Proper ordering of mapping entries in [domain_realms] section of krb5.conf

Todd Grayson tgrayson at cloudera.com
Tue Dec 9 00:32:09 EST 2014


What is the proper order for the [domain_realms] section of the krb5.conf
with regard to rules being applied when there are mixed dns FQDN, domain
names and REALMS.

Should the [domain_realms] section be listed from most specific to least
specific

for example
[domain_realm]
specific-host.domain.name = REALM.NAME
domain.name = OTHER.REALM.NAME
.domain.name = OTHER.REALM.NAME

or is it least specific to most specific?

[domain_realm]
domain.name = OTHER.REALM.NAME
.domain.name = OTHER.REALM.NAME
specific-host.domain.name = REALM.NAME

Thanks in advance!

-- 
Todd Grayson
Customer Operations Engineering


More information about the Kerberos mailing list