Subject: Re: DNS SRV for Kerberos

From: Jeffrey Altman <[email-masked]>
Date: Fri, 12 Nov 99 10:32:22 EST

> > OK, I just read it.  I stand corrected.  The DNS could represent those
> > three SRV records as different DNS records, if an encoding for case in
> > the labels was devised.  The draft I was reviewing did not propose any
> > such encoding; are you suggesting that it should?
> 
> yes, i think it should.
> 
> actually, i think kerberos realm names ought not be case sensitive, but
> nobody on namedroppers cares what i think about how kerberos ought to work,
> so given that this conversation only has a dns context, i think that the
> realm names ought to be mapped into unambiguous dns names.  utf-8 anybody?
> 
> note that this will impact win2000, which went ahead and used SRV for
> kerberos well in advance of the draft we're here debating.  (which i'm
> not slamming them for -- per-service RFC's for each use of SRV was never
> something we expected... but still there's this character set issue.)
> 

Ken and I will take care of the character-set issue.  UTF-8 will not
work because the lower / upper case issues will still exist in ASCII
names.  What would be required is an escaping mechanism for upper or 
lower case characters.

    Jeffrey Altman * Sr.Software Designer * Kermit-95 for Win32 and OS/2
                 The Kermit Project * Columbia University
              612 West 115th St #716 * New York, NY * 10025
  http://www.kermit-project.org/k95.html * [email-masked]

---

From: Jeffrey Altman <[email-masked]>
Date: Wed, 17 Nov 99 23:45:15 EST

> > Even so in this case 
> > 
> >   service   = foo._kerberos
> >   transport = tcp
> >   host      = REALM
> > 
> > this is assuming that the function automatically adds the underscores.
> > so the final query becomes
> > 
> >   _foo._kerberos._tcp.REALM IN SRV
> 
> That's a lot of grody detail for the application to have to know.
> (This objection may not be applicable to Kerberos, which is pretty
> danged grody already.)

Which application?

How is knowing that the name to search on is 

  foo._kerberos

any worse than knowing it has to be

  uptodate_kerberos