Re: [kitten] Adoption of draft-mccallum-kitten-krb-service-discovery?

[Nathaniel McCallum <[e-mail]>]

On Tue, 2016-05-17 at 17:08 -0400, Jeffrey Altman wrote:
> On 5/17/2016 4:43 PM, Nathaniel McCallum wrote:
> > We will need to add at least one more DNS query to support MS-KKDCP
> > (two if we have to treat http and https as separate queries). This
> > is
> > unavoidable. While it is true that this will result in a 50%
> > increase
> > in DNS queries, using my URI scheme means that a simple
> > administrator
> > configuration can turn this 50% increase into a 50% decrease in
> > queries
> > over the existing implementations. This is a win.
> 
> As an implementer I can tell you that it would be more than a decade
> before I would ever be able to remove existing lookup methods and
> possibly even longer than that.

I'm also an implementer. And I can tell you that when you remove the
code doesn't matter. All that matters is what happens at runtime. And
if we offer admins a way to cut their Kerberos DNS requests in half,
they'll take it.

> As a deployer of a realm I can tell you that I have no control over
> updates of Kerberos libraries in the clients.  Clients are deployed
> long
> after the 10 year lifetimes of the operating systems and new features
> such as this are not backported into prior OS distributions.
> As such I would be unable to rely upon URI as a replacement for SRV
> for
> more than 10 years.  I would be required to publish both URI and and
> SRV
> lookup records forever.

Agreed. But who cares? Clients that support the new method get
increased speed and functionality. Clients that don't, get the same
behavior they always had. The only cost for this on the DNS-side of the
equasion is an additional record -- one which we need anyway.

> You have described a reason why URI lookups are necessary for MS-
> KKDCP.
> Please restrict your draft to that case.

I've described a reason why a URI record lookup is requied for MS-
KKDCP. However, I've also described a system which presents a 50%
reduction in DNS lookups. I don't see any reason to neglect this second
feature.