Should two deployed applications within a private network requiring distinct databases (for storing their own users credentials) require distinct Authentication servers (implementing Kerberos)? Or is there a way to expect Kerberos to choose corresponding database according to the nature of the client application?

  • I'm having trouble understanding your question. I'm not sure how Kerberos is is involved in choosing between databases. Are you authenticating the communication between application and database using Kerberos tickets? Or are the users of the applications authenticating using Kerberos tickets? – Gabe Oct 5 '12 at 19:51
  • 2
    Your applications should choose the Kerberos server based on the Kerberos realm being used to authenticate with if the application is Kerberos aware. If it is using something like pam_krb5 then assumptions will be made based on default_realm in krb5.conf. It sounds like you are trying to do some sort of access control by having separate servers with separate users. I would look at trying to setup some other form or access control list that would allow one set of credentials to work on either server as long as the user has been granted access. LDAP groups would be something to consider. – chuck May 16 '13 at 16:00
  • What database software? Why not use the same username for both? What problem are you trying to solve? – Ben Jan 21 '14 at 16:25