[30168] in Kerberos
Re: krb5_sname_to_principal question
daemon@ATHENA.MIT.EDU (Russ Allbery)
Tue Jul 29 15:27:21 2008
To: kerberos@mit.edu
In-Reply-To: <20080729162940.GA97188@lizzy.catnook.local> (Jos Backus's
message of "Tue\, 29 Jul 2008 09\:29\:40 -0700")
From: Russ Allbery <rra@stanford.edu>
Date: Tue, 29 Jul 2008 12:26:17 -0700
Message-ID: <87hca8mqzq.fsf@windlord.stanford.edu>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
Jos Backus <jos@catnook.com> writes:
> In Kerberos 1.5, krb5_sname_to_principal calls krb5_get_host_realm which
> (when KRB5_DNS_LOOKUP is defined) causes DNS to be queried for a
> _kerberos.FQDN TXT RR when no applicable domain_realm entry is found and
> dns_lookup_realm is set.
>
> In 1.6 the KRB5_DNS_LOOKUP ifdef'ed code was removed. This means that
> the domain_realm section HAS to have a matching entry for the machine,
> mapping it into a realm, whereas in 1.5 this didn't need to be the case
> if the above conditions were met.
I believe this was to support server-side referrals. The idea is that the
client will ask the server for a principal with an empty realm and the
server will figure out the realm.
I don't know exactly how this works, though.
--
Russ Allbery (rra@stanford.edu) <http://www.eyrie.org/~eagle/>
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
