[27692] in Kerberos
Re: cross-realm authentication question
daemon@ATHENA.MIT.EDU (Russ Allbery)
Fri Apr 20 17:58:41 2007
From: Russ Allbery <rra@stanford.edu>
To: Rohit Kumar Mehta <rohitm@engr.uconn.edu>
In-Reply-To: <46292B5B.5060005@engr.uconn.edu> (Rohit Kumar Mehta's message of
"Fri, 20 Apr 2007 17:06:35 -0400")
Date: Fri, 20 Apr 2007 14:58:23 -0700
Message-ID: <87tzva6740.fsf@windlord.stanford.edu>
MIME-Version: 1.0
Cc: kerberos@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
Rohit Kumar Mehta <rohitm@engr.uconn.edu> writes:
> On my client (also running the same version of Ubuntu with libpam_krb5),
> I configured ssh for gssapi, and installed the keytab with the principal
> "host/cselin12.REALM1@REALM". I was able to "kinit rohitm@REALM2" and
> ssh to cselin12.REALM1 and login automatically when my default realm (in
> /etc/krb5.conf) was set to be REALM2. However, if I set it to be
> REALM1, it did not work and I get prompted for a password.
Did you create a ~/.k5login file in the home directory of the user to
which you're trying to log in that lists the principal in the other realm?
If ~/.k5login exists, Kerberos will use that for authorization; if it
doesn't, it falls back on krb5_aname_to_localname, which will fail for
cross-realm principals.
--
Russ Allbery (rra@stanford.edu) <http://www.eyrie.org/~eagle/>
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
