Re: [dnsext] New RRtype "KREALM" in draft-vanrein-dnstxt-krb1-02.txt

["Niall O'Reilly" <[e-mail]>]

On Fri, 11 Sep 2015 12:14:34 +0100,
Rick van Rein wrote:

  Hi, Rick.

> Hi Tony,
> 
> Thanks for thinking along!
> 
> > I was thinking
> >
> > @ KREALM "realm" "EXAMPLE.COM"
> > KREALM "realm" "EXAMPLE.ORG"
> > KREALM "admin" "carl"
> > KREALM "admin" "mary"
> > KREALM "service" "HTTP"
> > KREALM "service" "imap"
> 
> That would make it impossible to express everything that is desired. 
> The level of alternation that you are using here has been reserved for
> independent statements; the combined tag=value statements form a
> cross-product; for example all the realms mentioned combine with all the
> admins mentioned in the same RDATA portion.  If another realm has
> another admin set it will be specified in a separate KREALM.

  Don't you end up with a potentially large but sparse matrix of
  valid tag/value pairs in this model, Rick?

  Would a two-stage representation of the data you need work?
  I'm thinking of normalization and foreign keys.

  Here's an example below.

    ; advertise realms to which $ORIGIN belongs
    ; so that clients can perform discovery
    ; this RRset is the REALM-SET
    @ KREALM "realm" "EXAMPLE.COM"
    @ KREALM "realm" "EXAMPLE.ORG"
    ;
    ; for each realm at $ORIGIN, advertise its attributes
    ;
    ; this RRset is the ATTRIBUTE-SET for realm "EXAMPLE.COM" at $ORIGIN
    EXAMPLE.COM._realm	   KREALM "admin" "carl"
    EXAMPLE.COM._realm	   KREALM "service" "HTTP"
    ;
    ; this RRset is the ATTRIBUTE-SET for realm "EXAMPLE.ORG" at $ORIGIN
    EXAMPLE.ORG._realm	   KREALM "admin" "mary"
    EXAMPLE.ORG._realm	   KREALM "service" "imap"
  
  If the realm isn't really "at" $ORIGIN, a CNAME reference might be
  appropriate.

  If this approach risks string overflow in the owner names, an
  alternative might be to use

    @ KREALM <realm-handle> <realm-name>

  for the REALM-SET, and use the same handle in composing the owner
  name of the ATTRIBUTE-SET, so:

    @ KREALM "r1" "EXAMPLE.COM"
    @ KREALM "r2" "EXAMPLE.ORG"
    r1._realm	KREALM "admin" "carl"
    ; ...
    r2._realm	KREALM "admin" "mary"

  As I write, it occurs to me that it may be more "natural" to assign
  the RDATE fields in the REALM-SET in the reverse order.  That's a
  detail which just needs to be unambiguously specified. 8-)

  This-all seems to keep the option of re-using HINFO as Tony suggested.

  ATB
  Niall