Re: aname_to_locaname vs gssapi svc/host.domain.org@REALM

Harry Coin <[email protected]>
Newsgroups gmane.comp.encryption.kerberos.heimdal.general
Message-ID <[email protected]> 
On 10/12/2011 1:09 PM, Jeffrey Hutzelman wrote:
> Note that this function is not the_authorization_  mechanism for such
> access; that's what krb5_kuserok() is for.
Note krb5_kuserok() is indeed called by this function -- doing 
authentication+authorization but only in the event of a two part 
principal name ending in /root.   Let it be just 'root@realm' and you 
get realm checking but nothing more.


-HC
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.