Re: aname_to_locaname vs gssapi svc/host.domain.org@REALM

I'd like to thank you Nico for identifying the core issue.

On Tue, Oct 25, 2011 at 09:32:07PM -0500, Nico Williams wrote:
> But you have to understand that the NFS server feature that you want
> (share-level ACLs based on client principal names) is non-existent.
> Nothing in libkrb5 can make it come into existence.

Nice that Kerberos does not have to be adjusted to comply with
the oddities of NFS design.

> The next simplest is to use "host-based usernames".  MIT krb5 makes it
> easy to map these to whatever server-side usernames you want, but
> since that means having either distinct usernames on the server for
> each host instance of the same client-side username, that gets
> complicated pretty quickly.

It is not more complicated than the access control granularity which
you need.

<offtopic = NFS>
Do not assign distinct user names after the hosts they are
running on but rather after the access rights they are supposed
to have. I.e. not account_f_q_d_n but account_hostclass which means
actually account_accessclass  (avoiding '/' makes it actually
implementable despite all weird hardcoded assumptions about account
names in different places).

The number of accounts=principals to maintain can become
O(<suchaccounts>x<hosts>) but only in an extreme case. It is always
O(<suchaccounts>x<accessclasses>) which probably is much less.

So it does not have to be complicated and does not need any
extra support from the OSs, NFS or Kerberos.

Such an access control is more general than the suggested (hypothetical)
file labels per client host which you mention later (this allows e.g. to
move two accounts' instances together to the same host but still keep
their access rights separated).

That said, a deeper redesign would certainly give Harry an even simpler
and more maintainable system than keeping those host-related acls which
were conditioned by the old NFS3. Getting rid of NFS-conditioned
assumptions is not easy - hard in the existing setups, even harder
in the minds of people (not meaning anyone here).
:(
</offtopic>

Regards,
Rune