Re: [nfsv4] Path forward for flex-files

[Rick Macklem <[e-mail]>]

Benjamin Kaduk wrote:
[stuff snipped]
> The solution space looks rather different whether the synthetic principals
> are actually being created/deleted on the KDC or synthesized using the
> data server's keytab.
I'm not sure what you are thinking of w.r.t. synthesized using the data server's keytab,
but I am curious?

>  In the case where the KDC is involved, ticket
> lifetimes and principal existence are somewhat annoying to manage -- in
> order to have a long-lived TGT but get short-lived service tickets, with
> (e.g.) an MIT krb5 KDC you'd either have to use a custom policy plugin to limit
> the service ticket lifetime, or set the max lifetime on the data server's
> service principal to that short lifetime (which has annoying effects for
> anything that's supposed to be connecting to it directly).  As far as principal
> management, the fencing would not be particularly instantaneous -- the
> current ticket would have to expire, and the principal deletion/deactivation
> would need to propagate to all KDCs in the realm.  IIRC it's also possible
> to have a KDC that doesn't even pull up the client principal's database
> entry when generating a service ticket from a TGT (i.e., it would not
> actually notice the deleted client principal!), which of course would not
> work for this use case.
Oh well, doesn't sound like a good plan.

And I'm happy with a second version of XDR when this is done.

rick, who is glad he chose "tightly coupled";-)