[19171] in Kerberos_V5_Development
Re: get_cred starting realm
daemon@ATHENA.MIT.EDU (Nico Williams)
Thu Apr 30 16:45:28 2015
Date: Thu, 30 Apr 2015 15:45:17 -0500
From: Nico Williams <nico@cryptonector.com>
To: Greg Hudson <ghudson@mit.edu>
Message-ID: <20150430204516.GD6026@localhost>
MIME-Version: 1.0
Content-Disposition: inline
In-Reply-To: <20150430202302.GC6026@localhost>
Cc: krbdev@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krbdev-bounces@mit.edu
On Thu, Apr 30, 2015 at 03:23:03PM -0500, Nico Williams wrote:
> On Thu, Apr 30, 2015 at 03:40:40PM -0400, Greg Hudson wrote:
> > I think the two other viable options are:
> >
> > 1. Make kinit -n and krb5_gss_accept_sec_context() responsible for
> > setting a start-realm config entry when the local TGT realm differs from
> > the client principal realm. Basically, treat the edge cases as
> > exceptional and force them to be addressed at the highest possible layers.
>
> I'd live with this because it'd at least interop with Heimdal and could
> be implemented by other stacks that implement the FILE ccache format.
>
> But I won't contribute patches to implement (1) because I'd have to also
> submit patches for third-party applications like pam_krb5, and I'm not
> interested in boiling oceans in general. See more below.
I misread Greg's (1) proposal. It's fine and requires no changes to
existing applications not in-tree. I'd still prefer always writing the
start-realm ccconfig because for FILE ccaches doing so means that it
will always be found quickly.
Nico
--
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
