[19693] in Kerberos_V5_Development
Re: principal aliases?
daemon@ATHENA.MIT.EDU (Simo Sorce)
Tue Nov 21 20:32:50 2017
Message-ID: <1511314340.9952.40.camel@redhat.com>
From: Simo Sorce <simo@redhat.com>
To: Chris Hecker <checker@d6.com>, Benjamin Kaduk <kaduk@mit.edu>
Date: Tue, 21 Nov 2017 20:32:20 -0500
In-Reply-To: <CAOdMLc2OU=ODtVix4+P+hsnG6R44_ePJtFp5-OCnbAQW5=txkw@mail.gmail.com>
Mime-Version: 1.0
Cc: krbdev@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krbdev-bounces@mit.edu
This is right.
The way to do it is to set krbCanonicalName to the real name, and
krbPrincipalName then can contain any number of aliases. Note the
latter should also contain the canonical name and be a comprehensive
list.
Simo.
On Tue, 2017-11-21 at 16:59 -0800, Chris Hecker wrote:
> There is code that checks krbCanonicalName...hmm, it looks like maybe for
> MIT krbPrincipalName can have multiple entries and that's how aliases are
> done and krbPrincipalAliases is only on Heimdal...
>
> Chris
>
>
> On Tue, Nov 21, 2017 at 4:56 PM, Chris Hecker <checker@d6.com> wrote:
>
> > No, I meant, how does the KDC actually query for them since it doesn't
> > appear to be in the code anywhere I can find? I haven't set it up to test
> > yet, but I'm trying to see how it could possibly work when it's not in the
> > ldap queries...hopefully I'm missing something.
> >
> > Chris
> >
> >
> > On Tue, Nov 21, 2017 at 4:53 PM, Benjamin Kaduk <kaduk@mit.edu> wrote:
> >
> > > On Tue, Nov 21, 2017 at 04:43:58PM -0800, Chris Hecker wrote:
> > > > Oh, really? That's cool, I couldn't find krbPrincipalAliases (case
> > > > insensitive) in the entire 1.15.2 source code except for the schema and
> > > > ldif files...how does that work? I don't mind creating them myself, no
> > > > problem.
> > >
> > > The only documentation I know of is at the end of
> > > http://web.mit.edu/kerberos/krb5-latest/doc/admin/conf_ldap.html .
> > > There's probably other references in the list archives, though it's
> > > unclear exactly how helpful they would be.
> > >
> > > -Ben
> > >
> >
> >
>
> _______________________________________________
> krbdev mailing list krbdev@mit.edu
> https://mailman.mit.edu/mailman/listinfo/krbdev
--
Simo Sorce
Sr. Principal Software Engineer
Red Hat, Inc
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
