Subject: Re: [nfsv4] pNFS, OPEN principals and ACLs

From: Carl Burnett <[email-masked]>
Date: Tue, 30 Aug 2005 11:53:01 -0500

Yes, I meant cant'. Thanks for the correction
Mike.

Carl Burnett

AIX Kernel Architecture - Network File System

(512) 838-8498, TL 678-8498

(please reply to [email-masked])

Mike Eisler <[email-masked]>

08/29/2005 06:46 PM

Please respond to

email2mre-ietf

To

Carl Burnett/Austin/IBM@IBMUS

cc

Subject

Re: [nfsv4] pNFS, OPEN principals
and ACLs

Carl,

Did you mean to say "can't assume this equivalance"?

--- Carl Burnett <[email-masked]> wrote:

---------------------------------

RFC3530  makes no requirements on the client about a one to one relationship
between credentials

and openstate ids, so a server can assume this equivalence.  Also,
with delegation,the server

would have to some how know of every credential that is validfor access
under the delegation

stateid - something that does not soundvery possible since I don't think
there is anything in the

protocol thatallows the server to associate a cred in an ACCESS OP to a
delegation stateid. That

would be the ACCESS call required by the client for each "local"open
by a new user (cred) under a

granted delegation.

Carl

Carl Burnett

AIX Kernel Architecture - Network File System

(512) 838-8498, TL 678-8498

(please reply to [email-masked])

"J. Bruce Fields"<[email-masked]>

Sent by: [email-masked]

08/29/2005 03:59 PMTo

[email-masked]

[email-masked]

Re: [nfsv4] pNFS, OPEN principalsand ACLs

On Mon, Aug 29, 2005 at 04:20:30PM -0400, [email-masked]:

> Ok, so the client should use the same principal credentials as wasused

> for the Open that returned the stateid in the I/O Op.

> I can think of a couple of things:

> 1 - At one point, byte range Lock Op stateids were in the list foruse

>     in I/O Ops. I assume this would no longer be recommendedpractice?

Why not?

> 2 - I would assume that the Delegation stateid returned by the Openwould

>     be fine. Suppose the client no longer has the principalcredentials

>     for the principal that did the Open? Since a Delegationcan
persist

>     on a client indefinitely, the principal that did theOpen
could have

>     long since logged out, gone on vacation, etc.

This could also happen when the client doesn't have any other principal

with access to the file to fall back on.

I think the best the client can do is try to return the delegation

before losing the credential.

--b.

_______________________________________________

nfsv4 mailing list

[email-masked]

https://www1.ietf.org/mailman/listinfo/nfsv4

> _______________________________________________

> nfsv4 mailing list

> [email-masked]

> https://www1.ietf.org/mailman/listinfo/nfsv4

_______________________________________________
nfsv4 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nfsv4

---

From: "J. Bruce Fields" <[email-masked]>
Date: Tue, 30 Aug 2005 13:00:36 -0400

On Tue, Aug 30, 2005 at 11:53:01AM -0500, Carl Burnett wrote:
> 
> <br><font size=2 face="sans-serif">Yes, I meant cant'. Thanks for the correction
> Mike.</font>

Could you turn off the html email formatting?

--b.