Re: [kitten] Fwd: New Version Notification for draft-vanrein-dnstxt-krb1-05.txt

[Rick van Rein <[e-mail]>]

Hi Greg / others,

I'm rereading the canonicalization RFC, and it does seem to already provide the "case correction extension" that we said we'd need.

Greg, does this make you see things differently?  If not, I will continue with TXT instead of PTR.

>> Do you agree that the conceptual model and inefficient theoretic implementation
>> is in line with what RFC 4120 prescribes, and that the case-correction is
>> merely a more efficient manner of getting to the right answer?  (That would
>> need some explaining in the I-D of course.)
>
> I do not agree.  RFC 4120 says, "Before sending a request to the
> ticket-granting service, the client MUST determine in which realm the
> application server is believed to be registered."  It doesn't talk about
> determining a set of possible realms--certainly not a combinatoric set
> of 2^N possible realms where N is the number of case-varying characters.
>  What you are talking about is unquestionably an extension to RFC 4120.

RFC 6806 section 9 adds

   RFC 4120 permits a KDC to return a closer referral ticket when a
   cross-realm TGT is requested.  This specification extends this
   behavior when the canonicalize flag is set.  When this flag is set, a
   KDC MAY return a TGT for a realm closer to the service for any
   service as discussed in the previous section.  When a client follows
   such a referral, it includes the realm of the referred-to realm in
   the generated request.

The case-corrected realm in the krbtgt reply could be considered
"a realm closer to the service" and it would be followed instead of
the original one.  That is, when canonicalization is requested.  That
could be used for case correction -- if you agree to what I'm reading
in this text.

So we are back to our choice, and it's arbitrary to me which we choose.

We might still decide on TXT on grounds of
 1. it's been implemented, and informally documented
 2. it completely evades case-dependent problems
 3. it's more efficient (for mixed-case realm names)
 4. the _kerberos prefix bypasses overloading of TXT

Whereas PTR has advantages
 1. More akin to the domain-style names
 2. Initial mapping to all-uppercase works for the majority of cases
 3. Case correction by the KDC works for the few other cases
 4. It offers a future path for case-insensitive realm names in KDCs

Opinions, anyone?  To me it feels that everything that works according to the standards is acceptable to this group now?

Cheers,
 -Rick