Re: aname_to_locaname vs gssapi svc/host.domain.org@REALM

On Wed, Oct 12, 2011 at 09:44:57AM +0200, [email protected] wrote:
> There are two mapping daemons involved, at the server (local uids <-> strings)
> and at the client (strings <-> local uids) according to passwd.

Note that for authorization purposes NFSv4 server maps the principal names
(which are the authenticated identities) to local account names without
any extra modification. Then this string is mapped to the server-local
numerical uid and its access rights are applied.

I am not aware of a way (or the developers' intentions) to be able to
specify any extra mappings, like "root/*" to "root". If there is any
code which suggests otherwise it is most probably a mistake - this
would have long reaching security implications.

A more general principal-mapping layer might be useful in NFSv4 but I
am unaware of its existence. In any case such mapping does not belong
to Kerberos nor to Kerberos naming standards as it would be a matter of
site-local policies.

Rune