Re: [kitten] Finding Kerberos Realm Descriptors in secure DNS

[[e-mail] (Martin Rex)]

Greg Hudson wrote:
> On 09/15/2015 03:09 AM, Rick van Rein wrote:
>> 
>> So... it may be reasonable to assume that any KREALM client could
>> work with multiple realms, because they will normally be KDCs.
>> And that'd mean we wouldn't need this priority or go-for-this-one flag.
>> Agreed?
> 
> A KDC can only return one referral, so I'm not sure what it would do
> with multiple realms, with or without priorities.  Perhaps I'm missing
> something.

KDCs and client may have substantially different requirements/purposes.

With traditional Kerberos, a service can only have one unique
Kerberos principal name (in exactly one Kerberos Realm).

So for users from different locations, which locally authenticate
via Kerberos, accessing a central (cross-location or cross-organization)
service traditionally requires Kerberos realm to trust each other
and transparent cross-location / cross-organization access for some
very dangerous network protocols.

(dns: upd/53, ldap: udp/389, kerberos: udp/88 and tcp/88)

Conceptually, setting up a central service with seperate/distinct
service principals from each remote location/organization totally
obviates creating long-distance kerberos realm trust relationships
along with the dangerous network protocols.


In our own Single Sign-On solution, with our own implementation of the
relevant server-side AP_REQ processing we currently support the concurrent
use of kerberos service principals from seperate/independent Kerberos Realms,
and it is actively being used by customers.


-Martin