Re: multimple domain authentication

eric is quite right that the current plan 9 scheme often `just works' in practice,
because of factotum, secstore and authdom (and the 9p approach to distribution of everything).
`seamlessly', that's the buzz word, isn't it?
i have attended some dismal Grid/eScience meetings here where people are STILL
unable to do what i do quite casually with a simple Plan 9 pipe line.  it wasn't until after one
meeting that i realised that i casually run pipelines with pipeline elements running
in different authentication domains transparently but securely, including one
element that was running on Linux (p9 ghostscript is troublesome), and i've been doing
it for years without marvelling at it.  as have we all here, of course.

i've started to use a variant of SPKI in Inferno to address some of the
things mentioned.  the SPKI component does not replace the original, but
augments it.  the model seemed just right to me for my purposes.  i think it's right to distinguish
between who you are and what you can do.  of course, the former crops up in several ways
(eg, who owns those files?) but i decided to focus on the latter, because i thought i understood it.
i was happy to find that doing so seems to point to some natural solutions for the former,
at least in the context of my work.  a form of `group membership' is straightforward with the
right S-expressions (hello, ron!) and the infrastructure needn't be so daunting
that you throw up ... your hands, and give control of your security to the likes of Verisad.

there is a little twist that occurred to me in the 9p/styx application,
but i'm still implementing it and writing it up.
arguably not much that Taos didn't do years ago.

it's infuriating that (for instance at another escience meeting yesterday) i still hear
people say that `public key systems are complicated', and i see
yet another `bridge CA' talk on the menu.  x.509 has much to answer for.
now we've got WS-* and w3c in on the act.  anyway, to those that care to listen, i
explain spki, and show them a few s-expressions.
(ok, it could as well be XML but i've got a life and resource-constrained computers
and SPKI like Taos uses s-expression.)  ``cool.  but? ... but ... but it's easy!''

another overheard remark: ``we've got to keep the keys out of the hands of the users!''.
of course, it depends just what was meant by that ... factotum and secstore would qualify
but that's not what was meant, and it struck me as amusing.
suppose they were talking about houses or cars!