#
# SPDX-License-Identifier: Apache-2.0
#
# The OpenSearch Contributors require contributions made to
# this file be licensed under the Apache-2.0 license or a
# compatible open source license.
#

# Licensed to Elasticsearch under one or more contributor
# license agreements. See the NOTICE file distributed with
# this work for additional information regarding copyright
# ownership. Elasticsearch licenses this file to you under
# the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#    http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied.  See the License for the
# specific language governing permissions and limitations
# under the License.

#
# Modifications Copyright OpenSearch Contributors. See
# GitHub history for details.
#

[libdefaults]
    default_realm = ${REALM_NAME}
    dns_canonicalize_hostname = false
    dns_lookup_kdc = false
    dns_lookup_realm = false
    dns_uri_lookup = false
    forwardable = true
    ignore_acceptor_hostname = true
    rdns = false
    default_tgs_enctypes = rc4-hmac
    default_tkt_enctypes = rc4-hmac
    permitted_enctypes = rc4-hmac
    # udp_preference_limit = 1
    kdc_timeout = 3000
    canonicalize = true
    # See please https://seanjmullan.org/blog/2021/09/14/jdk17 (deprecate 3DES and RC4 in Kerberos)
    allow_weak_crypto = true

[realms]
    ${REALM_NAME} = {
        kdc = 127.0.0.1:88
        kdc = 127.0.0.1:${MAPPED_PORT}
        admin_server = ${KDC_NAME}:749
        default_domain = ${BUILD_ZONE}
    }

[domain_realm]
    ${BUILD_ZONE} = ${REALM_NAME}
    .${BUILD_ZONE} = ${REALM_NAME}
    ${OPENSEARCH_ZONE} = ${REALM_NAME}
    .${OPENSEARCH_ZONE} = ${REALM_NAME}