Subject: [nfsv4] draft-ietf-nfsv4-minorversion1-16 LAYOUTRETURN question

From: "William A. (Andy) Adamson" <[email-masked]>
Date: Wed, 14 Nov 2007 12:21:00 -0500

Sorry if I missed the discussion on this point.

The last paragraph of section 18.44.3 (LAYOUTRETURN)
draft-ietf-nfsv4-minorversion1-16.txt:

  The server MAY require that the principal, security flavor, and
   applicable, the GSS mechanism, combination that acquired the layout
   also be the one to issue LAYOUTRETURN. his might not be possible if
   credentials for the principal are no longer available.  The server
   MAY allow the machine credential or SSV credential (see
   Section 18.35) to issue DELEGRETURN.

Why is it allowed for a client-wide layout to be attached to a user?
This paragraph suggests that the layout is somehow attached to user
credentials. The layout, and therefore the layoutreturn, is of client
scope and so any user credentials should be acceptable to any pnfs
server.

Also. Why is it that the pNFS server is not required to allow machine
credentials?!?!?

-->Andy

_______________________________________________
nfsv4 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nfsv4

---

From: Mike Eisler <[email-masked]>
Date: Thu, 15 Nov 2007 05:35:07 -0800 (PST)

> scope and so any user credentials should be acceptable to any pnfs

It is attached to whoever obtained the layout via LAYOUTGET.

If the layout is client wide, then use a client wide credential to
get the layout, so that cred can return the layout.

> Also. Why is it that the pNFS server is not required to allow machine

The client and server negotiate this when EXCHANGE_ID is called. It
is worth a read.

This all goes back to an email Rick Macklem sent about how does a
client recover when it used Kerberos creds for a normal user to OPEN
a file, and now wants to CLOSE and has no Kerberos creds for the
user to issue the CLOSE with.

The client can use a machine cred or SSV cred to issue CLOSE with.

---

From: "Noveck, Dave" <[email-masked]>
Date: Thu, 15 Nov 2007 09:39:47 -0500

If you want to run your server so "nobody" can return layouts
that were gotten on your behalf, then the protocol allows you 
to.  But some people might want to restrict that and the
protocol allows them to do that. 

-----Original Message-----
From: William A. (Andy) Adamson [mailto:[email-masked]] 
Sent: Wednesday, November 14, 2007 12:21 PM
To: NFSv4
Subject: [nfsv4] draft-ietf-nfsv4-minorversion1-16 LAYOUTRETURN question

-->Andy