Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 1 down vote favorite

Should two deployed applications within a private network requiring distinct databases (for storing their own users credentials) require distinct Authentication servers (implementing Kerberos)? Or is there a way to expect Kerberos to choose corresponding database according to the nature of the client application?

share|improve this question
I'm having trouble understanding your question. I'm not sure how Kerberos is is involved in choosing between databases. Are you authenticating the communication between application and database using Kerberos tickets? Or are the users of the applications authenticating using Kerberos tickets? – Gabe Oct 5 '12 at 19:51
Your applications should choose the Kerberos server based on the Kerberos realm being used to authenticate with if the application is Kerberos aware. If it is using something like pam_krb5 then assumptions will be made based on default_realm in krb5.conf. It sounds like you are trying to do some sort of access control by having separate servers with separate users. I would look at trying to setup some other form or access control list that would allow one set of credentials to work on either server as long as the user has been granted access. LDAP groups would be something to consider. – chuck May 16 at 16:00

Know someone who can answer? Share a link to this question via email, Google+, Twitter, or Facebook.

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.