On 04/08/2016 05:10 PM, Martin Babinsky wrote:
I have put together a draft  outlining the effort to reimplement
the handling of Kerberos principals in both backend and frontend
layers of FreeIPA so that we may have multiple aliases per user, host
or service and thus implement stuff like
Since much of the plumbing was already implemented, the document
mainly describes what the patches do. Some parts required by other use
cases may be missing so please point these out.
I would also be happy if you could correct all factual inacurracies, I
did research on this issue a long time ago and my knowledge turned a
Currently DS is enforcing that 'krbPrincipalName' and
'krbCanonicalName' are unique.
krbPrincipalName is caseExactIA5Match.
Is it possible to imagine entries having the same (IgnoreCase) alias:
So KDB, searching as case insentive
retrieve user_one and user_two ?
Manage your subscription for the Freeipa-devel mailing list:
Contribute to FreeIPA: http://www.freeipa.org/page/Contribute/Code