Re: [nfsv4] New version of NFSv4 multi-domain access draft (

I will schedule time during the FedFS call on 10/28 for Andy to 
present this draft and give folks who have read it a chance to ask him 
questions in real time.

-james

On Thu, 30 Sep 2010, William A. (Andy) Adamson wrote:

> Hello
> 
> I uploaded a new version of our internet draft "NFSv4 Multi-Domain Access"
> 
> http://www.ietf.org/id/draft-adamson-nfsv4-multi-domain-access-03.txt
> 
> Please have a look and give us any feedback.
> 
> There are a number of sections that need text. Here are some issues
> that need discussion.
> 
> 1)  NFSv4 is not the only potential consumer. NFSv3, and SFTP, for
> example. Do we mention these and/or other potential consumers.
> 
> 2) Section 5.4.3.  Resolving Domain Names to Domain IDs
> 
> We need to have a common way to map Domain Names to Domain IDs.
> Currently we have two suggestions
> - Just use SIDs, first asking MSFT to allocate a suitable authority
> for non-Windows domain SIDs.
> - Store 96-bit numeric IDs
>      a) cast those to domain SIDs later.
>      b) define a non-SID large ID format
> 
> 3) Section 6.1.2.  RPCSEC_GSS Authorization Context Credential Data
> 
> Do we want to define a new "PAC" for multi-domain access for those
> implementations that don't provide the Windows PAC, or just insist
> upon the use of the Microsoft PAC.
> 
> 4) General review of section 6.3.  User Group Membership Determination
> - Do we depend upon 2307bis
> - Do we require groups within groups
> 
> 5) Do we need a section on service discovery.  Two potential methods:
> - Use local methods (configuration, DNS SRV RR lookups, ...) to
>   discover local domain's servers, then depend on LDAP referrals for
>   discovering all other domains' s
> - Use DNS SRV RRs much the way AD does.ervers.
> 
> 
> -->Andy
> _______________________________________________
> nfsv4 mailing list
> nfsv4@ietf.org
> https://www.ietf.org/mailman/listinfo/nfsv4
> 