Re: nfs client 'nobody no matter what' clarification was Re: k5userok .c / doc mismatch

On Fri, Oct 14, 2011 at 4:12 PM, Harry Coin <[email protected]> wrote:
> On 10/14/2011 4:03 PM, Nico Williams wrote:
>> Out of the box, however, Heimdal should not do that ever, not today,
>> not ever.  Indeed, out of the box Heimdal implements *two* aname2lname
>> conventions:
>
> Clarifying this answer:   discuss your view of the kuserok side of this.
> Shall it forever
> be impossible to match principals to local users if those local users have
> no default or
> home directory, for example /nonexistent, if the principal name is of the
> form with a
> / for examle as specified by GSSAPI->sasl->ldap for service accounts?

No, not forever, but "forever in the default configuration".  I see no
reason why a rules- and/or db-based aname2lname system could not be
devised -- indeed, I intend to implement such a thing at some point,
for Heimdal (MIT already has one).

>> But again, I don't want to say *never*, just never without additional
>> configuration.
>
> Kindly direct to the appropriate configuration capability.   My reading of
> the code in kuserok
>  and aname_to_lname appears to allow no such capability.

*Today* it doesn't.

Nico
--