Re: [nfsv4] [FedFS] Meeting Minutes, 12/03/2009

[Nicolas Williams <[e-mail]>]

On Fri, Dec 04, 2009 at 09:33:25AM -0500, James Lentini wrote:
> Yes, this is one of the options we discussed. The arguments to 
> FEDFS_CREATE_JUNCTION would be a natural place to include such a 
> parameter and perhaps the appropriate security context as well.

Yes.

> > > > By far the most likely case in actual federated deployments will be "TLS
> > > > with server certs".  It's just simpler (e.g., no need to talk to
> > > > Kerberos realm administrators).
> > > 
> > > Doesn't Active Directory use SASL with Kerberos? 
> > 
> > That's one way to use it (you have to in order to access non-public data
> > -- object attributes that have ACLs that don't grant read permission to
> > Everyone).
> 
> This would be an argument for supporting SASL with Kerberos.

It'd be fine to have that as a recommended or even required to implement
feature.  But we really need TLS to be required to implement.  The
reason is that use of self-signed certs and even small PKI island
deployments are less heavyweight than Kerberos + cross-realm trust
deployments -- we need a lightweight mechanism, and the lightest one is
TLS with server certs and passing of TAs via the ADMIN protocol.

Nico
--