Jos Backus wrote:
There are several issues here. First, DNS TXT records are known to be insecure. Turning them on for use in realm resolution provides for convenience but at the risk that your clientsOn Fri, Jun 27, 2008 at 12:52:49AM -0400, Jeffrey Altman wrote:This behavior was most likely broken when the referrals code was added.So it's a regression. Until this is fixed properly (which I don't claim my patch does :-) ) I'm possibly need of a workaround. Do you see anything wrong with the patch as such?
can be redirected to a realm that you do not control.Second, any domain_realm mapping for your domain .foo.com is going to override the use of DNS lookups. That is because local configuration data is considered to be trustworthy
whereas DNS lookups are not.In the case of two realms, PROD.FOO.COM and DEV.FOO.COM some of your hosts are in one and some are in the other. By default you want PROD.FOO.COM to be used. However, for specific hosts you want DEV.FOO.COM. Using the config file you would
specify [domain_realm] devhost1.foo.com = DEV.FOO.COM .foo.com = PROD.FOO.COMIf you want to rely on DNS TXT records you have to make sure that there are no mappings
in the config file. Then you would create records for _kerberos.devhost1.foo.com IN TXT DEV.FOO.COM _kerberos.foo.com IN TXT PROD.FOO.COMBecause DNS TXT records are insecure and there is a need to be able to provide for centralized configuration data Microsoft created the Kerberos referrals mechanism. Using referrals a client asks the KDC belonging to the TGT realm for a referral to the correct realm for the desired service principal. Referrals are used whenever there is not a local [domain_realm] mapping.
The safe way to add DNS TXT records back into the equation would be to add the DNS TXT
lookup after the referrals request fails.
smime.p7s
Description: S/MIME Cryptographic Signature
________________________________________________ Kerberos mailing list [email protected] https://mailman.mit.edu/mailman/listinfo/kerberos
