Re: [dnsext] New RRtype "KREALM" in draft-vanrein-dnstxt-krb1-02.txt

["Patrik Fältström " <[e-mail]>]

On 11 Sep 2015, at 4:04, Rick van Rein wrote:

> HINFO uses precisely 2 strings, with KREALM it'd be variable, but could be done with something like
>
> @ IN KREALM ( "realm=EXAMPLE.COM" "realm=EXAMPLE.ORG"
>    admin=carl "admin=mary"
>    service=HTTP "service=imap" )

Can you explain what you try to express with the statement above? Specifically when two attribute/value pairs are not quoted, but others are.

And be VERY specific and explain what data whoever has that looks up this record. What data do the party have and what data do the party want.

What we have somewhat bad experience with is to have selections made on the RDATA side of resource records (see NAPTR) and instead (as laid out in RFC5507 and RFC6950).

It sounds to me that the one looking for the record know it has domain name and service and looks for realm and admin? Where the two last ones can be multiple. Or is the service also unknown and one want to know what services orb can be used? A subset of services available at this domain?

In the draft I see:

   Two mappings are needed for the given scenario.  One is a mapping
   from the FQDN of a service to its realm name; the other is a mapping
   from the realm name to the Kerberos-specific services such as the
   KDC.  The latter mapping is published in SRV records [RFC4120] and
   such traffic is protected by the Kerberos protocol itself.  The first
   mapping however, has hitherto not been standardised and is ill-
   advised over unsecured DNS because the published information is then
   neither validated by DNS nor does it lead to a protocol that could
   provide end-to-end validation for it.

I though service+fqdn -> realm was using SRV, but the text here say that that is what you try to fix with this new spec. Or is my english failing me?

   Patrik