Well, that at least explains it. You could call it a misfeature, or just an unanticipated consequence. I suspect what we're doing here is a rare case.
If it's not going to change anytime soon, some documentation in the right place (e.g. admin or install manual) could help. Thanks, -- Abe On Mon, Feb 22, 2010 at 06:13:08PM -0500, Greg Hudson wrote: > > On Mon, 2010-02-22 at 16:54 -0500, Abe Singer wrote: > > When a Kerberized daemon (server) gets contacts by a client, the server > > does a name lookup of *all* the KDCs in the realm before attempting to > > contact > > any KDC. > [...] > > So, is this behavior intentional, or a bug triggered by an unusual > > situation? > > This behavior follows from the internal APIs. krb5_locate_kdc takes a > realm name and returns a complete list of addresses, and then > krb5_sendto_kdc iterates over the address list. So it's not a bug, > although I'd be happy to call it a misfeature. There are some > complications in the way of changing the behavior (specifically, a > plugin interface which assumes the realm -> addrlist interface), so I > don't know if it's likely to get better in the near future. > > ________________________________________________ Kerberos mailing list [email protected] https://mailman.mit.edu/mailman/listinfo/kerberos
