[libdefaults]
	default_realm = <%= node['krb5']['libdefaults']['default_realm'] %>

# The following krb5.conf variables are only for MIT Kerberos.
	krb4_config = /etc/krb.conf
	krb4_realms = /etc/krb.realms
	kdc_timesync = 1
	ccache_type = 4
	forwardable = true
	proxiable = true

# The following encryption type specification will be used by MIT Kerberos
# if uncommented.  In general, the defaults in the MIT Kerberos code are
# correct and overriding these specifications only serves to disable new
# encryption types as they are added, creating interoperability problems.
#
# Thie only time when you might need to uncomment these lines and change
# the enctypes is if you have local software that will break on ticket
# caches containing ticket encryption types it doesn't know about (such as
# old versions of Sun Java).

#	default_tgs_enctypes = des3-hmac-sha1
#	default_tkt_enctypes = des3-hmac-sha1
#	permitted_enctypes = des3-hmac-sha1

# for strong crypto
allow_weak_crypto = false
<%
default_tgs_enctypes = node['hadoop']['krb5_strong_crypto']['default_tgs_enctypes']
if !default_tgs_enctypes.nil? && !default_tgs_enctypes.empty? then
-%>
default_tgs_enctypes = <%= default_tgs_enctypes %>
<% end -%>
<%
default_tkt_enctypes = node['hadoop']['krb5_strong_crypto']['default_tkt_enctypes']
if !default_tkt_enctypes.nil? && !default_tkt_enctypes.empty? then
-%>
default_tkt_enctypes = <%= default_tkt_enctypes %>
<% end -%>
<%
permitted_enctypes = node['hadoop']['krb5_strong_crypto']['permitted_enctypes']
if !permitted_enctypes.nil? && !permitted_enctypes.empty? then
-%>
permitted_enctypes = <%= permitted_enctypes %>
<% end -%>

# The following libdefaults parameters are only for Heimdal Kerberos.
	v4_instance_resolve = false
	v4_name_convert = {
		host = {
			rcmd = host
			ftp = ftp
		}
		plain = {
			something = something-else
		}
	}
	fcc-mit-ticketflags = true

[realms]
<%
node['krb5']['realms'].each do |name, configs|
-%>
    <%= name %> = {
<%
  configs.each do |key, value|
    if key == 'kdcs' then
      value.each do |kdc| -%>
        kdc = <%= kdc %>
<%
      end
    elsif key == 'admin_server' then
-%>
        admin_server = <%= value %>
<%
    end
  end
-%>
    }
<%
end
-%>

[domain_realm]
<% node['krb5']['domain_realms'].each do |domain_realm| -%>
    <%= domain_realm %>
<% end -%>

[login]
	krb4_convert = true
	krb4_get_tickets = false
