[35725] in Kerberos
Re: Query - How to determine the KDC
daemon@ATHENA.MIT.EDU (Rick van Rein)
Fri Jan 31 10:29:16 2014
Mime-Version: 1.0 (Mac OS X Mail 7.1 \(1827\))
From: Rick van Rein <rick@openfortress.nl>
In-Reply-To: <CAGRZLnEsG6XqcFEiek7VecTf1uhB8L8S6OshFML9sAiua+QbFw@mail.gmail.com>
Date: Fri, 31 Jan 2014 16:29:02 +0100
Message-Id: <5C4F32DD-8C7D-4D20-9B93-E150AA5A6676@openfortress.nl>
To: Priya Balakrishnan <priya9907@gmail.com>
Cc: kerberos@mit.edu
Content-Type: text/plain; charset="windows-1252"
Errors-To: kerberos-bounces@mit.edu
Content-Transfer-Encoding: 8bit
Hi,
> Hope this isn't a silly question. Is there a command/tool that tells us
> which is the KDC for a particular realm ?
You’d normally guess that the realm name is a DNS name, as is suggested in manuals, and then look it up (no lowercase casting necessary, as DNS is agnostic to case). You lookup the _kerberos TXT record for confirmation that it matches the realmname.
Note 1. Characters in TXT records are case-insensitive too, even if they are usually served in the same case as in the zone file; so any letter is interpreted as an uppercase, unless modified (I think there was a prefix char such as an underscore to map the next char to lowercase). This is a bit silly because DNS names are not, and Kerberos realm names are case sensitive. The common uppercase notation for realms is given the preferential notation without escapes.
Note 2. This lookup is as reliable as your DNS; in other words, you probably want to ensure that DNSSEC is being used if what you are doing with the information could have any security implication.
-Rick
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
