X-RT-Interface: Web
MIME-Version: 1.0
Message-ID: <rt-4.4.4-26134-1594327589-828.8925-0-0@mit.edu>
X-Mailer: MIME-tools 5.507 (Entity 5.507)
Content-Transfer-Encoding: binary
Content-Type: text/html; charset="utf-8"
Content-Disposition: inline
References: <rt-4.4.4-26136-1594326664-257.0-0-0@mit.edu>
 <RT-Ticket-8925@mit.edu>
In-Reply-To: <rt-4.4.4-26136-1594326664-257.0-0-0@mit.edu>
X-RT-Original-Encoding: utf-8
RT-Send-CC:
Content-Length: 1440

Measures I have considered so far:<br />
<br />
* Implement canonicalization fallback for keytab search, as Heimdal does in its hostname canonicalization framework.&nbsp; If we did this, we might be able to get away with a qualify_shortname=&quot;&quot; default, sacrificing the TGS convenience.<br />
<br />
* Using getaddrinfo(gethostname()) to construct the local FQDN, regardless of dns_canonicalize_hostname value, under the theory that the local hostname will be listed in /etc/hosts.&nbsp; This wouldn&#39;t solve the GSS acceptor name case because we don&#39;t specifically know we&#39;re getting the local FQDN (unless we compared the supplied hostname to gethostname(), but that seems like it would create other edge cases).&nbsp; Also, I checked a few hosts under my control and found that one of them did not list the local hostname in /etc/hosts (so &quot;hostname -f&quot; goes to DNS).<br />
<br />
We might also consider delaying any transformation of the hostname until krb5_get_credentials/krb5_kt_et_entry time, so that we remember the original value.&nbsp; In the LAN case, hostname.ispdomain probably does not resolve, whereas the hostname alone does, so early shortname qualification gets in the way of fallback.&nbsp; Heimdal does this in its hostname canonicalization framework unless there is a single canonicalization rule of &quot;nss&quot;.&nbsp; (Well, more or less; it still removes trailing dots immediately.)