ECS 3.6.2 Data Access Guide

Equivalence user

ECS converts three part principals to two part principals.

A Kerberos principal is generally in the form primary/instance@realm, although the instance is not required, so primary@realm principal applies to all hosts in the realm. If the instance is specified, it may be used to designate a specific host, such as joe/host1.company.com@COMPANY.COM or joe/host2.company.com@COMPANY.COM. These two principals are for the same primary user (joe), but are targeted to only be granted authentication on the hosts (host1 or host2).

This type of user principal is recommended to provide an enhanced level of security. From an ECS perspective, each principal would have to be added to ECS. This becomes quite cumbersome, so the equivalence user feature allows ECS authorization to be performed by using a two-part principal (primary@realm), even if three-part principals are being used.