Re: multimple domain authentication

I've always like the user@authdom idea and felt I could live with
that fictitious user being in group ucalgary.  It takes some work on the
fileserver and authserver code, but doesn't seem infeasible.   We wouldn't
base anything on IP address, just let the user say what authdomain
he is coming from and, if that is listed as trusted in /lib/ndb/auth then
contact that authserver.

One thing we considered doing on our 9grid machines was creating a user
ucalgary and having the bootes factotum at ucalgary hold the credentials
and allow local users there to connect to us as that user.

Everybody coming in that way has to mutually trust each other not to
clobber each others files, of course.   And bad behavior by one such
user reflects badly on everyone there.  But at least you can do it with
the existing software and it might be enough for limited grid computing.



[email protected] wrote:

> If one permits access by grid users to the local file servers, there's
> still a mismatch between the notion of user as defined by /adm/users
> and general access being granted by suitable authentication.  The file
> servers need some way to sort out access rights.
> 
> Without going the full Globus route, one could define one user in
> /adm/users per class of grid user, thus some user like `anygrid' might
> be granted (via normal permissions) ordinary `other' access and belong
> to no other groups.  `anylanl' might belong to a group with write
> access to some files.  So part of authentication would be mapping
> incoming users to file server users and thus access rights.
> 
> Or maybe the file servers could treat user@authdom specially and
> authenticate such users via the appropriate auth server upon attach.
> Ken's fs at least is likely to run out of unique integer uids (which
> it does use internally, and stores in [signed] shorts currently) after
> a while; how do you know when a grid user is gone forever?  I'm not
> sure if fossil user names eventually resolve to an integer or not.
> 
> _______________________________________________
> 9grid mailing list
> 9grid-bRIBFEq44iy2p8tyqo/[email protected]
> http://nwn.definitive.org/mailman/listinfo/9grid