-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On Thu, 29 Jun 2006 at 18:43 (-0400), Marcus Watts wrote:
> As long as the KDCs are in different realms, you ought to be able to use
> one context, and one KRB5_CONFIG file, to access both.
Marcus,
But each time I call my subroutine, I get a new context.
> As it happens, I've been using Jeff's code for some other stuff.
>
> So, at a closer look at Jeff Horwitz's code, looks like he expects
> Authen::Krb5::init_context(). He's got this right before:
> if (context) croak("Authen::Krb5 already initialized");
I ran into this problem a while back and contacted Jeff about it. He
suggested the fix you mentioned (to free_context()), which I implemented.
So I don't have the problem of the context hanging around, because I do a
free_context() at the end of my subroutine.
Ken,
You said,
> If these KDCs are for two different realms, can you list both config
> files in KRB5_CONFIG?
But then how do I get the *default realm* set correctly? In my script, I
do a parse_name() to create a principal object corresponding to the TGS
service principal (e.g., krbtgt/<realm>@<realm>). (It's this principal
object that I must pass to get_in_tkt_with_password()). And,
unfortunately, parse_name() complains if my config file doesn't have a
default realm, so defining both realms in the [realms] stanza doesn't do
me any good. But if I do define a default realm, then that's the KDC to
which I get connected, regardless of the realm name I specify when
constructing the TGS service principal name itself.
So, it seems I need to point to a different config file each time I want
to go to a different KDC. And, I don't know any way except the
KRB5_CONFIG environment variable to do it from within my subroutine code.
But given that I get a new context each time, why can't I reset the value
of KRB5_CONFIG on each call and have it be honored? This is the crux of
the matter, apparently.
Mike
_________________________________________________________________________
Mike Friedman System and Network Security
[EMAIL PROTECTED] 2484 Shattuck Avenue
1-510-642-1410 University of California at Berkeley
http://socrates.berkeley.edu/~mikef http://security.berkeley.edu
_________________________________________________________________________
-----BEGIN PGP SIGNATURE-----
Version: PGP 6.5.8
iQA/AwUBRKRlFq0bf1iNr4mCEQLQHQCgxz3mmbhs+OrzL/ZQhZktn3bjU50An0Hf
qj1COxhUJfhwQIG9R6T8/Lxj
=011B
-----END PGP SIGNATURE-----
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
