Initial Auth Realm Fall-back

[Shawn M Emery]

On 08/19/13 02:44 PM, Russ Allbery wrote:
> "Henry B. Hotz" <hotz at jpl.nasa.gov> writes:
>> Shouldn't the fallback option be in [appdefaults] instead?
> Not if you want it to affect every library caller, which sounded like the
> goal (so that it would affect kinit and any gic application).

Yes, that was an additional goal over the current pam_krb5 solution.

>> For the specific case of all the realms satisfying the NIST 800-63
>> constraints on cross-realm relationships I think it's OK.  (From memory:
>> that's all realms under the same administrative control, and all
>> usernames synchronized, but don't hold me to it.)
> If you have cross-realm, it's not at all clear that you would need this.
> I expect it to be the most useful for client-side pseudo-merging of
> multiple realms where you *don't* have cross-realm.

Sorry, the realm names in the example should have not implied any form 
of hierarchy.

Shawn.
--