Re: multiple tgt's

[Harald Barth <haba@kth.se>]

> No, there's no cross trust, so thats not a problem 

At your site.

> (although it seems that even if there were, if one is doing setting
> up multiple tgt's, and since at least one will have to be a kinit
> (ie, not from login) that kinit would ask which one to give
> preference to if they are both valid for a given task).

The kinit is only giving you the tgt. The "ask" stage would be when
you invoke the afslog, telnet, ssh, imap or whatever service you'd
use.

> > How about a configuration option in /etc/krb5.conf?

> krb5.conf would work fine, although I'd prefer a less static option
> (if both were available).

As /etc/krb5.conf is read by the library that would be a way, but I
have no idea how to specify that logic for my users nor do I expect
them to understand it any better than using multiple KRB5CCNAMEs.

Harald.