Re: [kitten] Finding Kerberos Realm Descriptors in secure DNS

[Viktor Dukhovni <[e-mail]>]

On Tue, Sep 15, 2015 at 09:08:42AM +0200, Rick van Rein wrote:

> So, time to simplify.  What we're now looking it is a very simple KREALM
> record that says stuff like
> 
> www.example.org.  IN KREALM  "EXAMPLE.ORG"
>                   IN KREALM "EXAMPLE.COM"

Text strings used to be handy for realm names in DNS when associated
SRV records were plausibly optional.  These days, the REALM *should*
be a DNS name.  Therefore, a simpler design would be:

    ; Realm mapping per-host reduces lookup latency
    ;
    _kerberos.host.name.example.com. IN PTR EXAMPLE.COM.

    ; "Fallback" realm mapping at ancestor domain
    ;
    _kerberos.example.com. IN PTR EXAMPLE.COM.

    ; Associated SRV records
    ;
    _kerberos._udp.example.com. IN SRV 0 100 88 kdc.example.com.
    _kerberos._tcp.example.com. IN SRV 0 100 88 kdc.example.com.

This does not require a new RR type, PTR will do.

-- 
	Viktor.