Re: Does KDC service need the [realms] section in its configuration file?

On 05/14/2018 07:30 AM, Paul Robert Marino wrote:
> In modern implementations no in fact you shouldn't instead you should use the DNS for all of these settings and at most use the default realm and possibly the domain to realm matching section.
> In most implementations of Kerberos the ability to set this local is deprecated or not avaliable at all amy more. Even in MIT's implementation it is slated to go away in a few versions so it is generally considered a bad idea to use it. Also the testers of the client libraries are mostly testing around DNS so you may run into issues if you use that section of the configuration.

Speaking as the primary maintainer of MIT krb5, we have no plans to get
rid of [realms] -> realmname -> kdc, and to my knowledge we never had
any such plans.  Our continuous integration tests use it, and many
client machines at MIT specify [realms] -> ATHENA.MIT.EDU -> kdc values.
 I don't see anything in our documentation discouraging its use.

Also, I'm not sure this answer is responsive to the original question,
which was about the KDC.  As to that question, I am not super familiar
with the Heimdal code, but looking at kdc/connect.c:configure() and
lib/krb5/get_addrs.c:krb5_get_all_server_addrs(), it doesn't look like
the KDC uses [realms] -> realmname -> kdc.  Instead, it looks like it
uses [kdc] -> addresses and [kdc] -> ports; if those don't exist, it
enumerates interface addresses and uses a list of standard ports (port
88 and maybe port 80 and 9878 depending on whether the KDC is also
serving HTTP and kx509).