Re: multimple domain authentication

You hand a token to the server that is to provide you a resource.
This token depends on a shared key between the server and the
authserver.

So, server b.grid wants to see a token signed by authdom
grid.  That would still work if authdom grid had a shared
key with authdom ucalgary and user mirthov presents a token
from ucalgary.  Then authdom grid can create a token for
user mirtchov@ucalgary signed by authdom grid.

The file server still needs to change to register new users on the
fly, if indeed is a good implementation, but in principle it seems
possible that files are "owned" by an arbitrary user string.  I would
be inclined to put user mirtchov@ucalgary in group ucalgary.  If you
need more control on groups than that, get a local account.  It might
be worth trying this first with ramfs, where there is no issue of
compatibility with bits on disk and no question of permanent use of
resources.

As with SPKI, the authentication would be transitive so you might well
see rminnich@lanl@ucalgary on b.grid.   He'd be in group ucalgary,
and wouldn't have access to the same files as rminnich@lanl.

I don't think this is quite right yet.  It feels like there should
be a single identity which can be testified to by multiple keys
and multiple authentication servers.  My global name assigned by
the FCC is N2VI, unique across the world.  Sure would be nice if
I could use that as a handle everywhere.   But even that is a bit
messy, because the FCC used to call me KC2KHM.