Fix ResolveRealm for DNS domains (starting with a dot)

config/krb5conf.go

@@ -6,8 +6,6 @@ import (
 	"encoding/hex"
 	"errors"
 	"fmt"
-	"github.com/jcmturner/asn1"
-	"gopkg.in/jcmturner/gokrb5.v2/iana/etypeID"
 	"io"
 	"os"
 	"os/user"
@@ -15,6 +13,9 @@ import (
 	"strconv"
 	"strings"
 	"time"
+
+	"github.com/jcmturner/asn1"
+	"gopkg.in/jcmturner/gokrb5.v2/iana/etypeID"
 )
 
 // Config represents the KRB5 configuration.
@@ -431,10 +432,17 @@ func (d *DomainRealm) deleteMapping(domain, realm string) {
 // The most specific mapping is returned.
 func (c *Config) ResolveRealm(domainName string) string {
 	domainName = strings.TrimSuffix(domainName, ".")
+
+	// Try to match the entire hostname first
+	if r, ok := c.DomainRealm[domainName]; ok {
+		return r
+	}
+
+	// Try to match all DNS domain parts
 	periods := strings.Count(domainName, ".") + 1
-	for i := 1; i <= periods; i++ {
+	for i := 2; i <= periods; i++ {
 		z := strings.SplitN(domainName, ".", i)
-		if r, ok := c.DomainRealm[z[len(z)-1]]; ok {
+		if r, ok := c.DomainRealm["."+z[len(z)-1]]; ok {
 			return r
 		}
 	}

config/krb5conf_test.go

@@ -1,11 +1,12 @@
 package config
 
 import (
-	"github.com/stretchr/testify/assert"
 	"io/ioutil"
 	"os"
 	"testing"
 	"time"
+
+	"github.com/stretchr/testify/assert"
 )
 
 const (
@@ -56,6 +57,10 @@ const (
  .test.gokrb5 = TEST.GOKRB5
 
  test.gokrb5 = TEST.GOKRB5
+ 
+  .example.com = EXAMPLE.COM
+ hostname1.example.com = EXAMPLE.COM
+ hostname2.example.com = TEST.GOKRB5
 
 [appdefaults]
  pam = {
@@ -281,3 +286,27 @@ func TestParseDuration(t *testing.T) {
 	}
 
 }
+
+func TestResolveRealm(t *testing.T) {
+	c, err := NewConfigFromString(krb5Conf)
+	if err != nil {
+		t.Fatalf("Error loading config: %v", err)
+	}
+
+	tests := []struct {
+		domainName string
+		want       string
+	}{
+		{"unknown.com", "TEST.GOKRB5"},
+		{"hostname1.example.com", "EXAMPLE.COM"},
+		{"hostname2.example.com", "TEST.GOKRB5"},
+		{"one.two.three.example.com", "EXAMPLE.COM"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.domainName, func(t *testing.T) {
+			if got := c.ResolveRealm(tt.domainName); got != tt.want {
+				t.Errorf("Config.ResolveRealm() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}