Re: [nfsv4] Name Mappings for NFSv4 in Active Directory

On Wed, Oct 08, 2003 at 04:03:40PM -0600, Wachdorf, Daniel R wrote:
> I have seen that.  Is document describes a way of providing that same
> functionality (minus the communication piece) by placing this in active
> directory.
> This would allow:
> 	-foreign security principals to have group information associated
> with them.  You could add a foreign security principal into a local
> active directory group.

My draft does not address this one feature, but that's because the issue
is somewhat orthogonal to the mapping strategy itself - once you've
mapped foreign users you can make them members of groups in your domain
(yes, there be other details).

> 	-provides long term storage for a mapping of UID/GID to nfsv4 names.
> This is useful if file systems are replicated, or written to long-term
> backup mechanisms.
> 	-on the fly creation of UIDS/GIDS. (they would have be synchronized
> with the directory service).

Sounds good to me so far.

Of course, I'm interested in a solution that is not specific to
ActiveDirectory.

Besides that I'm curious as to how you address foreign domain user and
group name changes.  I solve the problem by making the permanent index
to foreign mappings be the tuple

{internal ID at foreign domain, foreign domain}

while counting on internal IDs not being reused without fair warning.

As an optimization my draft also allows for caching

user/group@domain <-> {foreign internal ID, foreign domain}

mappings for as long as a given name's foreign domain guarantees that a
name won't be reused.  I.e., if "jane@foobar.com" is renamed
"jane.doe@foobar.com" then the old name ("jane@foobar.com") won't be
re-used for X amount of time, which time is the max for which we can
cache the "jane@foobar.com" mapping.

Nico
-- 

_______________________________________________
nfsv4 mailing list
nfsv4@ietf.org
https://www1.ietf.org/mailman/listinfo/nfsv4