Keberos principal set incorrectly?

[ashmeer7]

In at least one environment, we had to specify the principal name both via the Giraffe API and via sun.security.krb5.principal property.

[bluekeyes]

I think this actually means that Giraffe is setting the principal property to the incorrect value. According to the javadoc the sun.security.krb5.principal property overwrites the value specified in the module by Giraffe.

Currently, Giraffe uses the username as the principal. In this environment, we know that the actual principal was different than the username. I suspect the code that failed passed the regular Linux username to Giraffe and then had to use the system property to specify the correct principal.

Giraffe should either clarify that it expects the principal instead of the username, or we should figure out how tools like SSH can automatically choose the correct principal (perhaps we shouldn't specify it at all, falling back to the system configuration).