Re: [kitten] Finding Kerberos Realm Descriptors in secure DNS

[Nico Williams <[e-mail]>]

On Wed, Sep 16, 2015 at 06:08:43PM +0000, Viktor Dukhovni wrote:
> so indeed PTR is not case-preserving.  The choice is to use "TXT"
> which is already supported by both MIT and Heimdal, or to bite the
> bullet and define realms as being domain names, and if two strings
> are the same valid domain name, then they are the same realm.

Certainly there's no harm in describing the TXT RR approach (as
implemented) in an Informative RFC.

I do think we should define domain-style realm names as being
domainnames, which means they must be treated case-insensitively by KDCs
and services.  That's not new: WIndows and AD do this.  Since it can be
a breaking change for apps that do name-based authorization, it's useful
to "canonicalize" realm names at the service (acceptors), and preferably
where possible at the client (kinit, pam_krb5, alike).

> I still see no advantage in introducing KREALM.  Just needlessly
> less usable than TXT.

Because of the middle-box problems, right?  Agreed.

Nico
--