possible new project: better realm determination heuristics -- any takers?

Ken Raeburn raeburn at MIT.EDU
Mon Apr 7 14:54:45 EDT 2008


One area we're looking to improve our package is in configuration  
requirements -- minimizing the need to manually set up the config file  
on client hosts -- and realm determination, both of server hosts and  
especially of the local host as a client, is a particular case of  
this.  Is anyone interested in making some improvements in this area?

Currently, we look for default_realm in the config file, and if that  
doesn't work, and the compile-time and run-time configurations allow,  
we try looking up some "_kerberos" TXT records in DNS, and then give  
up. But our code for determining the realm of a server host does other  
checks that we don't do for the local realm, like checking the current  
hostname and parent domains in the domain_realm mapping table;  
aligning the two sets of heuristics, to the degree that it makes  
sense, would also be helpful.

There are probably other fairly cheap heuristics that could be  
implemented as well, for both servers and default realm  
determination.  For example, guess that the hostname itself, or the  
parent domain, is also the realm name, and see if we can figure out  
where the KDCs are; if we can't, retry with the next domain up towards  
the root.

These seem pretty easy.  If someone is interested in expanding on the  
details a bit and perhaps implementing some of this, we'd like to hear  
from you.

Ken



More information about the krbdev mailing list