[19132] in Kerberos_V5_Development
Re: Proposal for using NAPTR/URI records
daemon@ATHENA.MIT.EDU (Nico Williams)
Fri Feb 27 12:27:01 2015
MIME-Version: 1.0
In-Reply-To: <1425055963.9346.4.camel@willson.usersys.redhat.com>
Date: Fri, 27 Feb 2015 11:26:36 -0600
Message-ID: <CAK3OfOhm_nCxjzsVCpUoMUAjx9cQL8vLPkbHKWXdA5yG6eq1RA@mail.gmail.com>
From: Nico Williams <nico@cryptonector.com>
To: Simo Sorce <simo@redhat.com>
Cc: "krbdev@mit.edu" <krbdev@mit.edu>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krbdev-bounces@mit.edu
On Fri, Feb 27, 2015 at 10:52 AM, Simo Sorce <simo@redhat.com> wrote:
> On Fri, 2015-02-27 at 10:38 -0600, Nico Williams wrote:
>> I think this adds up to: multiple DNS queries, with some local
>> configuration will be needed to decide on a DNS query order.
>
> My preference would be to implement the URI protocol, but not enable
> querying for it by default in 1.14, add a tunable in [libdefaults ]
> called something like dns_uri_lookup_kdc = false|true|only and set it to
> false by default, change it to true later on ? (let downstream change
> the default if they so desire)
Yes, this. Eventually this should be enabled by default. We can give
sites a couple of years to move to URI RRs instead of SRV RRs.
Nico
--
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
