Re: aname_to_locaname vs gssapi svc/host.domain.org@REALM

On Tue, Oct 25, 2011 at 3:19 PM, Nico Williams <[email protected]> wrote:
> There is a new RPCSEC_GSS (v3) in progress that does address this and
> therefore will allow for NFS server implementations that provide
> share-level ACLs based on client credentials.  Given this, it'd be
> possible to implement per-share user/group namespaces.

Er, a *fiction* of multiple namespaces anyways.

And the notion of multiple namespaces that you get with non-Keberized
NFS is a fiction.  It's not even intended to be so, but you
constructed it from existing features.

You realize that the multiple namespaces are ficticious when you use
ls -l on the server and see either the files are all owned by the same
UID when they're supposed to belong to different "instances" of that
user, or else you see different usernames for each instance of a
common username.

You need to understand what names and identities mean.  A complete
treatment of that topic would take a lot of time to write just for
you.  Enormous amounts of time have been put into this topic (and
associated code) by yours truly and other participants here, as well
as many others who are not participating in this thread.  For proof
you can see my old blogs at Sun (now Oracle) about IDentity mapping
and ZFS/Windows interoperability, as well as the Sun (now Oracle)
storage appliances.

Hopefully this is the last that I'll have to write in this thread
about what you want.  Hopefully you'll accept that what you're trying
to do is not "natural" for a FreeBSD NFS server, that what you want
requires new functionality in the NFS server, that libkrb5 cannot, on
its own, provide all that functionality.

Nico
--