Re: aname_to_locaname vs gssapi svc/host.domain.org@REALM

On Wed, Oct 12, 2011 at 12:36 PM,  <[email protected]> wrote:
> On Wed, Oct 12, 2011 at 11:51:39AM -0500, Harry Coin wrote:
>> Here and now, objectively,  heimdal has a function, documented and not
>> deprecated, that converts principal names to local names, that a 'grep
>> -r' at the top of your favorite OS source tree shows is used by nfs at
>> the least.
>
> Ouch.

Hyperbole isn't helping.  Harry's problem does not stem from this.  It
probably is a bug in the NFS server.

>> So, which direction is it going to be, discussed to date we have:
>>
>> A1) Some have called this function's existence a bug
>
> It looks like that.

I've said it's a bug that it encodes a convention.  The function's
existence is not a bug.  I want to fix the bug by adding a rule-based
facility for mapping principals (including an option to check the
would be target user's .k5login, though not necessarily in their home
directory, and an option for a DB).

If I may be so bold, I suggest providing code.  This thread is getting
a bit overlong.

> You do not have to synchronize the server's idea of uids with the client
> hosts' ideas, so allocate uids freely on the server, do not use that
> database for nss on the clients. Done. That's where nfs4 finally allows
> one to do right (but not with sec=sys).

Guess what: Solaris 11 can do that.  It reconciles everything by
storing SIDs on disk.  (I simplify.)

> The custom of synchronization of unix uids/gids over a campus existed
> only for nfs's sake. There is actually no reason to have it this way
> as soon as you throw out sec=sys.

UIDs and GIDs are local identities.  Sadly they have leaked out of the
local host: via NFSv2, NFSv3, AUTH_SYS, various filesystem backup and
archive formats, NIS, the RFC2307bis+ LDAP schema (the last two are
not a bid deal though -- it's the filesystems and backups that are the
problem), ...  To maintain an independent UID/GID namespace on every
host requires remapping all the time.  It also requires some form of
the "truest identity" (Solaris uses SIDs for this).  Anyways, this is
totally OT.  Start a new thread if this subject is of interest.

Nico
--