Re: [kitten] [nfsv4] draft-ietf-nfsv4-rpcsec-gssv3: request for review

[Nico Williams <[e-mail]>]

On Mon, Aug 04, 2014 at 03:46:09PM -0400, Benjamin Kaduk wrote:
> On Mon, 4 Aug 2014, Nico Williams wrote:
> >The critical bit is already factored out.  We should do the same for
> >the text.
> 
> Okay.  "Are you volunteering?"

I'd like to leave it to Andy for now.

> >The point is that clients can be expected to have credentials
> >suitable for this purpose.  I think this is quite clearly true.
> 
> I would like to live in a world where that is true.  I don't think
> we're quite in the state where we can say that this is "quite clearly"
> true yet, though.  (Consider people doing cloud deployments;
> provisioning a new image with its own credentials is a hassle unless
> you add your own tooling on top of stock kadmin.) Anyway, I don't
> think this is a worthwhile topic for us to discuss here, and it
> doesn't seem very relevant to the actual text of the document in
> question.

It really is true.  Provisioning is no more or less painful now than it
ever was, but since: a) truly multi-user systems generally need
server-like provisioning anyways (otherwise they couldn't authenticate
users with Kerberos!), b) anon PKINIT is available at rather low cost,
my statement is effectively true: it can be made true at low cost
anywhere that it already isn't.

Nico
--