Two typical forms for Kerberos (v5) principal names seem to be:
username[/instance]@REALM
service/fully-qualified-domain-name@REALM
I've also seen something like this for services which could exist on multiple ports:
service/fully-qualified-domain-name:port@REALM
I have an in-house application which is now being Kerberized, and would like to understand how the service principal(s) should be named. The service is distributed, with several instances running on each of several machines in each of several sub-domains.
For example, let's say my domain name is zombo.com, and my Kerberized service, "tenaciousd", runs on machines "www1" through "www5". Further, each machine has ten instances on well-known ports, say 25001 through 25010.
So I have fifty instances of the server, all basically the same, which lets me balance load, deploy new versions gradually, and so on.
Now, how should I name the service principal(s) in Kerberos? Should there be one for each host running the service, as there would be in what seems the most common form?
tenaciousd/www1.zombo.com@ZOMBO.COM
tenaciousd/www2.zombo.com@ZOMBO.COM
tenaciousd/www3.zombo.com@ZOMBO.COM
tenaciousd/www4.zombo.com@ZOMBO.COM
tenaciousd/www5.zombo.com@ZOMBO.COM
Or is it better practice (and why) to have one service principal per service instance?
tenaciousd/www1.zombo.com:25001@ZOMBO.COM
tenaciousd/www1.zombo.com:25002@ZOMBO.COM
tenaciousd/www1.zombo.com:25003@ZOMBO.COM
...
tenaciousd/www5.zombo.com:25010@ZOMBO.COM
Finally, what about having just one service principal, which seems simpler but less commonly done?
tenaciousd@ZOMBO.COM
If it matters, the Kerberized service (and clients) use Cyrus SASL, GNU GSSAPI, and MIT Kerberos 5. The SASL API takes a "fully-qualified domain name" parameter in addition to the service name, but I suspect that's because it supports more than just Kerberos, and we could probably pass things other than actual FQDNs.
Most of the documentation I've found assumes that each service runs on a single host in a realm, or at least that clients care deeply which service instance they connect to. In my case the services are all pretty much the same from the client's perspective, so what would be the best practice here?