Subject: Re: DNS SRV question on priorities

From: Jeffrey Altman <[email-masked]>
Date: Fri, 12 Nov 99 17:28:10 EST

>> Clearly(?), the common case would use the name _kerberos._udp.REALM.
>> But only in the case where the realm is of domain-name form, and
>> kerberos-revisions says basically that such a realm name should be
>> used only by the organization controlling the corresponding domain
>> name, and that it be upper case only, etc.
> 
> i've been thinking this over.  there are three functions i get from krb.conf:
> 
> 1. map domain name -> realm name
> 2. map realm name -> key servers
> 3. map realm name -> admin server
>
> to accomplish #1 with DNS, we would need a character set mapping rule.
> but we would also need to be able to enter these mapped names into GTLD
> zones.  that is, if the VIX.COM realm isn't the same as the Vix.Com
> domain, then the owner of Com (or worse, the owner of ".") would have to
> make entries that allowed the mapped form of VIX.COM (in utf-8 or whatever
> notation) to be found.
>
> this isn't practical.
>
> i believe that the SRV draft should say that only kerberos implementations
> who violate the kerberos standard by treating realm names as caseless
> should look for SRV RR's.  or perhaps, they should say that after the
> standard kerberos lookup of the case-sensitive realm name in krb.conf (or
> in IV, krb.realms) has been done and has failed, should the associated SRV
> RR be used.
>
> the draft as last published handles case 2 above.
> 
> something like _master._kerberos._udp.REALMNAME handles case 3 above.
> 

First, let me state that we are primarily concerned with Kerberos 5 
and not Kerberos 4.  Kerberos 4 as far as I am aware is not undergoing
any new Kerberos development.

The rules for using DNS SRV require that 

. the local config file be searched first

. DNS SRV be used only if an entry in the local config file cannot be
  found

Now it is also my understanding that while DNS is case insensitive for
queries, it is case preserving for replies.  Hence, if an
administrator is using all upper case realm names then the search for 

  _kerberos.foo.org IN TXT "UPPER.CASE.REALM"

will return all upper case.  And that 

  _kerberos.bar.org INT TXT "Mixed.Case.Realm"

will return mixed case.

Since the case is preserved within the Kerberos libraries then the
proper handling will be done internally for computing hashes, etc.

When the query is then sent out for 

  _kerberos.Mixed.Case.Realm IN SRV 

the DNS will return the proper server info.  The only restriction is
that there cannot be two realms that match on a case insensitive
comparison.

    Jeffrey Altman * Sr.Software Designer * Kermit-95 for Win32 and OS/2
                 The Kermit Project * Columbia University
              612 West 115th St #716 * New York, NY * 10025
  http://www.kermit-project.org/k95.html * [email-masked]

---

From: Robert Elz <[email-masked]>
Date: Sat, 13 Nov 1999 20:53:26 +1100

Date:        Fri, 12 Nov 99 17:28:10 EST
    From:        Jeffrey Altman <[email-masked]>
    Message-ID:  <[email-masked]>

  | > i believe that the SRV draft should say that only kerberos implementations
  | > who violate the kerberos standard by treating realm names as caseless
  | > should look for SRV RR's.

That's essentially saying that realms are domain names, or some other
system needs to be invented.

  | Now it is also my understanding that while DNS is case insensitive for
  | queries, it is case preserving for replies.

That's not the case.   The DNS is case insenstive for doamain names.
Elsewhere it is case sensitive.  All queries are domain names, hence
queries are case insensitive.  Some replies are domain names, so some
replies can be sent in any case.   The DNS docs did say that servers
should preserve the case entered, and return that where possible, that
is, that each domain name would have one true canonical case.   But
while we know COM is in the root servers (not com), we also know how
many others actually have COM as their domain name ... and in any case
(no pun...) domain name compression forces the reply case to be the
query case many times.

But ...

  | Hence, if an
  | administrator is using all upper case realm names then the search for 
  |   _kerberos.foo.org IN TXT "UPPER.CASE.REALM"
  | will return all upper case.  And that 
  |   _kerberos.bar.org INT TXT "Mixed.Case.Realm"
  | will return mixed case.

Yes, because TXT is just storing ctaracter data, no knowledge of case
appears there, whatever is stored is returned.

  | The only restriction is
  | that there cannot be two realms that match on a case insensitive
  | comparison.

That means, kerberos realm names are (become) case insensitive....
(at least for many purposes, for others, I expect they would still
be case sensitive - that is the worst of both worlds ... in this file
VIX.COM and vix.com are different things, but in that other one they're
the same...).

kre