Kerberos and IP aliases

[Mark Davies]

Russ Allbery wrote:
> In some cases the client will just use whatever hostname is given on
> the command line, but in many cases it will do a forward and reverse
> DNS lookup to canonicalize the hostname (although this is less
> secure if you can't trust DNS, and most people can't).  So in
> practice the server needs to have a key for all identities that
> might result from either of those approaches. 

Is there a way to have modauthkerb able to accept multiple identities 
for a single web site? I couldn't see an obvious way to configure it.

We used to have this setup:

	www.mcs.vuw.ac.nz cname for p.mcs.vuw.ac.nz
	p.mcs.vuw.ac.nz A	A.B.C.D
	D.C.B.A.in-addr.arpa	ptr p.mcs.vuw.ac.nz

web site always referenced as www.mcs.vuw.ac.nz. server had key for 
HTTP/p.mcs.vuw.ac.nz

This worked fine for firefox on windows, mac and unix
konqueror on unix and IE on windows but Safari on mac would try 
HTTP/www.mcs.vuw.ac.nz and so fail.

In an attempt to get Safari working I changed the www.mcs.vuw.ac.nz 
cname entry to an A record for A.B.C.D and changed the web server to 
have a key for HTTP/www.mcs.vuw.ac.nz.  Safari now works, IE and 
konqueror continue to work as does Firefox on Windows and UNIX but 
Firefox on Mac now fails (it tries to use the principle 
HTTP/p.mcs.vuw.ac.nz).  I don't understand why firefox's dns lookup 
behaviour is platform specific.

cheers
mark