]> Red Hat, Inc.

100 East Davie Street Raleigh NC 27601 USA npmccallum@redhat.com

Security Internet Engineering Task Force This document proposes defines a new mechanism for discovering Kerberos services using DNS. This new mechanism extends the mechanism already defined in Kerberos V5 and has four goals. First, reduce the number of DNS queries required to discover a Kerberos KDC. Second, provide DNS administrators more control over client behavior. Third, provide support for discovery of the MS-KKDCP transport. Fourth, define a discovery procedure for Kerberos password services.

Section 7.2.3 of Kerberos V5 defines a procedure for discovering a KDC based on DNS SRV records. This method has three drawbacks. First, two DNS queries are required to locate a single service (one for UDP and one for TCP). Second, specifying UDP and TCP in separate records means that the DNS administrator has no control over client preferences for TCP or UDP. Third, any new transports for reaching the KDC (such as MS-KKDCP) will require new records and additional DNS queries. The Kerberos Password protocol has no defined procedure for discovery similar to the KDC method described above. Implementations have largely chosen a similar method to section 7.2.3 of Kerberos V5, inheriting the same drawbacks outlined above. This RFC defines two new URI DNS records; one each for KDC and Kerberos Password service discovery.

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119.

This document does not define a new mechanism for translating Kerberos realms to DNS domains. The existing mechanism as defined in section 7.2.3.1 of Kerberos V5 MUST be followed.

The following URI formats MUST be supported by clients. These formats indicate support for the standard UDP and TCP transports. The port number is optional. If the port is not specified, the client MUST default to the standard port of the service (Kerberos V5 or Kerberos Password). udp://host[:port] tcp://host[:port]

The following URI formats MAY be supported by clients.

These URIs indicate support for the MS-KKDCP protocol. The port number is optional. If the port is not specified, the client MUST default to the standard port of the transport (HTTP or HTTPS). The path is also optional. http://host[:port][path] https://host[:port][path]

In order to discover a KDC service location, the client MUST query the following URI DNS record (REALM indicates the translation of the Kerberos realm to a DNS domain): _kerberos.REALM TTL, Class, URI, Priority, Weight and Target have the standard meanings as defined in RFC 2782 and the URI DNS record type. Target SHOULD contain one of the URI formats specified in this document.

In order to discover a password service location, the client MUST query the following URI DNS record (REALM indicates the translation of the Kerberos realm to a DNS domain): _kpasswd.REALM TTL, Class, URI, Priority, Weight and Target have the standard meanings as defined in RFC 2782 and the URI DNS record type. Target SHOULD contain one of the URI formats specified in this document.

If an existing discovery protocol is supported by a client, the client SHOULD perform the URI lookup as defined in this document first. If no URI record is found, the client MAY attempt discovery using another protocol.

&rfc2119; &rfc2782; &rfc3244; &rfc4120; &rfc7553; Microsoft