Hi All
Oracle's Java currently looks for the krb5.conf file in this order:
1: If -Djava.security.krb5.conf defined, use it
2: If jre/lib/security/krb5.conf found, use it
3: Looking for the system default krb5.conf
. /etc/krb5/krb5.conf on Solaris
. /etc/krb5.conf on Linux
. $WINDOWS/krb5.ini on Windows
. edu.mit.Kerberos or krb5.conf on Mac
We know native kerberos supports a KRB5_CONFIG env variable for the same
purpose. Hereby I suggest adding a check
1.5: If KRB5_CONFIG defined, use it
This will work with native Kerberos installation better. But there is
one compatibility issue that if you already have this variable set:
Current behavior: Java uses /etc/krb5.conf
Future behavior: Java uses KRB5_CONFIG
I wonder if that will be a problem in a real production environment.
Suppose you really have a different krb5.conf, you might have already
use -Djava.security.krb5.conf to override it.
I have more questions:
1. Is the value of this variable always a file path (either absolute or
relative)? Is it possible to be something like file:/etc/krb5.conf?
2. Should it always be honored? Is it possible that in a server
environment it should be ignored for security reasons? (If so, I wonder
how a server is defined).
Any suggestion?
Thanks
Max
