Re: [kitten] Finding Kerberos Realm Descriptors in secure DNS

[Nico Williams <[e-mail]>]

On Tue, Sep 15, 2015 at 02:36:36PM -0400, Greg Hudson wrote:
> On 09/15/2015 03:09 AM, Rick van Rein wrote:
> > See... we're requiring DNSSEC to validate the KREALM record, and it
> > is going to be difficult in general to rely on clients to accomadate
> > that; they may be subjected to crummy NAT routers that interfere
> > with, and break DNSSEC.  So, we will probably be dependent on KDCs
> > for practical deployment of KREALM, and a KDC could use KREALM
> > records to inspire a Server Referral in the style of RFC 6806.
> > 
> > So... it may be reasonable to assume that any KREALM client could
> > work with multiple realms, because they will normally be KDCs.  And
> > that'd mean we wouldn't need this priority or go-for-this-one flag.
> > Agreed?
> 
> A KDC can only return one referral, so I'm not sure what it would do
> with multiple realms, with or without priorities.  Perhaps I'm missing
> something.

Er, do we really want KDCs doing DNS queries for processing TGS-REQs?

I believe it could be done, and certainly LDAP and other things add
pressure to implement async evented KDCs, so that adding DNS queries
into the mix wouldn't be a big deal, but I suspect implementors are not
ready to bite that bullet.

Would this proposal (or variants discussed) really solve a _pressing_
problem?  Or a problem we believe will be pressing?

Nico
--