Re: [nfsv4] Path forward for flex-files

[Benjamin Kaduk <[e-mail]>]

On Mon, Aug 07, 2017 at 07:19:10PM +0000, Rick Macklem wrote:
> Olga Kornievskaia wrote:
> 
> > dot-x defs: https://www.rfc-editor.org/rfc/rfc7531.txt
> >
> >   typedef utf8str_mixed   fattr4_owner;
> >   typedef utf8str_mixed   fattr4_owner_group;
> Oh well. I've never looked at that RFC.
> The draft could just be changed to define the ffds_user and ffds_group as opaque<>
> instead of utf8str_mixed? (I don't think this would affect extant implementations,
> which will just assume a utf string is in there and can't handle/support Kerberos.)
> [stuff snipped]
> > That's the problem you need something in the structure to pass back
> > the ticket (TGT is not necessary. service ticket would do). Besides
> > the ticket you need to send the other pieces.
> Well, maybe a service ticket would work, but it would require a lot more "hacking"
> on the RPCSEC_GSS code, I think?
> - During initialization, the RPCSEC_GSS l;ayer normally calls
>   gss_init_sec_context(). In the vanilla Heimdal libraries, this works if there
>   are valid credentials in the credential cache and those come from the TGT.
>   (I'll admit my Kerberos is rusty. If you can easily get gss_init_sec_context() to work
>    with a service ticket, then I believe you. Also, I've never worked with the MIT libraries.)

No hacking needed; it works out of the box.

kaduk@prolepsis:~$ kinit -l5m -r5m -S host/rosebud2.mit.edu kaduk/root
Password for kaduk/[e-mail]: 
SAM Authentication
Challenge from authentication server
Duo login: Passcode/option or press return for options: 
kaduk@prolepsis:~$ ssh -o GSSAPIAuthentication=yes -o GSSAPIDelegateCredentials=no [e-mail]
Linux rosebud2 3.2.0-4-amd64 #1 SMP Debian 3.2.81-1 x86_64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Sun Aug  6 08:57:20 2017 from vpn-18-101-71-85.mit.edu
root@rosebud2:~# 


-Ben