Kerberos Login Handler and multiple KDCs

[Cantor, Scott]

> I specifically meant the LoginHandler code used in the IdP.

I don't know what login handler you mean. The only Kerberos code I'm aware of is the SPNEGO stuff, which is very different, and the JAAS module, which is not IdP code. There is no "Kerberos" login handler in the standard IdP for doing password checking against Kerberos. That's JAAS via the UsernamePassword handler.

> I've been
> unable to reproduce the 'bad' behavior with the Sun/Oracle JAAS module
> when I directly use it in plain-old Java code. So I'm pretty sure I can
> rule out the Sun/Oracle JAAS module.

Unless you're not using it, there is no other possible source. The issue is either that code, or how it's loaded and managed in the JAAS layer.

-- Scott