| |
What is a Kerberos Principal?
A Kerberos principal is a unique identity to which Kerberos can
assign tickets. Principals can have an arbitrary number of
components. Each component is separated by a component separator,
generally `/'. The last component is the realm, separated from the
rest of the principal by the realm separator, generally `@'. If there
is no realm component in the principal, then it will be assumed that
the principal is in the default realm for the context in which it is
being used.
Traditionally, a principal is divided into three parts: the
primary, the instance, and the realm. The format of
a typical Kerberos V5 principal is primary/instance@REALM.
- The primary is the first part of the principal. In the case
of a user, it's the same as your username. For a host, the primary is
the word
host.
- The instance is an optional string that qualifies the
primary. The instance is separated from the primary by a slash
(
/). In the case of a user, the instance is usually null, but a
user might also have an additional principal, with an instance called
admin, which he/she uses to administrate a database. The
principal [email protected] is completely
separate from the principal
jennifer/[email protected], with a separate
password, and separate permissions. In the case of a host, the instance
is the fully qualified hostname, e.g.,
daffodil.mit.edu.
- The realm is your Kerberos realm. In most cases, your
Kerberos realm is your domain name, in upper-case letters. For example,
the machine
daffodil.example.com would be in
the realm EXAMPLE.COM.
|
|
