Ubuntu
krb5 package

  1. Bug #571572
  2. Comment #6

Comment 6 for bug 571572

Revision history for this message
Russ Allbery (rra-debian) wrote : Re: [Bug 571572] Re: krb5 prefers the reverse pointer no matter what for locating service tickets.

Jesper Krogh <email address hidden> writes:

> Never the less it is a change from earlier versions of Ubuntu and a
> change that makes Ubuntu + Firefox work in a different way than MS
> Windows + MSIE (negoiating different tickets), thus breaking Single
> Signon in typical Kerberos enabled environments.. our is a corporate one
> with Active Directory as Kerbereos and both MS IIS and Ubuntu Apache +
> mod_auth_kerb on the serverside.

> Used to work.. lucid breaks it..

I'm confused why you're seeing a change, since in my experience it's been
this way for quite some time. Firefox used the final hostname, whereas IE
always used the URL name. When we deployed Negotiate-Auth with
mod_auth_kerb, we had to add both principals to the server keytab. Many
other people had the same issue, as discussed on the mod_auth_kerb mailing
list, which is why mod_auth_kerb added an option to use any principal in
its keytab. This all happened back in 2007 for us.

--
Russ Allbery (<email address hidden>) <http://www.eyrie.org/~eagle/>