Re: [kitten] Finding Kerberos Realm Descriptors in secure DNS

[Nico Williams <[e-mail]>]

On Tue, Sep 15, 2015 at 04:20:22PM +0000, Viktor Dukhovni wrote:
> On Tue, Sep 15, 2015 at 05:11:07PM +0200, Rick van Rein wrote:
> 
> I'm not assuming anything.  I proposing that:
> 
> 	_kerberos.host.example.com. IN PTR EXAMPLE.COM.
> 
> mean that the realm of "host.example.com" is "EXAMPLE.COM".  If
> this mapping sometimes loses case, it may well be time to consider
> defining the realm portion of Kerberos principals to be case-insensitive
> for A-labels, and for non-ASCII names (as with IDNA 2008) *required*
> to be effectively lower-case for U-labels.

Windows and AD are already case-insensitive/preserving for realm names
now.  I think it'd be a good idea to do the same in other
implementations.  For KDB lookups they may need to internally
canonicalize realm name case.  For name-based authorization services may
need to canonicalize realm name case as well.  But this isn't hard
because KDCs and services usually have sources of canonical realm case
already (in krb5.conf, in the KDB, in keytabs).

> The realm is going to be used for SRV lookups, and needs to be
> valid DNS name.  Also the realm should be case-insensitive anyway,
> time to bite that bullet.

It's going to be some work (see above), but I agree.

> > I would like to hear if i18n experts agree to such mappings.  And
> > especially in the context of Kerberos, where we are dealing with older
> > applications that were a bit too liberal with what they put into their
> > realm name fields.
> 
> They don't all have to use DNS for realm mappings, they've gotten
> by without so far.

Indeed, between referrals and just... not having out-of-zone realms for
hosts we've not needed this.

> Of course you could simply standardize the current informal
> 
>     _kerberos.host.example.com. IN TXT "EXAMPLE.COM"

Informative will do.

Nico
--