Re: [kitten] Adoption of draft-mccallum-kitten-krb-service-discovery?

[Jeffrey Altman <[e-mail]>]

On 5/17/2016 4:43 PM, Nathaniel McCallum wrote:
> We will need to add at least one more DNS query to support MS-KKDCP
> (two if we have to treat http and https as separate queries). This is
> unavoidable. While it is true that this will result in a 50% increase
> in DNS queries, using my URI scheme means that a simple administrator
> configuration can turn this 50% increase into a 50% decrease in queries
> over the existing implementations. This is a win.

As an implementer I can tell you that it would be more than a decade
before I would ever be able to remove existing lookup methods and
possibly even longer than that.

As a deployer of a realm I can tell you that I have no control over
updates of Kerberos libraries in the clients.  Clients are deployed long
after the 10 year lifetimes of the operating systems and new features
such as this are not backported into prior OS distributions.
As such I would be unable to rely upon URI as a replacement for SRV for
more than 10 years.  I would be required to publish both URI and and SRV
lookup records forever.

You have described a reason why URI lookups are necessary for MS-KKDCP.
Please restrict your draft to that case.

Sincerely,

Jeffrey Altman