Subject: Proposal for Kerberos hostname->realm mapping

From: Ken Hornstein <[email-masked]>
Date: Fri, 09 Apr 1999 17:07:03 -0400

As some people may or may not remember, we sorta agreed on using DNS
SRV records in the form:

_kerberos._udp.realm

For looking up Kerberos servers via DNS.

Along the same vein, I suggest doing the following for mapping hosts to
realms via DNS:

_kerberos.hostname	IN	TXT	"YOUR.REALM.HERE"
_kerberos.domain	IN	TXT	"YOUR.REALM.HERE"

The idea is that you'd do a TXT record lookup first on a specific
hostname, and if that failed you'd try the domain.

Of course, you'd want to check any local configuration files first.

Comments?

--Ken
==========================================================================
This message was posted through the Stanford campus mailing list
server.  If you wish to unsubscribe from this mailing list, send the
message body of "unsubscribe ietf-cat-wg" to [email-masked]

---

From: [email-masked] (Johan Danielsson)
Date: 10 Apr 1999 21:55:41 +0200

> Of course, you'd want to check any local configuration files first.

We do this in Heimdal, but choose to use krb5-realm.domain instead,
but that is no big deal.

I think this is more common practice, than something you'd want to
standardise.

/Johan

---

From: Ken Hornstein <[email-masked]>
Date: Sat, 10 Apr 1999 23:04:09 -0400

>I think this is more common practice, than something you'd want to

Forgive me if I seem dumb, but are you saying "krb5-realm.domain" is
the more standard practice, or that we shouldn't standardize on
something at all?

My only reason for suggesting _kerberos.domain is to try to avoid name
collision (that's the reason for using _ in SRV records).  I'm willing
to listen to other ideas, of course.

--Ken

---

From: [email-masked] (Johan Danielsson)
Date: 11 Apr 1999 13:56:13 +0200

> the more standard practice, or that we shouldn't standardize on

Well, no. I only said we used it, but that the choise was pretty much
random. If people like _kerberos, fine by me. :-)

Does 1510 say anything about how to find a KDC, or how to figure out
what realm a service belongs to? I think it would be a good idea to
write down common practice, but I'm just not sure it has to be in
1510++.

You also have the hair-ball of the, not completely undocumented, MIT
krb5 API. A revised subset of the API docs would be a great thing.

/Johan

---

From: Ken Hornstein <[email-masked]>
Date: Mon, 12 Apr 1999 16:17:23 -0400

>random. If people like _kerberos, fine by me. :-)

Just trying to figure out the best way to do this :-)  What do other
people think?

>write down common practice, but I'm just not sure it has to be in

Hmmmm ... I have mixed feelings about this.  Maybe an informational
RFC on common Kerberos practices would be the right thing.  Cliff,
do _you_ think this should be in 1510++?

>krb5 API. A revised subset of the API docs would be a great thing.

Hey, one problem at a time :-)

--Ken