Subject: RE: [nfsv4] Name Mappings for NFSv4 in Active Directory

From: "Wachdorf, Daniel R" <[email-masked]>
Date: Wed, 8 Oct 2003 16:03:40 -0600

I have seen that.  Is document describes a way of providing that same
functionality (minus the communication piece) by placing this in active
directory.
This would allow:
	-foreign security principals to have group information associated
with them.  You could add a foreign security principal into a local
active directory group.
	-provides long term storage for a mapping of UID/GID to nfsv4 names.
This is useful if file systems are replicated, or written to long-term
backup mechanisms.
	-on the fly creation of UIDS/GIDS. (they would have be synchronized
with the directory service).

-dan
-----Original Message-----
From: Nicolas Williams [mailto:[email-masked]] 
Sent: Wednesday, October 08, 2003 3:50 PM
To: Wachdorf, Daniel R
Cc: [email-masked]
Subject: Re: [nfsv4] Name Mappings for NFSv4 in Active Directory

Please see:

http://www.ietf.org/internet-drafts/draft-williams-nfsv4-ace-mapping-01.txt

This draft describes:

 - how to map user|group@domain names from multiple domains to UIDs/GIDs
   in one domain

    - including how to deal with foreign domain name reuse

 - how to do this on demand (as opposed to having to have meta-directory
   style synchronization)

 - how to make such mappings consistent to any of: a single host, a
   cluster of hosts, an entire domain

 - a new Kerberos V authorization data type that lists a principal's
   NFSv4-style user@domain and group@domain name lists

Cheers,

Nico

On Wed, Oct 08, 2003 at 03:34:57PM -0600, Wachdorf, Daniel R wrote:
> I have been working with CITI on finding a way to use Active Directory to
> use map NFSv4 names into active directory user accounts.
> I wrote a document that describes a scheme to map NFSv4 names and
> authentication principals into an Active Directory Domain.  
> I would be interested in what the members of the list thought.  Thanks.
> 
> -dan
> 
> --------------------------------------
> Daniel Wachdorf
> [email-masked]
> Sandia National Laboratories
> System Security Research and Integration
> 505-284-8060
> 
> 
> 
> 

_______________________________________________
nfsv4 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nfsv4

---

From: Nicolas Williams <[email-masked]>
Date: Wed, 8 Oct 2003 15:08:49 -0700

> with them.  You could add a foreign security principal into a local

My draft does not address this one feature, but that's because the issue
is somewhat orthogonal to the mapping strategy itself - once you've
mapped foreign users you can make them members of groups in your domain
(yes, there be other details).

> with the directory service).

Sounds good to me so far.

Of course, I'm interested in a solution that is not specific to
ActiveDirectory.

Besides that I'm curious as to how you address foreign domain user and
group name changes.  I solve the problem by making the permanent index
to foreign mappings be the tuple

{internal ID at foreign domain, foreign domain}

while counting on internal IDs not being reused without fair warning.

As an optimization my draft also allows for caching

user/group@domain <-> {foreign internal ID, foreign domain}

mappings for as long as a given name's foreign domain guarantees that a
name won't be reused.  I.e., if "[email-masked]" is renamed
"[email-masked]" then the old name ("[email-masked]") won't be
re-used for X amount of time, which time is the max for which we can
cache the "[email-masked]" mapping.

Nico
--

---

From: "William A.(Andy) Adamson" <[email-masked]>
Date: Thu, 09 Oct 2003 10:10:27 -0400

hi nico 

kevin coffman and i like dan's active directory solution, and are 
investigating eduperson and nis group schema (with a possible extension) to 
provide the same functionality for non-AD ldap directories.

BTW: will you be available at the bakeathon to discuss these ideas in more 
detail? kevin and i will be there monday - friday (leaving noon).

-->Andy

---

From: Nicolas Williams <[email-masked]>
Date: Thu, 9 Oct 2003 07:17:46 -0700

> detail? kevin and i will be there monday - friday (leaving noon).

Yes.

Nico
--