[22844] in Kerberos
Re: Is there an alternative to krb5.conf file????
daemon@ATHENA.MIT.EDU (Ken Raeburn)
Tue Nov 16 10:12:31 2004
In-Reply-To: <A3863F3136CBC546A40A61BA9CBA9D93ABD67F@sonusmail03.sonusnet.com>
Mime-Version: 1.0 (Apple Message framework v619)
Content-Type: text/plain; charset=US-ASCII; format=flowed
Message-Id: <D085A6E2-37E1-11D9-95BE-000A95909EE2@mit.edu>
Content-Transfer-Encoding: 7bit
From: Ken Raeburn <raeburn@mit.edu>
Date: Tue, 16 Nov 2004 10:11:38 -0500
To: "Ahluwalia, Ish" <iahluwalia@sonusnet.com>
cc: Ken Raeburn <raeburn@mit.edu>
cc: kerberos@mit.edu
Errors-To: kerberos-bounces@mit.edu
On Nov 15, 2004, at 17:45, Ahluwalia, Ish wrote:
> Is there an alternative to krb5.conf file to initialize and setup
> kerberos realm? I tried to use "krb5_set_default_realm" API call, but
> it didn't work. This api call asks for a char* to realm name which I
> provided for e.g. "REALM.COM". But some how when I use the API calls
> "krb5_sname_to_principal" and "krb5_unparse_name", kerberos prints a
> service name "service/nj.domain.com@domain.com". I service name
> should have been "service/nj.domain.com@REALM.COM".
> Any insight into this will be highly appreciated.
I believe that call sets the default local realm, not a single realm to
use for all hosts you might try to contact. Host-based service
principal names are still constructed by trying to determine a realm
for the indicated host.
> Essentially, I want to get away from setting up any kind kerberos
> configuration file for realm setup and want to do it through Kerberos
> API in an automated way.
If you create a config file with "dns_lookup_realm = yes" in the
"libdefaults" section, the library will look up TXT records in DNS when
trying to determine the host name to realm name mapping, so if you add
these records you could avoid realm-specific config information. This
should be covered in the documentation. However, it's a bit less
secure, so we don't turn it on by default, and you shouldn't expect
that other sites will be publishing such records.
Ken
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
