k5userok .c / doc mismatch
Harry Coin <[email protected]>
| Newsgroups | gmane.comp.encryption.kerberos.heimdal.general |
|---|---|
| Message-ID | <[email protected]> |
In k5userok.c we have, in cases neither /.k5login or k5login.d exist:
From: https://github.com/heimdal/heimdal/blob/master/lib/krb5/kuserok.c
...
static krb5_boolean
match_local_principals(krb5_context context,
krb5_principal principal,
const char *luser)
{
krb5_error_code ret;
krb5_realm *realms, *r;
krb5_boolean result = FALSE;
/* multi-component principals can never match */
if(krb5_principal_get_comp_string(context, principal, 1) != NULL)
return FALSE; ... While,
http://www.h5l.org/manual/HEAD/krb5/group__krb5__support.html#ga6368eceea4261ef2ccb8dc39ecc87772
Has: ...The user may have a ~/.k5login file listing principals that are
allowed to login as that user. If that file does not exist, all
principals with a first component identical to the username, and a realm
considered local, are allowed access....
Perhaps I may be forgiven causing fuss about why princicpal
XYZ/box.domain.org gets oddly mapped to 'nobody' though local account
'XYZ' exists.