Subject: [nfsv4] more on gss authentication for callback

From: [email-masked]
Date: Thu, 30 Oct 2003 16:58:11 -0500 (EST)

First, thanks a lot for the good info. I now have some idea of what to do.
One case I am curious about:
- The client authenticates to the server for SetClientID with
	target: nfs@<serverhost.domain>
	initiator: root (or root@REALM in Kerberos jargon)
then, can the server authenticate the callback with
	target: root
	initiator: nfs@<serverhost.domain>	??
Can the client do a gss_accept_sec_context() with "root@REALM" credentials
without any keytab and get the principal nfs@<serverhost.domain>?

If the above would work, that would avoid the client having to have a
keytab file.

Anyone know if this will work, or see problems with it? rick

_______________________________________________
nfsv4 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nfsv4

---

From: Nicolas Williams <[email-masked]>
Date: Thu, 30 Oct 2003 14:16:17 -0800

> 	initiator: root (or root@REALM in Kerberos jargon)
                   ^^^^
		   root@<clienthost.domain>
> then, can the server authenticate the callback with
                ^^^^
		root@<clienthost.domain>
> 	initiator: nfs@<serverhost.domain>	??

The client has to have an acceptor credential[1] for root@<clienthost.domain>.

[1]  In Solaris SEAM, MIT krb5 and Heimdal parlance this means having a
     keytab entry for root@<clienthost.domain>.

Will it work?  For the Kerberos V GSS-API mechanis, yes.  For LIPKEY, no.

Do make sure that the server uses as the target name the initiator name
that did the SETCLIENTID - i.e., do NOT hardcode "root@..."

Cheers,

Nico
--