Re: multimple domain authentication

auth and fs integration seems to be the major pain, afaik everybody uses mapping
id's and storing tables with the relations between users/ids, auth servers uses
user/pass and the fs uses ids, i suppose the layer you mean is the translation
between those ?

or you mean to skip ids and use directly user@domain as id?

using ldap and unix, auth system translates between unix id and user/name, and
all the auth stuff needs to support ldap

using M$ w2k and nt the same, but the id's are less human-readable

thats means that fs is writting files with unknown users id's, can fossil/venti
do that? i think is better not to do that

an user connects, from other domain user@server, supposing we are capable of
check their credentials via an auth-auth protocol or via an authfs union
directory with all trusted servers authfs in there, the only thing needed is
that fossil/venti write with "temporary" user id's only avaiable when the user
is authenticated

all of those sounds very bad,now i see why is so problematic :), at the moment
there are two user database one for authfs and one for fossil/venti?, two
commands auth/changeuser and fossil uname command isn't it?, i think the way is
merging those, making fossil/auth comunication for each write/access may be is
to expensive, and caching that may be insecure, time to move auth to fossil?


gabi.

Quoting "boyd, rounin" <boyd-Ic1ggjWUKI8eIZ0/[email protected]>:

> > A: use their own auth server
>
> well, chuck fossil away.  replace it with a f/s layer
> that writes owner@domain to venti.  get the auth servers
> to auth each other and then auth with the remote servers.
>
> doable?
>
> sounds like a 9P change might be needed.
>
> _______________________________________________
> 9grid mailing list
> 9grid-bRIBFEq44iy2p8tyqo/[email protected]
> http://nwn.definitive.org/mailman/listinfo/9grid
>