Re: [kitten] Kerberos Service Discovery using DNS

[Petr Spacek <[e-mail]>]

On 24.3.2015 15:20, Greg Hudson wrote:
> On 03/24/2015 08:36 AM, Nathaniel McCallum wrote:
>> On Tue, 2015-03-24 at 09:35 +0100, Petr Spacek wrote:
>>> It seems like a good idea to standardize _kerberos-master URI record 
>>> too (with
>>> semantics equal to the one described on
>>> http://web.mit.edu/Kerberos/krb5-1.12/doc/admin/realm_config.html).
> 
>> I *think* this might be MIT specific. Maybe Greg can answer that?
> 
> It does look like only MIT krb5 implements it.
> 
> The semantics of _kerberos-master are "these addresses represent KDCs
> (usually just one) which are more up to date than the other KDCs in the
> realm, so retry with one of these if your first try fails for most
> reasons."  In some realms the master KDC isn't one of the regular KDCs,
> in order to shed the majority of the load from the KDC which is also
> running kadmind.
> 
> These semantics are not generally needed for a realm with fast
> replication (iprop with low polling delay, LDAP, etc.), but there are
> enough realms with slow replication that we're not about to discard
> those semantics.
> 
> It might be good if master KDC entries could be obtained in the same DNS
> lookup as regular KDC entries, but none of the ways I can think of to do
> it are particularly elegant.  We would need to be able to annotate each
> URI with "this is also a master KDC" or "this is only a master KDC".
> Shoving that tri-state into each URI scheme wouldn't be very elegant;
> designating magic priority values for the URI record would be a layering
> violation.  It's not really a big deal if a second DNS lookup is needed
> for the fallback.
> 
> I have no strong opinion on whether the discovery standard needs to talk
> about this.  MIT krb5 can always continue to implement it as a
> non-standardized feature, using the same lookup behavior as the
> _kerberos URI record but with the label changed to _kerberos-master.

IMHO:
I would not optimize for fallback when it means obfuscating the original idea.
I.e. a separate DNS name like _kerberos_master with URIs of masters sounds
fine to me.

Also, I do not see a reason not to standardize it because it is deadly
simple/cheap and allows Heimdal and others to be interoperable if they decide
to support this feature in future.

-- 
Petr^2 Spacek