Re: [kitten] [nfsv4] draft-ietf-nfsv4-rpcsec-gssv3: request for review

[Nico Williams <[e-mail]>]

On Mon, Aug 04, 2014 at 06:59:27PM +0000, Adamson, Andy wrote:
> On Aug 4, 2014, at 2:45 PM, Nico Williams <[e-mail]> wrote:
> > - v3 (all versions so far) permits the use of any RPCSEC_GSS context
> >   handle, whether a v1, v2, or v3 handle.
> 
> No, multiple handle versions were left behind once we made v3 a proper
> superset of v2 (and v1). Only v3 handles allowed in v3.

My idea was that existing code to setup v1 contexts could be left as-is
and augmented with code that uses v1 contexts to setup v3 contexts when
compound authentication and/or assertions are required.

This would help interop: the client sets up v1 contexts, and if it can't
setup v3 contexts, then it either gives up (e.g., if it needs protection
for the shared-cache case, or if it has critical assertions to make) or
continues and hopes for the best (if it has non-critical assertions to
make).

Nico
--