SPNEGO authentication and multiple Kerberos service principals

[Cantor, Scott]

> I did this because servicePrincipal appears to be single-valued, whereas
> support for more than one "realm" is obvious.

Realm is a bit of a misnomer there, all that's actually in there is the service principal and the credential source for it (keytab or password). So in effect it's really the service principal from what I can see.

> Is there any reason I should not do this?

No, it just loops.

> Should servicePrincipal be evolved to accept a list of strings?

I think that would throw off the code and make it more complex rather than less, it's more a naming issue. The parent bean could just be deprecated and renamed to shibboleth.ServicePrincipal or something like that, with no change in function.

Just file a bug on it (if you care enough to bother, it's not exactly a big deal).

-- Scott