Subject: Re: [Ietf-krb-wg] reasons of DHCP-based KDC discovery

From: Nobuo OKABE <[email-masked]>
Date: Sun, 03 Aug 2008 07:42:31 +0100 (IST)

From: Sam Hartman <[email-masked]>
Subject: Re: [Ietf-krb-wg] reasons of DHCP-based KDC discovery
Date: Thu, 31 Jul 2008 11:26:25 -0400

> How would you feel about a DHCP option structure that included 
> 1) a default realm
> 2) a set of 0 or more mappings from realm to KDC IP address?

Yes, a realm and KDC IP address(es) are the minimum requirement.

Here are further considerations.
However, honestly speaking, I don't have any concrete idea yet.

  Usually, a KDC can be configured for multiple realms.

  When considering this case, it may be useful that
  a DHCP advertises multiple sets as candidates.
  # Of course, it is a bad idea to advertise too many sets.

  Or, a host can send a DHCP request with a realm
  for giving a hint to the DHCP server.

  In our case (= a Industrial system with DHCP(s) without DNS(s)),
  the similar case may appear when considering
  crossing realms even if even KDC is configured for single realm.

Thanks,

----- Nobuo Okabe, Ph.D. (Yokogawa Electric Corporation)
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Shoichi Sakane <[email-masked]>
Date: Mon, 04 Aug 2008 17:14:23 -0400

Hi Sam,

I think that the minimum content of the KDC option is both a realm name and a set of KDC IP address.
With this option, if the DHCP server has more than one realm, the server could send more than one KDC option.

There are two method to get more than one KDC IP address.
1. a client sends a request to the link.
   a DHCP server replies to the client with more than one KDC option.
2. a client sends a request with a specific realm name to the link.
   a DHCP server replies to the client with a KDC option regarding to the realm name.

In the 1st case, we need to define a KDC option.  We need to consider how to specify
the realm name in the request message.

BTW, could you tell me an example case where a client does not know its realm name,
but it knows a client name itself and it is installed a shared key with the KDC ?
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Mon, 04 Aug 2008 17:21:22 -0400

--On Monday, August 04, 2008 05:14:23 PM -0400 Shoichi Sakane 
<[email-masked]> wrote:

> Hi Sam,
>
> I think that the minimum content of the KDC option is both a realm name
> and a set of KDC IP address. With this option, if the DHCP server has
> more than one realm, the server could send more than one KDC option.

No, you can't send the same option more than once in a single DHCP message.

Sam is proposing an option which contains the following:

- A default realm name (presumably optional)
- A list of zero or more (realm, KDC) pairs, telling you the KDC for
  each realm.

Obviously, the question of whether to send zero, one, or more than one 
(realm, KDC) pair is up to the DHCP server operator, as is the question of 
which realms to include and for that matter whether to support the option 
at all.  But this proposal would support your usage, in which you need to 
include the (realm,KDC) pair for the client's realm and possibly for other 
realms (this may be useful if you have clients in several realms, since 
then the DHDP server does not need to know which client is in which realm).

> BTW, could you tell me an example case where a client does not know its
> realm name, but it knows a client name itself and it is installed a
> shared key with the KDC ?

That's easy; those are called "windows users".  They typically know their 
username, but not their realm name, and their password (key).

More generally, any workstation handling user logins may have a default 
realm which is used when users obtain tickets, even though the machine 
itself has no stored credentials.

-- Jeff

---

From: Shoichi Sakane <[email-masked]>
Date: Mon, 04 Aug 2008 17:33:18 -0400

Hi Jeff,

> - A list of zero or more (realm, KDC) pairs, telling you the KDC for

Do you agree with the following to have these information ?

- A KDC address sub-option in a KDC option includes a realm name and a set of KDC address.
- A KDC option is able to include a set of KDC address sub-option.
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Nicolas Williams <[email-masked]>
Date: Mon, 4 Aug 2008 16:35:54 -0500

> - A KDC option is able to include a set of KDC address sub-option.

Sounds like Sam's proposal minus the default realm.  I don't see why an
optional default realm would be bad.

Nico
--

---

From: Nicolas Williams <[email-masked]>
Date: Mon, 4 Aug 2008 16:25:48 -0500

On Thu, Jul 31, 2008 at 03:34:44PM +0100, Nobuo OKABE wrote:
> Hi all,
> 
> As pointed out int the meeting, we summarized reasons
> why DHCP-based KDC discovery is more suitable than
> the existing KDC discovery described in RFC4120
> for the industrial systems.
> 
> From: Larry Zhu <[email-masked]>
> Subject: [Ietf-krb-wg] Kerberos WG IETF72 meeting summary
> Date: Thu, 31 Jul 2008 05:11:27 -0700
> 
> > At the open mic, Shoichi Sakane mentioned the proposal he brought to
> > the dhc working group to create a DHCPv6 option for identifying a KDC. There is no support in the working group and Shoichi is asked to explain to the list why DNS is not acceptable in the applicable environment.
> 
> ========================================================================
> 1. Summary
> 
>    - The scope of this memo is industrial systems,
>      such as PA (Process Automation), FA (Factory Automation) and
>      BA (Building Automation).

There's nothing special about those environments.   There is something
special to some instances of those and other environments.

Any RFC for this feature should not really speak about PA, FA, BA, ...

>    - This memo describes reasons why DHCP-based KDC discovery
>      is more suitable than DNS-based KDC discovery described
>      in RFC4120 (= the RFC4120-way) for the industrial systems.
> 
>    - The main reason is that some industrial systems don't use DNS
>      because they have already had their own name spaces and
>      naming systems rather than FQDN and DNS.

I think we need one recommended/standard method of realm/KDC discovery.
This is so that vendors can know what minimal set of options to
implement so as to interop with each other.

Clearly the DNS method is more generic than the DHCP method, and so
should be the recommended/standard method.

A DHCP option seems like a reasonable alternative.  As an Informational
document this would be fine.

>    - Less servers benefits the industrial systems:
>      1) Less messages simplifying the systems.
>      2) Less servers contributing reliability,
>         and reducing management cost.

Sure.  On the other hand, DNS is pervasive.  I'm impressed that you've
been able to avoid its use for so long, but, let's face it, for better
or worse (worse, mostly) DNS is the standard protocol we have for
domainname resolution.

>    - We understand that RFC4120 does not require DHCP for KDC discovery.
>      However, we will have to solve DNS discovery
>      when considering the RFC4120-way.

I don't understand the above.

>      And it is natural way to use DHCP for the purpose.
> 
>    - DHCP-based KDC discovery is more efficient under those
>      systems (=expecting not to use DNS).
> 
>    - Please read the followings for the details.
> 
> [...]

Nico

---

From: Nobuo OKABE <[email-masked]>
Date: Tue, 05 Aug 2008 10:03:10 +0900 (JST)

From: Nicolas Williams <[email-masked]>
Subject: Re: [Ietf-krb-wg] reasons of DHCP-based KDC discovery
Date: Mon, 4 Aug 2008 16:35:54 -0500

> optional default realm would be bad.

We don't need to delete "default realm" option.
In some cases, the value of "default realm" appears in sub-opton.

---

From: Nobuo OKABE <[email-masked]>
Date: Tue, 05 Aug 2008 11:00:02 +0900 (JST)

Hi Nico,

From: Nicolas Williams <[email-masked]>
Subject: Re: [Ietf-krb-wg] reasons of DHCP-based KDC discovery
Date: Mon, 4 Aug 2008 16:25:48 -0500

> Any RFC for this feature should not really speak about PA, FA, BA, ...

yes

> document this would be fine.

I think that it would be OK with an Informational.

> or worse (worse, mostly) DNS is the standard protocol we have for

Agree.

Precisely speaking, we are not those who have defined
specifications of industrial systems.

  People who has worked for the industrial systems
  frequently avoid to use IP-related technology.
  We have tried to introducing IP-related technology
  with convincing them.

Anyway, we may face DNS in the future.
But it may take a long time.

  There are many technologies for the industrial systems.

  Their name-spaces and naming systems are depend on their applications
  whose lifetime is not short (10 years or more).

> I don't understand the above.

Sorry for my poor text.
This bullet is redundant
if the first half of this section is understandable.

> >    - Please read the followings for the details.

thanks,

---

From: Nicolas Williams <[email-masked]>
Date: Mon, 4 Aug 2008 22:01:51 -0500

>   We have tried to introducing IP-related technology

If there are standards published anywhere for these industrial systems
it would be nice to have a reference to them in the document for
DHCP-based KDC discovery.

Nico

---

From: Nobuo OKABE <[email-masked]>
Date: Tue, 05 Aug 2008 16:58:39 +0900 (JST)

Hi Nico,

From: Nicolas Williams <[email-masked]>
Subject: Re: [Ietf-krb-wg] reasons of DHCP-based KDC discovery
Date: Mon, 4 Aug 2008 22:01:51 -0500

> DHCP-based KDC discovery.

It's a good idea. And we will try if having chances.
A document published by IETF is very helpful for this purpose.

thanks,