Proper ordering of mapping entries in [domain_realms] section of krb5.conf

Greg Hudson ghudson at
Tue Dec 9 13:16:18 EST 2014

On 12/09/2014 12:32 AM, Todd Grayson wrote:
> What is the proper order for the [domain_realms] section of the krb5.conf
> with regard to rules being applied when there are mixed dns FQDN, domain
> names and REALMS.

The order of relations in a profile only matters for relations of the
same name (such as multiple values of "kdc" in a realm subsection).  For
[domain_realm], the library will search from most specific to least
specific regardless of the order of the domains in the profile.

> [domain_realm]

As an aside, you do not need a entry if you have a entry saying the same thing.  Older versions of our
documentation suggested putting in a entry, but there was
no reason for it.

More information about the Kerberos mailing list