Re: [kitten] Adoption of draft-mccallum-kitten-krb-service-discovery?

[Jeffrey Altman <[e-mail]>]

On 5/17/2016 11:49 AM, Nathaniel McCallum wrote:
> https://tools.ietf.org/html/draft-mccallum-kitten-krb-service-discovery
> -02
> 
> I'd like to propose adoption of this draft:
> 
> 1. It is in the scope of the WG. This is an extension to the discovery
> methods already defined in RFC 4120.
> 
> 2. It is beneficial. It provides both speed improvments and additional
> functionality (discovery of MS-KKDCP proxies).
> 
> 3. It is small. It avoids defining new: DNS names, DNS semantics, URIs,
> or transport semantics. It simply combines the existing tools in a
> fairly obvious way.
> 
> Thoughts?
> 

Having read the draft I am totally unclear how it is implemented.

  _kerberos.REALM

is not a valid DNS URI record name.  To translate the URI

  https://host[:port][path]

to an URI record requires

 _kerberos._https.host

not

 _kerberos.host

DNS URI records according to RFC 7553 work just like DNS SRV records in
that they require both a service name and a protocol name.  Switching to
URI records does not solve the problem of multiple DNS queries.

To find a KDC that supports https, use the DNS SRV record

  _kerberos._https.REALM

registering additional service types such as "kpasswd" can be done but
the fact is implementations such as Heimdal already perform SRV lookups for

 _kpasswd,_tcp.REALM and _kpasswd._udp.REALM

Can you make a case for something that DNS URI records provides that DNS
SRV records do not?

The introduction of DNS URI records will only mean that in practice that
Kerberos client libraries will need to issue the DNS URI queries in
addition to the existing DNS SRV records.

Jeffrey Altman