Subject: [Ietf-krb-wg] Review of Kerberos and draft-sakane-dhc-dhcpv6-kdc-option-03.txt

From: Sam Hartman <[email-masked]>
Date: Tue, 18 Nov 2008 16:21:23 -0500 (EST)

Dear chairs: An author of draft-sakane-dhc-dhcpv6-kdc-option-03.txt
 came to the Kerberos working group and asked for review of his draft.

I'm providing review as an individual but I think others in the
kerberos wg have agreed with me when discussing this issue in the
past.

Section 2.2 conflicts with how Kerberos views KDC discovery.  There
are cases where a client needs to contact KDCs not in its default
realm.  So, option 2.2 needs to provide some way to indicate the realm
of the KDC for which an address is being requested.
It needs to be the case that multiple realms can be specified in the DHCP option.

Section 2.1 should make it clear that it specifies the default realm of the client, not the realm.  It's not clear what a realm of a client is; default realm is at least reasonably well defined in implementations.

If the way you resolve my concern about 2.2 is to support multiple
instances of the 2.1 option, then the first should be the default realm and subsiquent realm sub-options should simply specify the realm for following kdc address sub-options.

Thanks for your consideration,

--Sam
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Shoichi Sakane <[email-masked]>
Date: Wed, 19 Nov 2008 13:34:12 +0900

Hi Sam,

This option can contain multiple sub-options.  If you need to specify
a set of realms, and a set of KDCs for each realm, you just put a set of
a Realm sub-option immediately followed by a set of KDC sub-option.
For example, it is like the following order of sub-option in the Kerberos
option, realm + kdc + realm + kdc + kdc.

I am not sure if I understand what you want to do correctly.
In the cross-realm operation, a DHCP servers need to provide
a default realm for the client, and other cross-realms.

It is realized to have a default realm bit in the Realm sub-option.
The kerberos option contains like the following sub-options:
realm with a default bit + kdc + realm + kdc + realm + kdc + kdc.

===
Shoichi Sakane