Re: [kitten] Kerberos Service Discovery using DNS

[Greg Hudson <[e-mail]>]

On 03/24/2015 08:36 AM, Nathaniel McCallum wrote:
> On Tue, 2015-03-24 at 09:35 +0100, Petr Spacek wrote:
>> It seems like a good idea to standardize _kerberos-master URI record 
>> too (with
>> semantics equal to the one described on
>> http://web.mit.edu/Kerberos/krb5-1.12/doc/admin/realm_config.html).

> I *think* this might be MIT specific. Maybe Greg can answer that?

It does look like only MIT krb5 implements it.

The semantics of _kerberos-master are "these addresses represent KDCs
(usually just one) which are more up to date than the other KDCs in the
realm, so retry with one of these if your first try fails for most
reasons."  In some realms the master KDC isn't one of the regular KDCs,
in order to shed the majority of the load from the KDC which is also
running kadmind.

These semantics are not generally needed for a realm with fast
replication (iprop with low polling delay, LDAP, etc.), but there are
enough realms with slow replication that we're not about to discard
those semantics.

It might be good if master KDC entries could be obtained in the same DNS
lookup as regular KDC entries, but none of the ways I can think of to do
it are particularly elegant.  We would need to be able to annotate each
URI with "this is also a master KDC" or "this is only a master KDC".
Shoving that tri-state into each URI scheme wouldn't be very elegant;
designating magic priority values for the URI record would be a layering
violation.  It's not really a big deal if a second DNS lookup is needed
for the fallback.

I have no strong opinion on whether the discovery standard needs to talk
about this.  MIT krb5 can always continue to implement it as a
non-standardized feature, using the same lookup behavior as the
_kerberos URI record but with the label changed to _kerberos-master.