Subject: [nfsv4] [PATCH] Go from credentials to user/group

From: Thomas Haynes <[email-masked]>
Date: Mon, 19 Jan 2015 15:45:46 -0800

From: Tom Haynes <[email-masked]>

Not sure why this was not sent out ...

Signed-off-by: Tom Haynes <[email-masked]>
---
 flexfiles_middle_coupling.xml | 16 ++++++++-----
 flexfiles_middle_layout.xml   | 54 ++++++++-----------------------------------
 2 files changed, 20 insertions(+), 50 deletions(-)

diff --git a/flexfiles_middle_coupling.xml b/flexfiles_middle_coupling.xml
index 12fd0c1..89f5244 100644
--- a/flexfiles_middle_coupling.xml
+++ b/flexfiles_middle_coupling.xml
@@ -42,12 +42,16 @@
       With loosely coupled storage devices, the metadata server
       uses synthetic uids and gids for the data file, where the uid
       owner of the data file is allowed read/write access and the
-      gid owner is allowed read only access.  As part of the layout,
-      the client is provided with the rpc credentials to be used
-      (see ffds_auth in  <xref target='ff_layout4' />) to access the
-      data file.  Fencing off clients is achieved by using SETATTR
-      by the server to change the uid and/or gid owners of the data
-      file to implicitly revoke the outstanding rpc credentials.
+      gid owner is allowed read only access.  As part of the layout
+      (see ffds_user and ffds_group in  <xref target='ff_layout4' />),
+      the client is provided with the user and group to be used in
+      the RPC credentials needed to access the data file.  Fencing
+      off clients is achieved by using SETATTR by the server to
+      change the uid and/or gid owners of the data file to implicitly
+      revoke the outstanding rpc credentials.
+    </t>
+
+    <t>
       Note: it is recommended to implement common access control
       methods at the storage device filesystem exports level to
       allow only the metadata server root (super user) access to
diff --git a/flexfiles_middle_layout.xml b/flexfiles_middle_layout.xml
index b7d5b2c..511b6b2 100644
--- a/flexfiles_middle_layout.xml
+++ b/flexfiles_middle_layout.xml
@@ -70,7 +70,8 @@
 ///     uint32_t                ffds_efficiency;
 ///     stateid4                ffds_stateid;
 ///     nfs_fh4                 ffds_fh_vers&lt;&gt;;
-///     opaque_auth             ffds_auth;
+///     fattr4_owner            ffds_user;
+///     fattr4_owner_group      ffds_group;
 /// };
 ///
       </artwork>
@@ -190,52 +191,17 @@
     </t>
 
     <t>
-      For loosely coupled storage devices, ffds_auth provides the
-      RPC credentials to be used by the client to access the data
-      files.  For tightly coupled storage devices, the server SHOULD
-      use the AUTH_NONE flavor and a zero length opaque body to
-      minimize the returned structure length.  I.e., if
-      ffdv_tightly_coupled (see <xref target='ff_device_addr4' />)
-      is set, then the client MUST ignore ffds_auth in this case.
+      For loosely coupled storage devices, ffds_user and ffds_group
+      provide the synthetic user and group to be used in the RPC
+      credentials that the client presents to the storage device
+      to access the data files.  For tightly coupled storage devices,
+      the user and group on the storage device will be the same as
+      on the metadata server.  I.e., if ffdv_tightly_coupled (see
+      <xref target='ff_device_addr4' />) is set, then the client
+      MUST ignore both ffds_user and ffds_group.
     </t>
 
     <t>
-      Note that opaque_auth is defined in Section 8.2 of
-      <xref target='RFC5531' /> and is for reference:
-    </t>
-
-    <t>
-      &lt;CODE BEGINS&gt;
-    </t>
-
-    <figure>
-      <artwork>
-    enum auth_flavor {
-       AUTH_NONE       = 0,
-       AUTH_SYS        = 1,
-       AUTH_SHORT      = 2,
-       AUTH_DH         = 3,
-       RPCSEC_GSS      = 6
-       /* and more to be defined */
-    };
-      </artwork>
-    </figure>
-
-    <figure>
-      <artwork>
-    struct opaque_auth {
-        auth_flavor  flavor;
-        opaque       body&lt;400&gt;;
-    };
-      </artwork>
-    </figure>
-
-    <t>
-      &lt;CODE ENDS&gt;
-    </t>
-
-
-    <t>
       ffds_efficiency describes the metadata server's evaluation
       as to the effectiveness of each mirror. Note that this is per
       layout and not per device as the metric may change due to
-- 
1.9.3