Locate KDC via DNS SRV records #60228
Conversation
danielashare
temporarily deployed
to
docs-amplify
GitHub Actions
Inactive
github-actions
bot
requested review from
boxofrad,
mmcallister,
probakowski,
ptgott,
r0mant and
zmb3
|
Amplify deployment status
|
@ptgott Thanks for this, good idea. I've slightly changed how this will look from a configuration point of view to the user. Instead of having a separate |
| dialer := net.Dialer{} | ||
| dial := func(dialCtx context.Context, network, address string) (net.Conn, error) { | ||
| return dialer.DialContext(dialCtx, network, address) | ||
| } | ||
|
|
||
| // In development environments, the system's default resolver is unlikely to be | ||
| // able to resolve the Active Directory SRV records needed for server location, | ||
| // so we allow overriding the resolver. | ||
| if resolverAddr := os.Getenv("TELEPORT_KDC_RESOLVER"); resolverAddr != "" { | ||
| s.cfg.Logger.DebugContext(ctx, "Using custom DNS resolver address", "address", resolverAddr) | ||
| // Check if resolver address has a port | ||
| host, port, err := net.SplitHostPort(resolverAddr) | ||
| if err != nil { | ||
| host = resolverAddr | ||
| port = "53" | ||
| } | ||
|
|
||
| customResolverAddr := net.JoinHostPort(host, port) | ||
| dial = func(ctx context.Context, network, address string) (net.Conn, error) { | ||
| return dialer.DialContext(ctx, network, customResolverAddr) | ||
| } | ||
| } | ||
|
|
||
| resolver := &net.Resolver{ | ||
| PreferGo: true, | ||
| Dial: dial, | ||
| } |
There was a problem hiding this comment.
Could all of this be abstracted behind some kind of "resolver" interface? One that we could initialize and pass to WindowsService during construction?
It seems like picking a resolver strategy is a separate concern from actually using it to resolve the KDC address, and the logic for each may evolve differently.
4 participants
We recently added the locating of LDAP servers through DNS SRV records. A customer requested that this same functionality be added for discovering KDC servers.
This PR adds optional configuration:
When enabled, Teleport will get the address of a KDC server from the AD domain when a user connects to a desktop.
changelog: Added auto discovery of KDC servers through SRV records