IBM RS/6000 SP, Problem Determination Manual

Page: 92 / 316

This soft copy for use by IBM employees only.
3.2 Terminology
Kerberos clients (user) and services are uniquely identified by a principal
identifier, which consists of three components:
• A principal name
•
An instance name
•
A realm name
3.2.1 Principal
Kerberos defines a name space of authenticated users and services. Each
different client and service has a unique
principal name. An RS/6000 SP user
who wishes to use any Kerberos-authenticated service must be registered to
Kerberos (by using
kadmin
or
kdb_edit
commands). By virtue of this registration,
the user then becomes a Kerberos user (also known as a principal). A private
DES key is created for the user and stored in the Kerberos database.
Note that the Kerberos name space is unrelated to the AIX name space, so that
an individual may be known by one name to Kerberos and by another name to
AIX. However, it is more convenient to assign the same name in each space.
It is possible to have multiple AIX users all using the same Kerberos user to
gain access to authenticated services. For example, you can do the following:
1. Define two non-root AIX users, Fred and Joe, on the Control Workstation
(make sure that the users are exist on the nodes, as well).
2. Use the command /usr/kerberos/bin/kadmin to add a Kerberos user called
kerb.
3. Create a new file, .klogin, in the home directory of the two new AIX users.
This file should contain a line similar to kerb@SP21CW0.
4. Log on as either user Fred or Joe and execute
kinit kerb
. The user can
now run any of the Kerberos-authenticated commands.
A principal can also refer to a Kerberos-protected service. In this way server
programs can be authenticated. For example, the hardmon service principal is
used by the hardmon and splogd server daemons.
3.2.2 Instance
The instance name is a label that allows the same client or service to exist in
several different forms that each require distinct authentication. In the case of
services, an instance may specify the host that provides the service. For client
principals, the instance can be useful when one wishes to have different
identifiers for different privileges. The usual case is that users operate using a
name with a null instance.
For example, the client or user principal “root.admin” represents an instance
(admin) used for administrative tasks. The service principal “hardmon.sp21cw0”
represents an instance (sp21cw0) indicating the node providing the service.
72
SP PD Guide