Re: [kitten] Fwd: New Version Notification for draft-vanrein-dnstxt-krb1-05.txt

[Greg Hudson <[e-mail]>]

On 09/30/2015 09:21 AM, Rick van Rein wrote:
> RFC 6806 section 9 adds
> 
>    RFC 4120 permits a KDC to return a closer referral ticket when a
>    cross-realm TGT is requested.  This specification extends this
>    behavior when the canonicalize flag is set.  When this flag is set, a
>    KDC MAY return a TGT for a realm closer to the service for any
>    service as discussed in the previous section.  When a client follows
>    such a referral, it includes the realm of the referred-to realm in
>    the generated request.
> 
> The case-corrected realm in the krbtgt reply could be considered
> "a realm closer to the service" and it would be followed instead of
> the original one.  That is, when canonicalization is requested.  That
> could be used for case correction -- if you agree to what I'm reading
> in this text.

Please refer back to
http://www.ietf.org/mail-archive/web/kitten/current/msg05852.html
where I responded to almost exactly the same reasoning.  The quoted RFC
6086 text does not change the behavior of requests for krbtgt/X
principals; it applies similar (but not identical) behavior to requests
for other principals.  You could make an argument that "for any service"
means that requests for krbtgt/X principals are also affected, but no
implementor interpreted the text in that way (because it would have
broken many existing multi-hop cross-realm scenarios), so that wouldn't
be helpful.

If the client makes a request for krbtgt/X and the KDC responds with a
ticket for krbtgt/x, the currently expected client behavior is to ask
realm x for krbtgt/X, not to decide it wanted realm x instead.