search

jcmturner / gokrb5

Pure Go Kerberos library for clients and services
Apache License 2.0
725 stars 248 forks source link

Should `DNSLookupKDC` default to `true` to match `man krb5.conf` ? #544

Open ae-govau opened 4 months ago

ae-govau commented 4 months ago

man krb5.conf (https://linux.die.net/man/5/krb5.conf) states:

dns_lookup_kdc Indicate whether DNS SRV records should be used to locate the KDCs and other servers for a realm, if they are not listed in the information for the realm. The default is to use these records.

whereas this library defaults DNSLookupKDC to false.

Is this a deliberate choice?

It's making it a bit challenging to use in one of our envs - where the krb5.conf is managed centrally. They don't currently set a value for dns_lookup_kdc and systems that don't use this library work fine, as they default to true, whereas those that do use this library don't work.

(thanks for providing the lib! we're using it via https://github.com/IBM/sarama)

oleksandrkorzhenevskyi commented 2 months ago

@ae-govau hi! Did you get any feedback from the owner of the repository? Maybe, via other channels. My team uses the sarama client, and we want to modify this Kerberos library too. I wonder how well it is maintained.

ae-govau commented 2 months ago

No I didn't get any feedback.