On Thu, May 02, 2013 at 11:40:35AM -0700, Love H?rnquist ?strand wrote:

> > +	ret = krb5_cc_default(context, &ccache);
> > +	if (ret == 0) {
> > +	    ret = krb5_cc_get_principal(context, ccache, principal);
> > +	    krb5_cc_close(context, ccache);
> > +	    if (ret == 0)
> > +		return;
> > +	}
> > +
> > +	/*
> > +	 * Otherwise, search the keytab for the bare name of the default
> > +	 * principal.
> > +	 */
> > +	ret = krb5_get_default_principal(context, &tmp);
> > +	if (ret)
> > +	    krb5_err(context, 1, ret, "krb5_get_default_principal");
> > +	ret = krb5_unparse_name_flags(context, tmp,
> 
> this unparse/parse game seems weird, can you just update/set the realm ?

That was Nico's question also.  I was a bit concerned about the safety
of the set_realm API for principals with NULL realms.  Here we'd update
a principal with a NULL realm to set a specific realm.

The code seems to support this, but it is not documented to be a
valid use case.  For example, setting the realm to NULL will probably
segfault in strdup or if strdup() returns NULL with a NULL argument,
a false ENOMEM (misattributing the NULL value to a strdup memory
allocation failure).

So yes, if you're comfortable just updating the realm, that's perhaps
better.

-- 
	Viktor.