> The former is really easy. The user can authenticate with multiple kerberos
> realms quite easily, just by specifying different ticket caches when using kinit
> (I open a new session and set KRB5CCNAME).
You call that *easy*??
However, IIRC from last I used kerberos, you can actually kinit to multiple realms just fine without
setting random environment variables.
Posted Jan 15, 2010 12:27 UTC (Fri) by paulj (subscriber, #341)
[Link]
It's not random, it's documented in the kinit manual page.
You need an environment variable really, otherwise every krb5-or-GSS using
client you run needs to have an explicit option (argument, conf file, and/or in the
UI) to specify the ticket cache.
It's not as transparent as using having SSH keys though, unfortunately.