Null realms and servers
rra at stanford.edu
Sat Dec 16 13:51:05 EST 2006
Nicolas Williams <Nicolas.Williams at sun.com> writes:
> On Fri, Dec 15, 2006 at 07:08:52PM -0500, Jeffrey Altman wrote:
>> I agree that your proposal is a finer grained approach to determining
>> the realm. It does have the property that it might find the right
>> realm under some circumstances, but I am aware of plenty of
>> environments in which the failure to provide a domain realm mapping
>> when combined with your algorithm would produce the wrong realm for the
>> machine when the default realm specified in the krb5 profile is
>> For a server which is the most frequently used case of a keytab file,
>> the most common configuration of the machine existing in a single realm
>> (the default realm) should just work.
> The point is to provide a domain2realm that works with zero
> configuration; where you would need configuration to deal with special
> environments then you wouldn't use this scheme.
> There are many sites where this approach would provide the best possible
> results given zero configuration.
I believe assuming the default realm will be accurate in significantly
more circumstances than using any algorithm based on the name of the
Russ Allbery (rra at stanford.edu) <http://www.eyrie.org/~eagle/>
More information about the krbdev