Re: [kitten] Kerberos Service Discovery using DNS

[Benjamin Kaduk <[e-mail]>]

On Fri, 6 Mar 2015, Nathaniel McCallum wrote:

> On Fri, 2015-03-06 at 16:43 -0500, Greg Hudson wrote:
> >
> > The current draft does allow the URI records to express no
> > preference of UDP versus TCP; one can simply give them the same
> > priority and don't use weights.  But if the URI records express a
> > preference, should a client always honor that preference, or can it
> > ignore it--say, if the packet is large?
>
> I would say that the client must never ignore the DNS preference.
> Large packets are not usually generated on the fly by clients but are
> either server responses to clients or are the result of server-
> configured preauth mechs. This means that the server in question has
> been configured to cause these large packet sizes. Because of this,
> the DNS preferences should match the server's configuration. Anything
> other than this is a misconfiguration.

The client can always supply arbitrary authdata and request its inclusion
in the ticket.  The KDC need not know in advance when this might happen or
what it might include.

> I'd be happy to add a statement to this effect in the draft.

I would prefer Simo's approach.

-Ben