Subject: Re: DNS SRV question on priorities

From: Paul A Vixie <[email-masked]>
Date: Fri, 12 Nov 1999 13:56:27 -0800

> Clearly(?), the common case would use the name _kerberos._udp.REALM.
> But only in the case where the realm is of domain-name form, and
> kerberos-revisions says basically that such a realm name should be
> used only by the organization controlling the corresponding domain
> name, and that it be upper case only, etc.

i've been thinking this over.  there are three functions i get from krb.conf:

1. map domain name -> realm name
2. map realm name -> key servers
3. map realm name -> admin server

to accomplish #1 with DNS, we would need a character set mapping rule.  but
we would also need to be able to enter these mapped names into GTLD zones.
that is, if the VIX.COM realm isn't the same as the Vix.Com domain, then the
owner of Com (or worse, the owner of ".") would have to make entries that
allowed the mapped form of VIX.COM (in utf-8 or whatever notation) to be found.

this isn't practical.

i believe that the SRV draft should say that only kerberos implementations who
violate the kerberos standard by treating realm names as caseless should look
for SRV RR's.  or perhaps, they should say that after the standard kerberos
lookup of the case-sensitive realm name in krb.conf (or in IV, krb.realms) has
been done and has failed, should the associated SRV RR be used.

the draft as last published handles case 2 above.

something like _master._kerberos._udp.REALMNAME handles case 3 above.

---

From: Ken Raeburn <[email-masked]>
Date: 13 Nov 1999 02:12:50 -0500

> 3. map realm name -> admin server

Actually, the admin server is not the other use we're talking about.
The _kerberos-adm SRV lookup gets you the host/port to talk to to make
database changes, and _kpasswd gets you the host/port for password
changes.  The second use we need is to find the Kerberos server (KDC)
or servers that get changes propagated to them most quickly.  This may
be one or more of the _kerberos entries that happen to have the same
hostname as the _kerberos-adm or _kpasswd entries; then again, it may
not.  (Consider a test realm running master and multiple slaves on one
host.)

> allowed the mapped form of VIX.COM (in utf-8 or whatever notation) to be found.

I think the solution for realm names differing only in case is to say,
"you lose".  (Well, a little more formally for the document, perhaps.)

Making realm names case-sensitive was probably a poor choice, but we
can't reverse it now without breaking lots of functioning realms.
(Though, if we can come up with a smooth transition mechanism, just
maybe....)  And I'm not sure we should change it for realm types other
than domain-name ones.

The kerberos-revisions draft says the domain name form must (should?)
be upper case.  (Except for the backwards-compatibility issue, we
could look at it as case-insensitive domain names, but coerced to
upper-case for internal use.)  It's not possible to have the VIX/Vix
problem without violating this.  Still, since we'll need to support
realms that do violate this rule for backwards compatibility, it may
be worth *also* putting into the kerberos-revisions draft something to
the effect that setting up multiple realms this way is not allowed.

Or, we can say that SRV records must not be used in such cases, unless
the same set of servers will serve both (all) of the realms.

> something like _master._kerberos._udp.REALMNAME handles case 3 above.

I think the term "master" is a poor one to use in trying to nail down
the spec because the "Kerberos master KDC" has in the past had the
implicit assumption that multiple services and database update
characteristics coincide on one host, and that assumption falls apart
in various scenarios; so which *one* service or characteristic should
the term apply to?  I don't think we can arbitrarily pick one without
causing confusion.

The attribute we care about in this instance is the order of updates,
which is why I suggested "_fast-update" for the first component, or
maybe just "_update" would suffice.

---

From: Ken Raeburn <[email-masked]>
Date: 12 Nov 1999 02:08:28 -0500

Well, the use of two SRV records seems pretty agreeable to most, but
that still leaves the question of naming them.

For the less common case...

fast-update._kerberos._udp.REALM ?
_fast-update._kerberos._udp.REALM ?
_kerberos-master._udp.REALM ?