freeipa

#8968 Add URI records for KDC
Closed: fixed by frenaud. Opened by cheimes.

Closed: fixed
Reopen Issue

Request for enhancement

To simplify OpenShift / Kubernetes integration, FreeIPA should provide URI records in addition to SRV records. As of today Kubernetes does not support SRV records with same name but different protocols, e.g. _kerberos._tcp and _kerberos._udp entries. #97149.

URI discovery support was added in MIT KRB5 1.15. Kerberos clients prefer _kerberos and _kpasswd URI records over SRV records. URI records have priority and weight just like SRV records. In addition to SRV record they can encode different types of transport and have flags.

Example:

_kerberos.EXAMPLE.COM  URI  10 1 krb5srv:m:tcp:kdc1.example.com
                       URI  20 1 krb5srv:m:udp:kdc2.example.com:89
                       URI  40 1 krb5srv::udp:10.10.0.23
                       URI  30 1 krb5srv::kkdcp:https://proxy:89/auth

Benefits:

  • URI records provide an easy workaround for the Kubernetes issue.
  • URI discovery is slightly faster than SRV discovery. Kerberos clients first do a URI DNS query, then fall back to multiple SRV queries.

Upstream documentation: https://web.mit.edu/kerberos/krb5-latest/doc/admin/realm_config.html#kdc-discovery

Metadata Update from @cheimes:
- Custom field on_review adjusted to https://github.com/freeipa/freeipa/pull/5990

master:

  • f1c58fb6466fba516f3d3e50a1a982b0162ef902 Add URI system records for KDC

ipa-4-9:

  • 2cf0ad5cfd2d558c844bc9640c121fa35ebb1c30 Add URI system records for KDC

Metadata Update from @frenaud:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

Metadata Update from @abbra:
- Custom field changelog adjusted to FreeIPA DNS integration now provides URI records for a dynamic discovery of Kerberos KDCs. This allows automatic discover and use of MS-KKDCP proxies. URI records are also Kubernetes-friendly as Kubernetes does not support SRV records with the same name and different protocols.
Metadata
None

containers rfe

None
None
Normal
https://github.com/freeipa/freeipa/pull/5990
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.