preferences-osx-10.2.html   [plain text]


<!-- #bbinclude "header.template"
  #PAGETITLE#="Kerberos Preferences on Mac OS X 10.2 Documentation"
  #BASEHREF#="" 
-->
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"
			"http://www.w3.org/TR/REC-html40/loose.dtd">
<HTML>
<HEAD> 
	<BASE HREF="http://web.mit.edu/macdev/KfM/Common/Documentation/preferences-osx-10.2.html">
  	<META NAME="keywords" CONTENT="#KEYWORDS#">
	<META NAME="description" CONTENT="#DESCRIPTION#">
	<TITLE>Kerberos Preferences on Mac OS X 10.2 Documentation</TITLE> 
	<STYLE TYPE="text/css">
		@import url(../../Common/Documentation/templates/site.css);
	</STYLE>
</HEAD>
<BODY>

<DIV ID="menu">
<IMG SRC="../../Common/Documentation/graphics/Kerberos.jpg" ALT="Kerberos for Macintosh Logo">
<HR>
<P><A HREF="../../Common/Documentation/index.html">Home</A></P>
<P><A HREF="http://web.mit.edu/kerberos/">MIT Kerberos</A></P>
<P><A HREF="http://web.mit.edu/ist/">MIT IS&amp;T</A></P>
<HR>
<P><A HREF="../../Common/Documentation/news.html">News</A></P>
<P><A HREF="../../Common/Documentation/documentation.html">Documentation</A></P>
<P><A HREF="../../Common/Documentation/developer.html">Developer Resources</A></P>
<P><A HREF="../../Common/Documentation/license.html">License</A></P>
<HR>
<P><A HREF="../../Common/Documentation/download.html">Download</A></P>
<P><A HREF="../../Common/Documentation/support.html">Support</A></P>
<P><A HREF="../../Common/Documentation/contact.html">Contact Us</A></P>
</DIV>
<DIV ID="body">
<!-- end bbinclude -->
<!-- #bbinclude "icon.template" #ICON#="graphics/KerberosPreferences.gif" 
	#TEXT#="<H2>Kerberos Preferences on Mac OS X 10.2 Documentation</H2>" -->
<TABLE BORDER=0 CELLSPACING=0 CELLPADDING=0>
   <TR VALIGN=middle>
      <TD ALIGN=center> <IMG CLASS=icon SRC="graphics/KerberosPreferences.gif" ALT="An icon image (description text to the right)" WIDTH=32 HEIGHT=32> </TD>
      <TD ALIGN=left> <H2>Kerberos Preferences on Mac OS X 10.2 Documentation</H2> </TD>
   </TR>
</TABLE>
<!-- end bbinclude -->

<P>This web page discusses the <CODE>edu.mit.Kerberos</CODE> (Kerberos configuration)
file: what's in it, where it goes, and how to configure it for distribution at
your site.</P>

<P>The information on this page applies to <B>Mac OS X 10.2 only</B>. For links to preferences
documentation for other Mac OS versions, click <a href="preferences.html">here</a>.</P>

<HR>
<UL>
	<LI><A HREF="#about">About the edu.mit.Kerberos File</A></LI>
	<LI><A HREF="#quickguide">Setting up a Configuration File Quick Guide</A></LI>
	<LI><A HREF="#locations">edu.mit.Kerberos File Locations (or, "Why are there two edu.mit.Kerberos files?")</A></LI>
	<LI><A HREF="#install">What to Install Where</A></LI>
	<LI><A HREF="#pfdf">About Kerberos Configuration Information</A></LI>
</UL>
<HR>

<H3><A NAME="about">About the edu.mit.Kerberos File</A></H3>

<P>The <CODE>edu.mit.Kerberos</CODE> file is where the Kerberos v4 and v5 configuration information is
stored on Mac OS X.  (Formerly the Kerberos Login Library and Kerberos management application
preferences were stored in it, but they now have their own preference files: <CODE>edu.mit.Kerberos.KerberosLogin.plist</CODE>
and <CODE>edu.mit.Kerberos.KerberosApp.plist</CODE>.)</P>

<P>The <CODE>edu.mit.Kerberos</CODE> file stores this information in its data
fork, which contains the realm and server configuration
information (the info that would be found in the <CODE>krb5.conf</CODE> file on
Unix). See the <A HREF="#pfdf">Kerberos Configuration</A> section for more
information.</P>

<P>On some systems there may be two <CODE>edu.mit.Kerberos</CODE> files.  See the
<A HREF="#locations">edu.mit.Kerberos File Locations</A> section for more
information about why this is so.</P>

<HR>

<H3><A NAME="quickguide">Setting up a Configuration File Quick Guide</A></H3>

<P>We recommend that you read this entire page.  However, if you are in a hurry to
get Kerberos for Macintosh up and working:</P>

<P>You need to create an <CODE>edu.mit.Kerberos</CODE> file in the
<CODE>/Library/Preferences</CODE> directory which contains the realm and server
configuration information for your site, although:</P>

<UL>
	<LI>if you upgraded from Mac OS X 10.1 with Kerberos for Macintosh 4.0, you probably
	already have a properly configured file and no changes are necessary to use it
	under Mac OS X 10.2;</LI>

	<LI>if you've run the Mac OS X 10.2 Kerberos Extras installer,
	you will already have a file in the correct place,
	but which contains MIT configuration information (which is provided as a guideline);</LI>

	<LI>if you have a functioning Mac OS 9.x Kerberos installation, you can simply copy
	the <CODE>Kerberos Preferences</CODE> file from the <CODE>Kerberos</CODE> folder
	in <CODE>Application Support</CODE> from your Mac OS 9 volume to the
	<CODE>/Library/Preferences</CODE> on your Mac OS X volume, and rename it to
	<CODE>edu.mit.Kerberos</CODE>.</LI>
</UL>

<P>If you do not have an <CODE>edu.mit.Kerberos</CODE> file:</P>

<OL>
	<LI>Create a file named <CODE>edu.mit.Kerberos</CODE> in <CODE>/Library/Preferences</CODE>,
		using BBEdit, emacs, or Codewarrior (it must be a plain text file);</LI>
	<LI>Place Kerberos realm and server configuration in the data fork of this file.  See the
		<A HREF="#pfdf">Kerberos Configuration</A> section for the proper format.</LI>
</OL>

<P>Note - while there may also be an <CODE>edu.mit.Kerberos</CODE> file in your
<CODE>/Users/username/Library/Preferences</CODE> directory, you should place
your configuration information in the <CODE>/Library/Preferences</CODE>
location. (See <A HREF="#locations">edu.mit.Kerberos File Locations</A> for more
details.)</P>

<HR>

<H3><A NAME="locations">edu.mit.Kerberos File Locations</FONT> (or, "Why are there two edu.mit.Kerberos files?")</A></H3>

<P>Kerberos for Macintosh supports and looks for two copies of the
<CODE>edu.mit.Kerberos</CODE> file - a "system"
<CODE>edu.mit.Kerberos</CODE> file that contains the configuration to be used by all
users of the computer, and a "user" <CODE>edu.mit.Kerberos</CODE>
file, containing additional configuration for an individual user.</P>

<P>The user <CODE>edu.mit.Kerberos</CODE> is located in
<CODE>/Users/username/Library/Preferences</CODE> (where "username" is the name
of the user), and the system <CODE>edu.mit.Kerberos</CODE> is located in
<CODE>/Library/Preferences</CODE> .</P>

<P>When KfM reads the configuration file, it first looks for it in the user
location, and if it doesn't find it, then looks for one in
the system location.</P>

<P>The typical case is to have the Kerberos
configuration information in the system configuration file, and no user configuration
file. However there may be circumstances where a user wants to have additional
realm and server information not shared with other users on the same machine.
You can add any additional realm and server configuration information to the
user configuration file, and KfM will meld the two sets of information
together.  You should be careful to avoid duplicate entries - if you have the same
entry with different information it is not guaranteed that the user config
file will override the system config file (we hope to fix this in a future release),
or you may see the same realm listed twice if it is in both files.  </P>

<P>Having just a user
configuration file and no system configuration file to fall back on is permitted,
but not recommended.</P>

<HR>

<H3><A NAME="install">What To Install Where</A></H3>

<P>On Mac OS X, the system Kerberos configuration file <CODE>edu.mit.Kerberos</CODE>
should be placed in <CODE>/Library/Preferences</CODE> .</P>

<HR>

<H3><A NAME="pfdf">About Kerberos Configuration Information</A></H3>

<P> The Kerberos v4 and v5 configurations are stored in the data fork of <CODE>edu.mit.Kerberos</CODE>.

<P>This text is similar to that of <CODE>krb5.conf</CODE> on Unix machines or <CODE>krb5.ini</CODE> on Windows machines.  
The configuration tells Kerberos for Macintosh what realms exist,
what Kerberos versions are supported by them, and where to find the servers.  You should
edit this file for your site by opening the <CODE>edu.mit.Kerberos</CODE> file in a text editor that 
will save the file as pure text again (ie: BBEdit, emacs, or CodeWarrior; but not TextEdit or 
Microsoft Word).</P>

<P>Once you are done editing the <CODE>edu.mit.Kerberos</CODE> file, you should reboot or log out,
and then you need to use the <a href="../../KerberosManager/Documentation/using.html#addrem">"Edit Favorite Realms"</a>
feature of the Kerberos management application to add your realms to the pop-up menu in the Login dialog. </P>

<P> Here is an example Kerberos configuration: </P>
	
<PRE>
	[libdefaults]
		default_realm = ATHENA.MIT.EDU
		noaddresses = TRUE

	[realms]
	        ATHENA.MIT.EDU = {
	                kdc = kerberos.mit.edu.:88
	                kdc = kerberos-1.mit.edu.:88
	                kdc = kerberos-2.mit.edu.:88
	                admin_server = kerberos.mit.edu.
	                default_domain = mit.edu
	        }
	        MEDIA-LAB.MIT.EDU = {
	                kdc = kerberos.media.mit.edu.
	                admin_server = kerberos.media.mit.edu.
	        }

	[domain_realm]
		.mit.edu = ATHENA.MIT.EDU
		mit.edu = ATHENA.MIT.EDU
		.media.mit.edu = MEDIA-LAB.MIT.EDU
		media.mit.edu = MEDIA-LAB.MIT.EDU

	[v4 realms]
	        ATHENA.MIT.EDU = {
	                kdc = kerberos.mit.edu.
	                kdc = kerberos-1.mit.edu.
	                kdc = kerberos-2.mit.edu.
	                admin_server = kerberos.mit.edu.
	                default_domain = mit.edu
	                string_to_key_type = mit_string_to_key
	        }
	        UMICH.EDU = {
	                kdc = kerberos.umich.edu.
	                admin_server = kerberos.umich.edu.
	                default_domain = umich.edu
	                string_to_key_type = afs_string_to_key
	        }

	[v4 domain_realm]
		.mit.edu = ATHENA.MIT.EDU
		mit.edu = ATHENA.MIT.EDU
		.umich.edu = UMICH.EDU
		umich.edu = UMICH.EDU</PRE>
		
<P>The <CODE>[libdefaults]</CODE> section describes what the default behavior of the Kerberos 
libraries should be.  You should always fill in the default realm.  If you have Kerberos 
v5 at your site, you should also copy any other <CODE>[libdefaults]</CODE> from your site's
<CODE>krb5.conf</CODE> or <CODE>krb5.ini</CODE>.</P>

<P>Note that Kerberos for Macintosh does not honor any <CODE>ticket_lifetime</CODE> entry in
<CODE>[libdefaults]</CODE> .  The default lifetime that will be used by both the
Kerberos Login dialog and kinit is the one you specify in the GUI Kerberos management
application preferences, although you can specify a different lifetime when you
log in if you want.</P>

<P>The <CODE>[realms]</CODE> and <CODE>[domain_realm]</CODE> sections refer to Kerberos v5 realms.
If your site is v4-only you should omit these sections.  Otherwise just copy these sections from
your site's <CODE>krb5.conf</CODE> or <CODE>krb5.ini</CODE>.</P>

<P>The <CODE>[v4 realms]</CODE> and <CODE>[v4 domain_realm]</CODE> sections refer to Kerberos v4 
realms.  If your site is v5-only you should omit these sections.  Otherwise you will need to
create entries for each of the Kerberos v4 realms at your site.  You must supply 
a Kerberos v4 <CODE>string_to_key_type</CODE> for each realm.  Currently the type can be 
either <CODE>mit_string_to_key</CODE> or <CODE>afs_string_to_key</CODE>.  If your site uses a 
different string_to_key function, please send us mail at 
<A HREF="mailto:krbdev@mit.edu">krbdev@mit.edu</A>.</P>

<!-- #bbinclude "footer.template" -->
</DIV>
<DIV ID="footer">
	<P>
		Copyright 2005 Massachusetts Institute of Technology.<BR>
		Last updated on $Date: 2005/05/04 18:24:31 $ <BR> 
		Last modified by $Author: lxs $ 
	</P>
</DIV>
<!-- Begin MIT-use only web reporting counter -->
	<IMG SRC="http://counter.mit.edu/tally" WIDTH=1 HEIGHT=1 ALT="">
<!-- End MIT-use only web reporting counter -->
</BODY></HTML>
<!-- end bbinclude -->