Subject: Re: comments on krb-dns-locate draft

From: Jeffrey Altman <[email-masked]>
Date: Thu, 9 Dec 99 17:32:45 EST

> >We do not depend on DNS security. We use the directory to locate referrals -
> >not DNS. DNS is only used to locate a KDC for a domain/realm.
> 
> Okay, I'm going to show my ignorance here ... _which_ directory are we
> talking about?
> 
> I guess the real question is, "How are hostnames canonicalized?"  Is this
> done via DNS?  The "directory"?  Is there a relationship between the DNS
> and the "directory"?

I assume that the MS folk are referring to their Active Directory.

(This is one of those assumptions I was referring to in earlier
posts.)

    Jeffrey Altman * Sr.Software Designer * Kermit-95 for Win32 and OS/2
                 The Kermit Project * Columbia University
              612 West 115th St #716 * New York, NY * 10025
  http://www.kermit-project.org/k95.html * [email-masked]

==========================================================================
This message was posted through the Stanford campus mailing list
server.  If you wish to unsubscribe from this mailing list, send the
message body of "unsubscribe ietf-cat-wg" to [email-masked]

---

From: Jonathan Trostle <[email-masked]>
Date: Thu, 09 Dec 1999 16:28:55 -0800

>> done via DNS?  The "directory"?  Is there a relationship between the DNS

The KDC queries the backend database using the server name and receives
back the realm for that name. It's a name mapping function.
Jonathan

---

From: Ken Hornstein <[email-masked]>
Date: Fri, 10 Dec 1999 00:40:53 -0500

>back the realm for that name. It's a name mapping function.

Except .... the client apparantly does a DNS lookup at some point.  To
quote you from previous email:

>>And how is application supposed to know to request that name?
>
>It does the DNS lookup, finds out that it's an alias. On the reverse
>lookup, it picks up the primary name. So it knows how to construct the name.

--Ken