Multi-tenancy in MIT KDC

Tim Mooney Tim.Mooney at
Fri May 29 19:00:20 EDT 2015

In regard to: Multi-tenancy in MIT KDC, Firouzeh Jalilian said (at 10:24pm...:

> I would like to know if there is any support currently for multi-tenancy
> in MIT KDC?

What do you mean by multi-tenancy?  Do you mean one krb5kdc process
serving multiple distinct realms?  If so, then yes, that's possible.
We've served 11 different realms from one krb5kdc process.

You have to run separate kadmind processes, each on a separate port,
because those can't serve multiple realms.  On your secondary kdcs,
you also need to run a separate kpropd per realm, each on its own

We've done it for years and it works, but if we were starting over,
these days I'm not certain I would choose the same path.  Depending on
your realms, it might be better to use separate VMs or containers,
depending on what you're comfortable with.

Tim Mooney                                             Tim.Mooney at
Enterprise Computing & Infrastructure                  701-231-1076 (Voice)
Room 242-J6, Quentin Burdick Building                  701-231-8541 (Fax)
North Dakota State University, Fargo, ND 58105-5164

More information about the Kerberos mailing list