Re: [kitten] Fwd: New Version Notification for draft-vanrein-dnstxt-krb1-05.txt

[Nico Williams <[e-mail]>]

On Fri, Sep 18, 2015 at 01:08:56PM +0200, Rick van Rein wrote:
> Or, we could simply say
> 
>    "All retrieved _kerberos PTR data MUST be cast to all-uppercase characters
>    before processing with Kerberos and/or GSS-API.  This compensates for the
>    uncertainty of case mappings in DNS.  Kerberos realms that want to be
>    reachable through these PTR records MUST accept requests with the
>    realm name in all-uppercase form."

I'm very reluctant to agree to that, but I'd agree to saying that a TGS
client should first try the realm as it appears in the PTR RR and then
as up-cased if the first failed.

> This does not change the semantics of Kerberos AFAIK, and it remains open to

To be clear, there isn't and never has been a requirement that realm
names be upper-case.  Therefore your proposal would be in conflict with
Kerberos semantics, and the only saving grace is that sites with
non-all-upper-case realm names could simply not use PTR RRs this way.

> future changes in case handling in the KDC.  The mapping to uppercase is not
> a compensation for a temporary condition, but for the permanent uncertainty
> around case handling of PTR record data.

I realize that asking implementors to support realm aliasing is probably
a lot, but maybe not that much.  KDCs already have a list of realms
served.

The only thing that concerns me is how to canonicalize realm names for
name-based authorization.  This is the case where an AS client used an
alias realm name and now cannot get authorized to access some resources.
A service could canonicalize the client's realm name, but without a hint
from the KDC this won't scale.  The simplest thing to do is to reject
such AS-REQs and require that the client know the user's canonical
realm.  The next simplest thing to do would be to extend the AS protocol
to allow the AS to tell the client its canonical realm.  The next
simplest (and, really, hardest) thing to do would be to include
authz-data in tickets telling services the canonical form of the
client's realm.

> Shall I formulate the above in an individual submission and leave it to Kitten
> whether they want to lift it up the a WG spec?  That way we'd at least be out
> of the current impasse on this matter.

Sure.

Nico
--