Preliminary discussion: DB alias entries

[Greg Hudson]

On Tue, 2009-03-10 at 21:26 -0500, Nicolas Williams wrote:
> On Tue, Mar 10, 2009 at 10:16:32PM -0400, Greg Hudson wrote:
> > For service principals I believe this level of support is sufficient as
> > is, because we don't canonicalize service principal names anyway.  Does
> > that seem accurate?
> 
> Yes.  Has it been tested?

Just did that now.  You can't actually add an alias with addprinc -x
dn=... because the addprinc LDAP code refuses to touch an already
kerberized entry, but if you add other principals to a service key by
hand with ldapmodify, you can get service tickets under the other names
and they will work against a keytab with the original name (using
sclient and sserver as test cases).