In the krb5.conf file, you can specify kdc's statically, but there is no mechanism for prioritizing them or indicating which ones should be tried first.
You can also specify one or more master_kdc's, but based on the
documentation those are only accessed in the case of a password failure
on one of the regular kdc entries? If, hypothetically, all of the
regular kdc entries timeout, would the master_kdc entries still be used,
or would the request simply fail at that point with an unreachable kdc
error?
In the MIT krb5 implementation, they are tried in the order specified,
with a 1s delay in between. I can't speak to the Java implementation, unfortunately.
Any other suggestions for achieving a separate primary/failover configuration for two different network locations in a fashion that
would work properly with the Java kerberos client?
Last I checked with the Java implementation which is granted a very
long time ago (maybe 2012), they were used in order retrying failures
three times. I think that the default timeout was 30s between each
attempt meaning that it took 90s to reach the second KDC in the
list.
There is a krb5.conf var kdc_timeout, but I think that Java interprets
in in either micro or milliseconds whereas Heimdal uses the same
variable and interprets it in seconds. Some experimentation may
be in order.
You can also use the JNI implementation in Java which has the nice
property that you don't have an extra set of Java libs with a
separate set of bugs in your deployment.
In the MIT krb5 implementation, they are tried in the order specified,
with a 1s delay in between. I can't speak to the Java implementation, unfortunately.
The request would fail with an unreachable error, in the MIT implementation.
We're currently using DNS SRV records and all of our kdc's seems to have fairly equal load. Are DNS SRV records handled differently in terms of distributing load, or is that just a side effect of the resolver handing
them back in a different order for each lookup?
There's no mechanism for load balancing when using file based
kdc configuration?
Sysop: | Keyop |
---|---|
Location: | Huddersfield, West Yorkshire, UK |
Users: | 285 |
Nodes: | 16 (2 / 14) |
Uptime: | 74:05:13 |
Calls: | 6,489 |
Calls today: | 2 |
Files: | 12,096 |
Messages: | 5,275,931 |