[libdefaults]
	default_domain = AD.ENGR.WISC.EDU
	default_realm = AD.ENGR.WISC.EDU
	krb4_config = /etc/krb.conf
	krb4_realms = /etc/krb.realms
	kdc_timesync = 1
	ccache_type = 4
	forwardable = true
	proxiable = true
	v4_instance_resolve = false
	v4_name_convert = {
		host = {
			rcmd = host
			ftp = ftp
		}
		plain = {
			something = something-else
		}
	}
	fcc-mit-ticketflags = true
	default_tgs_enctypes = RC4-HMAC DES-CBC-MD5 DES-CBC-CRC
	default_tkt_enctypes = RC4-HMAC DES-CBC-MD5 DES-CBC-CRC
	preferred_enctypes = RC4-HMAC DES-CBC-MD5 DES-CBC-CRC
	dns_lookup_kdc = true

# The following krb5.conf variables are only for MIT Kerberos.

# The following encryption type specification will be used by MIT Kerberos
# if uncommented.  In general, the defaults in the MIT Kerberos code are
# correct and overriding these specifications only serves to disable new
# encryption types as they are added, creating interoperability problems.
#
# Thie only time when you might need to uncomment these lines and change
# the enctypes is if you have local software that will break on ticket
# caches containing ticket encryption types it doesn't know about (such as
# old versions of Sun Java).

#	default_tgs_enctypes = des3-hmac-sha1
#	default_tkt_enctypes = des3-hmac-sha1
#	permitted_enctypes = des3-hmac-sha1

# The following libdefaults parameters are only for Heimdal Kerberos.

[realms]
	AD.ENGR.WISC.EDU = {
		kdc = engr-dc1.ad.engr.wisc.edu
		kdc = engr-dc2.ad.engr.wisc.edu
		kdc = engr-dc3.ad.engr.wisc.edu
	}
#	ENGR.WISC.EDU = {
#		kdc = kdc1.cae.wisc.edu
#		kdc = kdc2.cae.wisc.edu
#		kdc = kdc-master.cae.wisc.edu
#		admin_server = kdc-master.cae.wisc.edu
#		default_domain = cae.wisc.edu
#	}
#	AD.ENGR.WISC.EDU = {
#		auth_to_local = RULE:[1:$0\$1](^AD\.ENGR\.WISC\.EDU\\.*)s/^AD\.ENGR\.WISC\.EDU/ENGR/
#		auth_to_local = DEFAULT
#	}
	CS.WISC.EDU = { 
		kdc = kerberos-1.cs.wisc.edu
		kdc = kerberos-2.cs.wisc.edu
		kdc = kerberos.cs.wisc.edu
		admin_server = kerberos.cs.wisc.edu
	}

# Our ENGR.WISC.EDU realm that's used for AFS, NFS, etc.
# We aren't specifying any v4_ rules like default_domain since we shouldn't
# need to support that anymore.
# TODO: test to see if we need any mapping rules (auth_to_local*)

# An entry for the ActiveDirectory Kerberos realm at CAE, possibly useful for
# cross-site trust.

# Some more entries for CS's Kerberos so we can share AFS.

# These were defaults in the kdc.conf file upon installation.  I see no
# immediate need to remove them, though the data should be available via DNS
# TXT and SRV records now.
# See Also:
# http://web.mit.edu/Kerberos/krb5-1.6/krb5-1.6.3/doc/krb5-admin.html#Using-DNS
# 2009-08-18
# bpkroth


[domain_realm]
	.engr.wisc.edu = ENGR.WISC.EDU
	engr.wisc.edu = ENGR.WISC.EDU
	.cae.wisc.edu = ENGR.WISC.EDU
	cae.wisc.edu = ENGR.WISC.EDU
	.ad.engr.wisc.edu = AD.ENGR.WISC.EDU
	ad.engr.wisc.edu = AD.ENGR.WISC.EDU
	.ece.wisc.edu = AD.ENGR.WISC.EDU
	ece.wisc.edu = AD.ENGR.WISC.EDU
	.cs.wisc.edu = CS.WISC.EDU
	cs.wisc.edu = CS.WISC.EDU
# Locally added realms for CAE.
# 2009-08-18
# bpkroth



# These were defaults in the kdc.conf file upon installation.  I see no
# immediate need to remove them, though the data should be available via DNS
# TXT and SRV records now.
# See Also:
# http://web.mit.edu/Kerberos/krb5-1.6/krb5-1.6.3/doc/krb5-admin.html#Using-DNS
# 2009-08-18
# bpkroth


# Adding a section to setup logging.
# 2009-08-18
# bpkroth
[logging]
	default=SYSLOG

# Setup capaths for cross-site authentication with ad.engr.wisc.edu.
[capaths]
	ENGR.WISC.EDU = {
		AD.ENGR.WISC.EDU = .
	}
	AD.ENGR.WISC.EDU = {
		ENGR.WISC.EDU = .
	}

[login]
	krb4_convert = true
	krb4_get_tickets = false
[appdefaults]
	pam = {
   mappings = ENGR\\(.*) $1@AD.ENGR.WISC.EDU
   forwardable = true
   validate = true
	}
	httpd = {
   mappings = ENGR\\(.*) $1@AD.ENGR.WISC.EDU
   reverse_mappings = (.*)@AD\.ENGR\.WISC\.EDU ENGR\$1
	}
# krb5.conf
# 2009-08-17
# bpkroth
# 
# The client/server config file for Kerberos v5 on Linux machines at CAE.
# This file is used both by KDCs, clients, and applications.

