Subject: Re: comments on krb-dns-locate draft

From: Jeffrey Altman <[email-masked]>
Date: Tue, 23 Nov 99 12:24:50 EST

> Jeffrey Altman <[email-masked]> writes:
> 
> > I will once again ask the simple question.  How can the user as the
> > KDC to instruct it as to which realm should be used for a host if I
> > have not yet determined the realm?
> 
> As I interpreted it, you'd ask your own KDC.  It deals with the name
> lookup in some unspecified but secure way, and gives you the answer.
> The proposal only addresses TGS_REQs, so I guess it's assumed you've
> figured out your own KDC's location already for the AS_REQ, and the
> security isn't that big a deal in this case, since if it's spoofed,
> the check against some local secret will still fail.

In other words I still must use DNS TXT and DNS SRV to find out that
my local realm is KRB5.COLUMBIA.EDU and KDC is
yclept.kermit.columbia.edu.  Then I am supposed to ask
yclept.kermit.columbia.edu for the realm of foo.athena.mit.edu and its
associated KDC?  

How is yclept.kermit.columbia.edu supposed to have a better idea of
what's in ATHENA.MIT.EDU than the client?

    Jeffrey Altman * Sr.Software Designer * Kermit-95 for Win32 and OS/2
                 The Kermit Project * Columbia University
              612 West 115th St #716 * New York, NY * 10025
  http://www.kermit-project.org/k95.html * [email-masked]

==========================================================================
This message was posted through the Stanford campus mailing list
server.  If you wish to unsubscribe from this mailing list, send the
message body of "unsubscribe ietf-cat-wg" to [email-masked]

---

From: Ken Raeburn <[email-masked]>
Date: 23 Nov 1999 12:59:39 -0500

> yclept.kermit.columbia.edu for the realm of foo.athena.mit.edu and its

Actually, my guess was that the authors were assuming a config file
would point you to the local KDC.  But that would force the principal
to be in one specific realm, or a closed list of realms.  Unless
draft-swift-win2k-krb-referrals-00 or some other proposal addresses
that....

> what's in ATHENA.MIT.EDU than the client?

Dunno.

---

From: Jonathan Trostle <[email-masked]>
Date: Tue, 23 Nov 1999 14:13:35 -0800

>draft-swift-win2k-krb-referrals-00 or some other proposal addresses

The client knows its realm name, and the SRV record is used to locate the
KDC, as specified in the dns-locate draft.
Jonathan