Host-realm pluggable interface scope questions
ghudson at MIT.EDU
Mon Jun 17 12:12:41 EDT 2013
We've been asked to make a pluggable interface for host-realm
translation, and I thought it might be helpful to discuss the
appropriate scope before getting into details.
Obviously krb5_get_host_realm() and krb5_get_fallback_host_realm() are
in scope. But:
* Should krb5_get_default_realm() be in scope? One can think of this as
a special case of krb5_get_host_realm(), and some of the same
mechanisms have historically applied (such as TXT lookups).
* Should hostname canonicalization be in scope? This is performed by
krb5_sname_to_principal(), not krb5_get_host_realm(), but
sname-to-principal is one of only two consumers of
* Should hostname "cleaning" be in scope? This is where we convert
hostnames to lower-case and strip off any trailing dot.
* Should plugin modules be able to return multiple answers for the host
realm? Our APIs currently allow this (for realm-of-host and
fallback-realm-of-host, not for default-realm) but we only ever
produce or consume one answer at the moment.
More information about the krbdev