Re: [kitten] Fwd: New Version Notification for draft-vanrein-dnstxt-krb1-05.txt

[Greg Hudson <[e-mail]>]

On 09/18/2015 10:02 AM, Nico Williams wrote:
> I'm very reluctant to agree to that, but I'd agree to saying that a TGS
> client should first try the realm as it appears in the PTR RR and then
> as up-cased if the first failed.

That is a non-starter for me.  The case of the realm as it appears in
the PTR RR is influenced by the case used in the query; it cannot be
treated as canonical.  Fallback KDC queries complicate security and
performance analysis, and I prefer to avoid them whenever possible.

I am provisionally okay with Rick's proposal that the record must either
refer to an uppercase realm or a realm with KDCs that can canonicalize
the uppercase realm to the correct realm.  I am also okay with using TXT.

> The only thing that concerns me is how to canonicalize realm names for
> name-based authorization.  This is the case where an AS client used an
> alias realm name and now cannot get authorized to access some resources.

I assume that if you use the wrong realm name with an AD KDC, you get
back a WRONG_REALM response, and the client tries again with the correct
case of the realm.  This only works when the client uses the
CANONICALIZE flag, which MIT krb5 clients don't do by default, and the
WRONG_REALM response isn't authenticated.  I am not sure what should
change there, but simply issuing a ticket for the non-canonical realm
seems out of the question.

These DNS records are more likely to be used for service principal names
than client principal names anyway.  I am not really fond of our
aliasing story for service names (I never understood why we chose to lie
to clients instead of correcting them), but it does work by default, up
until the point where application servers can't reliably use the sname
and realm in the Ticket for diagnostic purposes.

Rick wrote:
> If you guys are happy with this, I will jump back to DNSEXT and propose
> it there, and push it forward to get an RRTYPE assigned.

Rick, in
http://www.ietf.org/mail-archive/web/kitten/current/msg05840.html
it seemed like you agreed to use an existing RR type.  So I am confused
why this draft update still defines a KREALM RR type and why you are
talking about getting an assignment.