Principals

A client in SEAM is identified by its principal. A principal is a unique identity to which the KDC can assign tickets. A principal can be a user, such as joe, or a service, such as nfs.

By convention, a principal name is divided into three parts: the primary, the instance, and the realm. A typical SEAM principal would be, for example, joe/admin@ENG.ACME.COM, where:

• joe is the primary. This can be a username, as shown here, or a service, such as nfs. It can also be the word host, signifying that this is a service principal set up to provide various network services.

• admin is the instance. An instance is optional in the case of user principals, but it is required for service principals. For example: if the user joe sometimes acts as a system administrator, he can use joe/admin to distinguish himself from his usual user identity. Likewise, if joe has accounts on two different hosts, he can use two principal names with different instances (for example, joe/denver.acme.com and joe/boston.acme.com). Notice that SEAM treats joe and joe/admin as two completely different principals.

  In the case of a service principal, the instance is the fully qualified hostname. bigmachine.eng.acme.com is an example of such an instance, so that the primary/instance might be, for example, nfs/bigmachine.eng.acme.com or host/bigmachine.eng.acme.com.

• ENG.ACME.COM is the SEAM realm. Realms are discussed in the next section.

The following are all valid principal names:

• joe

• joe/admin

• joe/admin@ENG.ACME.COM

• nfs/host.eng.acme.com@ENG.ACME.COM

• host/eng.acme.com@ENG.ACME.COM