Re: principal name comparisons reflexive, type insensitive?

On Fri, Oct 14, 2011 at 3:36 PM, Harry Coin <[email protected]> wrote:
> Given:
>
> P1 - a principal with a name type other than 'unknown'.  and

Principal types are never taken into account for principal comparisons.

Principal types are purely informative.  They are particularly useful
when parsing a principal name, because the type tells the API
something about the syntax and semantics of the input arguments.
Principal types might also be useful for admin purposes (by
documenting what kind of principal a name was supposed to be), but
this never happens in practice.

> P2 - a principal whose text and realm matches P1 but with name type unknown
>
> Does krb5_principal_compare(P1,P2) == krb5_principal_compare(P2,P1) == TRUE?

Yes.  See above.  krb5_principal object comparisons ignore any name types.

krb5_principal objects will result from: authentication (in which case
a krb5_principal will come from a ticket or from KDC referrals), from
serialized names (e.g., as in ccaches, keytabs, ...), or from being
parsed from user/application inputs (as in krb5_parse_name() and
krb5_sname_to_principal()).  The name type is only of interest when
creating a krb5_principal from scratch (via krb5_parse_name() or
krb5_sname_to_principal()).

Nico
--