Re: [kitten] Fwd: New Version Notification for draft-vanrein-dnstxt-krb1-05.txt

[Greg Hudson <[e-mail]>]

On 09/22/2015 07:09 AM, Rick van Rein wrote:
>> 2. The client does determine the service realm name with confidence, but
>> with the wrong case.  In this case its asks its KDC for
>> krbtgt/wrong-case-realm@LOCALREALM, and RFC 6806 does not apply.
> Ah.  My reasoning was that it would ask directly for
> imap/imap.example.com@WRONG-CASE-REALM
> and that RFC 6806 would then be applied.  I've seen such guessing,
> presumably under the hoping that the KDC will know how to link the client
> to the requested service; I've seen this behaviour on Mac OS X, which
> uses Heimdal.

Can you elaborate on the request behavior you have seen?  Specifically,
these fields:

1. The realm of the KDC-REQ-BODY
2. The sname of the Ticket inside the PA-TGS-REQ

In my experience with the Kerberos protocol, when (2) is krbtgt/X, X
always matches (1).  The MIT krb5 KDC implementation requires this, and
will reject the request with a KRB_AP_ERR_NOT_US error if they don't match.

In summary, a client never asks realm X for a service ticket in realm Y.
 If it knows it wants a service ticket in realm Y, it asks realm X for a
krbtgt/Y ticket and then asks realm Y for the service ticket.

>> RFC 4120 section 9 allows the local realm KDC to issue a
>> krbtgt/right-case-realm@LOCALREALM ticket as a "closer TGT", but a
>> current client will not take that as a case correction; instead, it will
>> stubbornly ask right-case-realm for a krbtgt/wrong-case-realm Ticket.
> You mean because it sees wrong-case-realm as different from right-case-realm
> and thinks it hasn't reached its destination, right?

Yes.

> Do you agree that the conceptual model and inefficient theoretic implementation
> is in line with what RFC 4120 prescribes, and that the case-correction is
> merely a more efficient manner of getting to the right answer?  (That would
> need some explaining in the I-D of course.)

I do not agree.  RFC 4120 says, "Before sending a request to the
ticket-granting service, the client MUST determine in which realm the
application server is believed to be registered."  It doesn't talk about
determining a set of possible realms--certainly not a combinatoric set
of 2^N possible realms where N is the number of case-varying characters.
 What you are talking about is unquestionably an extension to RFC 4120.