Re: [kitten] Kerberos Service Discovery using DNS

[Jeffrey Altman <[e-mail]>]

On 3/11/2015 12:44 PM, Benjamin Kaduk wrote:
> On Wed, 11 Mar 2015, Nathaniel McCallum wrote:
> 
>> On Wed, 2015-03-11 at 12:05 -0400, Benjamin Kaduk wrote:
>>> On Thu, 5 Mar 2015, Nathaniel McCallum wrote:
>>>
>>>> I have uploaded a new draft:
>>>>
>>> http://datatracker.ietf.org/doc/draft-mccallum-kitten-krb-service-discovery/
>>>>
>>>> If you'd like to discuss it, reply to this message. :)
>>>
>>> I'm generally in favor of something like this.
>>>
>>> A few things that came to mind while reading it that have not
>>> already been
>>> raised:
>>>
>>> You cover kerberos and kpasswd, but not kadmin.  Any reason why?
>>> (MIT's code does not currently support using DNS to locate an admin
>>> server, but that's not a reason to reject adding it to a discovery
>>> protocol in its own
>>> right.)
>>
>> My understanding is that kadmin is a proprietary protocol and has not
>> been standardized. If that is incorrect, I can certainly add it. Does
>> it already have a standardized discovery protocol?
> 
> There are at least two different proprietary kadmin protocols.

And this is why SRV records for kadmin is not standardized.

> SRV records for _kerberos-adm._tcp.[realm] are documented by both
> MIT and Heimdal, and exist at many sites.  It looks like Heimdal doesn't
> actually implement client support for them, either, though, judging by git
> grep. 

Using the same SRV record for both MIT and Heimdal is in my opinion a
bad mistake since each kadmin service implementation is incompatible
with the other.

_mit-kerberos-adm._tcp.[realm]
_heimdal-kerberos-adm._tcp.[realm]

would have been much better.

> (The corresponding draft-ietf-cat-krb-dns-locate seems to have
> withered and died.)

No.  The part of this I-D that were acceptable to the working group were
incorporated in RFC 4120.

Jeffrey Altman