Kerberos behind load balancer?

[Henry B. Hotz]

My basic objection to a load balancer is that Kerberos was designed to  
do its own failover without one.

Kerberos was also originally designed to require FQDN's to uniquely map  
to the destination IP numbers.  Violations of those assumptions  
deserved to fail because they might indicate some attempted crack.   
While things have changed a lot, I would not be sanguine about avoiding  
all the possible side effects.

I would be concerned independent of any specific problems which have  
been identified.

On Oct 6, 2004, at 5:23 PM, kerberos-request at mit.edu wrote:

> Well, the answer to this question is complex. We don't think a
> load-balancer will be required for our deployment, but it would  
> simplify
> the end-user experience.

I think many of us still don't understand why you say this.  Let me  
attempt to clarify.

My assumptions are (pretty much what Ken H suggested):

1) The user's get given a standard krb5.conf file with all the (real or  
potential) slave kdc's and the master kdc listed.  There is no  
mentionable overhead for configuring extra kdc entries on all clients  
ahead of time.

2) You're using standard Kerberos software like MIT, Heimdal, Sun, or  
Microsoft.

3) Your app's use the libraries from 2).

Then all applications will try all the kdc's listed in the krb5.conf  
before failing.  No load balancer or DNS tricks needed.

The only place you might loose is when the master goes down.  Then  
admin and password change access fails.  But it would fail anyway!  (I  
presume you weren't going to have a password change get sent to a  
random kdc.  That would make normal password changes usually fail.)   
(I'm not trying to be insulting here, just very, very clear and basic.)

Password change and admin access do not need the same reliability that  
normal authentication does.  I suspect you could do without for a few  
days and hardly feel it.

I get it that DNS changes and "unusual" entries are a problem.  Here's  
a suggestion:  Don't use the load balancer for normal operations (see 1  
above).  If and only if the Kerberos master fails, then use the load  
balancer to redirect traffic to your stand-in master.  You'll probably  
have to play some games with name resolution on the stand-in to make  
everything work, and I recommend you test the contingency plans  
carefully.

Does this help?
------------------------------------------------------------------------ 
----
The opinions expressed in this message are mine,
not those of Caltech, JPL, NASA, or the US Government.
Henry.B.Hotz at jpl.nasa.gov, or hbhotz at oxy.edu