On Thu, May 22, 2014 at 09:42:15AM -0400, Simo Sorce wrote:
> > Is it possible to have a user foo in domain
example.com
that has a
> > principal of bar(a)EXAMPLE.COM ? And at the same time also have a user
> > 'bar' in the same domain ?
> > Is this the case you are trying to handle ? How likely is it ?
>
> no, I think this is quite unlikely. My concern was more related to
> performance. If we decide that name@REALM is a principal because we
> didn't find user 'name' in domain 'REALM' we have to iterate
over all
> configured domains and check if there is a user with the given
> principal. If the domain is known for the principal we cannot only skip
> the user lookup but can search the given domain directly. The krb5
> localauth will be able to give the right domain in all the cases where
> the user logs in with a fully qualified name or if fully qualified names
> are used as canonical names.
If we index the principal names, a perfect match search will be quite
fast, I do not think performance will be a big deal.
I think the performance hit comes even earlier. If you need to check if
name@REALM is a user name in a domain REALM, you need to start N
searches for N configured domains and only then you will start searching
by the principals.