Subject: RE: comments on krb-dns-locate draft

From: "Paul Leach (Exchange)" <[email-masked]>
Date: Tue, 21 Dec 1999 16:53:07 -0800

In this case, only one "draft 3" principal name mapping is needed at
MIT.EXAMPLE.COM:   * :-> NT.EXAMPLE.COM

Since NT domains can all be grouped into one "forest", and all MIT realms
can point to the NT forest root, then the forest root will take care of
finding the services's realm/domain given services's principal name. Hence,
the above case actually covers a lot of other ones.

In general, though, you are correct:  if one is going to permit the use of
flat service names _and_ arbitrary assignment of services to NT realms that
are in disjoint trust tress, and get service authentication, a complete
mapping of flat names to realms needs to be kept. I claim that this is an
intrinsic problem: it needs to be kept _somewhere_, and it needs to be kept
somewhere _trustworthy_.  That leaves only two viable candidates, as far as
I can see: the client or the KDC. We chose the KDC, because there are fewer
of them to manage.

Please don't forget, in the example given, "foo" usually isn't even a DNS
name -- it is a NetBIOS name, and resolved via WINS, not DNS. This was a
legacy we had to deal with.

Paul

---

From: Bill Sommerfeld <[email-masked]>
Date: Tue, 21 Dec 1999 20:28:49 -0500

DNS is clearly evolving to be an adequate alternative to WINS; I don't
think we should start complicating kerberos now to adapt to a protocol
which can be straightforwardly replaced by a standard ietf protocol.

					- Bill
==========================================================================
This message was posted through the Stanford campus mailing list
server.  If you wish to unsubscribe from this mailing list, send the
message body of "unsubscribe ietf-cat-wg" to [email-masked]