Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Should two deployed applications within a private network requiring distinct databases (for storing their own users credentials) require distinct Authentication servers (implementing Kerberos)? Or is there a way to expect Kerberos to choose corresponding database according to the nature of the client application?

share|improve this question
I'm having trouble understanding your question. I'm not sure how Kerberos is is involved in choosing between databases. Are you authenticating the communication between application and database using Kerberos tickets? Or are the users of the applications authenticating using Kerberos tickets? – Gabe Oct 5 '12 at 19:51
Your applications should choose the Kerberos server based on the Kerberos realm being used to authenticate with if the application is Kerberos aware. If it is using something like pam_krb5 then assumptions will be made based on default_realm in krb5.conf. It sounds like you are trying to do some sort of access control by having separate servers with separate users. I would look at trying to setup some other form or access control list that would allow one set of credentials to work on either server as long as the user has been granted access. LDAP groups would be something to consider. – chuck May 16 '13 at 16:00
What database software? Why not use the same username for both? What problem are you trying to solve? – Ben Jan 21 '14 at 16:25

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.