Subject: RE: [nfsv4] New I-D: draft-falkner-nfsv4-acls-00

From: "Everhart, Craig" <[email-masked]>
Date: Thu, 3 Nov 2005 11:52:59 -0500

I think the IDENTIFIER_GROUP flag is important on Unix.

How hard is it for Windows to tell whether a given SID
applies to a group or a principal?

		Craig 

> -----Original Message-----
> From: Gordon Waidhofer [mailto:[email-masked]] 
> Sent: Wednesday, November 02, 2005 6:55 PM
> To: Nicolas Williams; Lisa Week
> Cc: [email-masked]
> Subject: RE: [nfsv4] New I-D: draft-falkner-nfsv4-acls-00
> 
> > > >
> > > >The IDENTIFIER_GROUP flag may be problematic for some platforms, 
> > > >like NT. What does [email-masked] with IDENTIFER_GROUP==0 
> mean? NT 
> > > >doesn't allow both a user 'staff' and a group 'staff'.
> > > >The NT SIDs (Security Identifiers) are always unique. A 
> lookup of 
> > > >the SID will tell if its group/user/alias/etc.
> > >
> > > An ACE with a who of "[email-masked]" and with 
> IDENTIFIER_GROUP == 0 
> > > means the ACE applies to *user*, "[email-masked]".
> > >
> > > This should be taken into account when doing access 
> checks as well 
> > > as when determining whether or not to allow the setting of an ACL.
> > >
> > > For instance, if a client is trying to do a SETATTR of 
> ACL against a 
> > > server (regardless of the platform) and the ACL contains 
> an ACE with 
> > > who="[email-masked]" and the ACE4_IDENTIFIER_GROUP flag is 
> not set, 
> > > then the server should check to see if there is a *user* named 
> > > "[email-masked]".  If  a *user* named "[email-masked]" 
> exists, set the 
> > > ACL.  If a *user* named "[email-masked]", doesn't exist, return 
> > > NFS4ERR_BADOWNER to the client.
> > >
> > > Thoughts?
> >
> > Windows has a unified user/group namespace.  I think this 
> means that 
> > Windows NFSv4 servers can just ignore IDENTIFIER_GROUP when the ACE 
> > subject domain is a Windows domain, both, on SETATTR and GETATTR.
> >
> 
> I expect IDENTIFIER_GROUP will ultimately prove unworkable.
> 
> It is a bandaid for UNIX-type platforms so they know whether 
> to use getpwnam() or getgrnam(). Unified accounts (one 
> namespace) is likely the future.
> 
> Consider interoperability with a Windows system. There is a 
> group "staff".
> UNIX folks want the IDENTIFIER_GROUP!=0 so they can tell. But 
> Windows can't do that. There can not simultaneously be a user 
> "staff" and a group "staff". Interoperability between the 
> UNIX and Windows systems is precluded in sites that try to 
> have both regardless of what edicts exist in the NFSv4 
> protocol. There is absolutely no way to trick NT into "staff" 
> meaning two things.
> 
> So then the question is how important is the IDENTIFIER_GROUP 
> bit in UNIX environments? How much name collision between 
> users and groups exists? It is not as far fetched a 
> constraint as one might first think to say UNIX systems can 
> not collide user/group names because they have to face that 
> anway due to NT.
> 
> Regards,
> 	-gww
> 
> 
> 
> _______________________________________________
> nfsv4 mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/nfsv4
> 

_______________________________________________
nfsv4 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nfsv4

---

From: Nicolas Williams <[email-masked]>
Date: Thu, 3 Nov 2005 11:14:55 -0600

> applies to a group or a principal?

It must lookup the SID in the directory.

But it already has to do SID<->name lookups in order to use name@domain
on the wire in NFSv4.

Nico
--

---

From: Lisa Week <[email-masked]>
Date: Thu, 03 Nov 2005 10:14:52 -0700

> applies to a group or a principal?

Looks like a SID contains the appropriate information to make the 
determination.

Source: 
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/secauthz/security/trustee.asp

The security identifier (SID)
---------------------
     (SID) A data structure of variable length that identifies user, 
group, and computer accounts. Every account on a network is issued a 
unique SID when the account is first created. Internal processes in 
Windows refer to an account's SID rather than the account's user or 
group name.

Trustees

A trustee is the user account, group account, or logon session to which 
an access control entry (ACE) applies. Each ACE in an access control 
list (ACL) has one security identifier (SID) that identifies a trustee.

The TRUSTEE structure
-------------------
The TRUSTEE structure has an element (TRUSTEE_TYPE TrusteeType).
TrusteeType is:    A value from the TRUSTEE_TYPE enumeration type that 
indicates whether the trustee is a user account, a group account, or an 
unknown account type.

---

From: Nicolas Williams <[email-masked]>
Date: Thu, 3 Nov 2005 11:28:59 -0600

> http://msdn.microsoft.com/library/default.asp?url=/library/en-us/secauthz/security/trustee.asp

Ah, excellent.  Of course, SIDs themselves have no user vs. group type
tag.