Re: aname_to_locaname vs gssapi svc/host.domain.org@REALM

On 10/22/2011 3:56 PM, [email protected] wrote:
> On Sat, Oct 22, 2011 at 11:28:56AM -0500, Harry Coin wrote:
>>> Do your NFS servers behave differently and call aname_to_lname()?
>> Yes.  Through a long chain winding in and out of the kernel eventually
>> calling a userland daemon gssd.
> It's funny if it is gssd which calls the mapping function
> because the mapping belongs in nfsuserd, not in gssd.
> IOW if it is gssd which does it, it is a bug. Oh well.
>
>> If you take the time to focus on how and when the procedure with I bug I
>> fixed gets called, you will comprehend.
>> http://www.freebsd.org/cgi/query-pr.cgi?pr=161854
>>
>> and
>> http://svnweb.freebsd.org/base/head/kerberos5/lib/libgssapi_krb5/pname_to_uid.c?revision=181344&view=markup
> Yes I see. Using krb5_aname_to_localname() is a pity and in my eyes an
> oversight in the NFS implementation. Anyway, thanks for explaining the
> cause of your problem.
>
> [This could be better fixed in the first hand by not using
> krb5_aname_to_localname() and then applying configurable explicit rules
> as desired for NFS instead. Note that the desired mapping for different

More on the rest of your post later, but this use is a client of nfs.  
The process making the call is much more central than that-- rpc.