Re: [kitten] Fwd: New Version Notification for draft-vanrein-dnstxt-krb1-05.txt

[Greg Hudson <[e-mail]>]

On 09/19/2015 09:13 AM, Rick van Rein wrote:
>    RFC 4120 permits a KDC to return a closer referral ticket when a
>    cross-realm TGT is requested.  This specification extends this
>    behavior when the canonicalize flag is set.  When this flag is set, a
>    KDC MAY return a TGT for a realm closer to the service for any
>    service as discussed in the previous section.  When a client follows
>    such a referral, it includes the realm of the referred-to realm in
>    the generated request.
>    [Section 9 of RFC6806]
> 
> This can be used to change a request with a different case that is
> considered an alias to one that has the case that we want to.  Clients
> would need to treat this as a change to another realm, due to their
> case-insensitive treatment of realm names.  Effectively, the case would
> be changed to the case as known to the KDC.

This reasoning isn't correct.  There are two scenarios:

1. The client can't determine the service realm name with confidence (it
doesn't implement PTR lookups, or can't do secure DNS resolution because
of a restrictive network element, or whatever).  In this case, it asks
its local KDC for a service ticket (making a TGS query to
serviceprinc@LOCALREALM) with no conception of what the target realm
should be.  The KDC can issue an RFC 6806 referral to whatever realm it
wants.  Case correction doesn't even enter the picture from the Kerberos
protocol perspective, since the client has no realm name to correct.

2. The client does determine the service realm name with confidence, but
with the wrong case.  In this case its asks its KDC for
krbtgt/wrong-case-realm@LOCALREALM, and RFC 6806 does not apply.  RFC
4120 section 9 allows the local realm KDC to issue a
krbtgt/right-case-realm@LOCALREALM ticket as a "closer TGT", but a
current client will not take that as a case correction; instead, it will
stubbornly ask right-case-realm for a krbtgt/wrong-case-realm Ticket.

We can certainly require that clients which implement PTR realm lookup
also treat krbtgt/case-variant-realm replies as case corrections rather
than referrals.  But that needs to be treated as a protocol extension
and an update to RFC 4120.  In MIT krb5 there are some API and caching
considerations for this new client behavior, though they may be manageable.