On Mon, 10 Apr 2000, Olaf Titz wrote:
[snip]
> > The problem I have with this approach is that it only allows one level of
> > grouping. So if you look at Kerberos .conf files, you'll find that in
> > some cases then ended up needing an additional level of grouping, and so
> > you get a hybrid:
> >
> > | [realms]
> > | stanford.edu = {
> > | kdc = krb5auth1.stanford.edu:88
> > | kdc = krb5auth2.stanford.edu:88
> > | kdc = krb5auth3.stanford.edu:88
> > | admin_server = krb5-admin.stanford.edu
> > | default_domain = stanford.edu
> > | }
>
> Ouch. That's really bad. In this case probably they should use one
> file called "realms" and make "stanford.edu" a group there, and put
> the rest into another file. Or use another format.
Much as I hate to admit it, I have to work with MS stuff every day. They
have this problem too, and a typical solution would be:
[realms]
stanford.edu = stanford_section
[stanford_section]
kdc1 = krb5auth1.stanford.edu
kdcport1 = 88
kdc2 = krb5auth2.stanford.edu
kdcport2 = 88
kdc3 = krb5auth3.stanford.edu
kdcport3 = 88
admin_server = krb5-admin.stanford.edu
default_domain = stanford.edu
FWIW
-- Mark H. Wood, Lead System Programmer mwood@IUPUI.Edu "Where's the kaboom? There was supposed to be an Earth-shattering kaboom!" -- Marvin Martian, 01/01/2000 00:00:00- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/
This archive was generated by hypermail 2b29 : Sat Apr 15 2000 - 21:00:14 EST