SPNEGO authentication and multiple Kerberos service principals

[Scott Koranda]

> > I did this because servicePrincipal appears to be single-valued, whereas
> > support for more than one "realm" is obvious.
> 
> Realm is a bit of a misnomer there, all that's actually in there is the service principal and the credential source for it (keytab or password). So in effect it's really the service principal from what I can see.
> 
> > Is there any reason I should not do this?
> 
> No, it just loops.
> 
> > Should servicePrincipal be evolved to accept a list of strings?
> 
> I think that would throw off the code and make it more complex rather than less, it's more a naming issue. The parent bean could just be deprecated and renamed to shibboleth.ServicePrincipal or something like that, with no change in function.
> 
> Just file a bug on it (if you care enough to bother, it's not exactly a big deal).
> 

Agreed.

Thanks much,

Scott K