Re: Question about using Kerberos with AFS

[Ken Hornstein]

>What are all the problems, Ken?  If you do a krb5.conf file on your
>clients with a domain_realm section to map your DNS domain name to the
>Kerberos realm name, doesn't that essentially address any issues?

You'd _think_ that, wouldn't you?

The reality - not all software honors that setup (for example, I don't
think Win2K does), and updating all of those configuration files is
a huge pain.  Let's pretend that's not the issue.

The _real_ issue comes up with AFS compatibility.  You need to salt the
password with the correct realm name ... and that ends up being tricky.
Maybe part of this guy's problem was that his AFS cell name didn't
match his Kerberos realm name, so perhaps I'm overstating the problem.
But it _does_ make things harder; believe me, I'd try to avoid it
if at all possible.

--Ken