Re: [kitten] Kerberos Service Discovery using DNS

[Nathaniel McCallum <[e-mail]>]

On Wed, 2015-03-11 at 12:44 -0400, Benjamin Kaduk wrote:
> On Wed, 11 Mar 2015, Nathaniel McCallum wrote:
> 
> > On Wed, 2015-03-11 at 12:05 -0400, Benjamin Kaduk wrote:
> > > On Thu, 5 Mar 2015, Nathaniel McCallum wrote:
> > >
> > > > I have uploaded a new draft:
> > > >
> > > 
> http://datatracker.ietf.org/doc/draft-mccallum-kitten-krb-service-discovery/
> > > >
> > > > If you'd like to discuss it, reply to this message. :)
> > >
> > > I'm generally in favor of something like this.
> > >
> > > A few things that came to mind while reading it that have not > >
> already been
> > > raised:
> > >
> > > You cover kerberos and kpasswd, but not kadmin.  Any reason why? 
> > > (MIT's code does not currently support using DNS to locate an 
> admin > > server, but that's not a reason to reject adding it to a 
> discovery > > protocol in its own
> > > right.)
> >
> > My understanding is that kadmin is a proprietary protocol and has 
> not > been standardized. If that is incorrect, I can certainly add 
> it. Does > it already have a standardized discovery protocol?
> 
> There are at least two different proprietary kadmin protocols. SRV 
> records for _kerberos-adm._tcp.[realm] are documented by both MIT 
> and Heimdal, and exist at many sites.  It looks like Heimdal doesn't 
> actually implement client support for them, either, though, judging 
> by git
> grep.  (The corresponding draft-ietf-cat-krb-dns-locate seems to 
> have withered and died.)

I am hesitant to attempt to define a discovery method for an 
unstandardized service. I would rather the service be standardized and 
define its own prefix at that time.

Nathaniel