SPNEGO authentication and multiple Kerberos service principals

[Scott Koranda]

Hi,

Some OS and browser combinations, most notably FireFox on Debian 8, when
using SPNEGO will use the TGT to obtain a service principal of the form

HTTP/my.server.campus.edu at MY.ORG

Note that the browser bar shows 'my.server.org' and not
'my.server.campus.edu'. 'my.server.org' is a CNAME for
'my.server.campus.edu'.

Since we configured the IdP with only the single principal

HTTP/my.server.org at MY.ORG

this caused SPNEGO to not function for FireFox on Debian 8 and some
other combinations.

The solution appears simple. I just edited conf/authn/spnego-authn-config.xml
and added an extra "realm" that points at the same keytab file (just easier 
to put them both in one keytab file):

<util:list id="shibboleth.authn.SPNEGO.Krb5.Realms">

    <bean parent="shibboleth.KerberosRealmSettings"
        p:servicePrincipal="HTTP/my.server.org at MY.ORG"
        p:keytab="/opt/shibboleth-idp/credentials/httpd.keytab" />

    <bean parent="shibboleth.KerberosRealmSettings"
        p:servicePrincipal="HTTP/my.server.campus.edu at MY.ORG"
        p:keytab="/opt/shibboleth-idp/credentials/httpd.keytab" />

</util:list>

I did this because servicePrincipal appears to be single-valued, whereas
support for more than one "realm" is obvious.

This appears to work.

Is there any reason I should not do this?

Should servicePrincipal be evolved to accept a list of strings?

Thanks,

Scott K