Kerberos Authn default realm

[Terry Fleury]

Thanks Scott, that works. I am already using a custom script for
attributes, so it is easy to strip off @TERAGRID.ORG.

-Terry

On 2016-09-26 10:06 AM, Cantor, Scott wrote:
> On 9/26/16, 10:51 AM, "users on behalf of Terry Fleury" <users-bounces at shibboleth.net on behalf of tfleury at illinois.edu> wrote:
> 
>> Is there a bean for default realm in krb5-authn-config.xml ? Or is there
>> some other method to specify a default realm for Shib IdP v.3? I'm not a
>> Kerberos expert, so perhaps I'm simply not using the keytab correctly.
> 
> I don't believe there's anything implemented directly, it's taking whatever's provided as a principal name and passing it into the libraries.
> 
> All specifying a default realm would really do, I think, is just auto-attach the realm to the principal to qualify it. So in that vein, I think the solution is probably just to apply a pre-validate transform to the principal name that takes one without a realm and adds what you want.
> 
> See [1], shibboleth.authn.Password.Transforms
> 
> Of course in turn that may impact the principal name that pases into the c14n step and you may need to deal with it there. It sounds like you want all the IdP traffic going to one realm but the box to have a different default, in which case adding it with that bean and then stripping it via c14n is the right thing.
> 
> -- Scott
> 
> [1] https://wiki.shibboleth.net/confluence/display/IDP30/PasswordAuthnConfiguration
>