On Sun, 2010-12-19 at 14:36 -0500, Russ Allbery wrote: > It uses whatever one the client uses, in general.
Actually, as of MIT krb5 1.7, we usually ignore the principal sent by the client, because it might be an alias. If the server application doesn't specify a principal, we just try every entry in the keytab until we find one which can decrypt the ticket. (The exception is when we're using a keytab with no iterator methods, such as the KDB keytab.) > There are some services > that limit what principals they'll accept to only that one principal that > matches what the service thinks is the local hostname, but given how many > problems this causes, an increasing number of services will accept any > principal found in the system keytab. This is still true. ________________________________________________ Kerberos mailing list Kerberos@mit.edu https://mailman.mit.edu/mailman/listinfo/kerberos
