Subject: [nfsv4] Group membership (and other attribute dereferencing) for federated-fs

From: Leif Johansson <[email-masked]>
Date: Mon, 17 Nov 2008 20:03:54 +0100

Hi,

I'm trying to understand what the direction is for identity management
for federated-fs, specifically how to dereference group membership in 
a federation of fileservers that cross administrative boundaries.

If all federation fs:en share a single identity and group namespace then you 
might be able to get away with looking up group membership in a single 
identity store based on the authenticated user identity, but if you build
federations across administrative boundaries then experience from the web 
identity federation space shows what the only thing that has any chance of 
working is session-oriented claims-based attribute _push_. In other words
I think building federated identity management based on a directory look-up
has little chance of real-world deployment.

Feel free to tell me I haven't read the docs property at this point :-)

	Cheers Leif
_______________________________________________
nfsv4 mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/nfsv4

---

From: "Everhart, Craig" <[email-masked]>
Date: Wed, 19 Nov 2008 00:46:00 -0500

Hi, Leif,

I'm not sure if what you refer to is in the current suite of documents,
except in sweeping generality.  That sweeping generality aims to leave
this problem, along with possibly several other problems, in the
province of the underlying NFSv4 model protocol.

That handwaving done, my guess would be that it's up to the federation
creator to decide what permissions and group memberships mean within one
of these federations, just as it's up to the client to authenticate
itself with each fileserver.  Within NFSv4, this is true even if one
fileserver refers to another: the client will still need to authenticate
itself with the fileserver housing the filesystem being referred to.

I'm sure that this isn't much of an answer for audiences wondering how
to build a useful federation.  I invite them to suggest requirements and
potentially propose solutions for discussion.

		Craig 

> -----Original Message-----
> From: Leif Johansson [mailto:[email-masked]] 
> Sent: Monday, November 17, 2008 11:04 AM
> To: [email-masked]
> Subject: [nfsv4] Group membership (and other attribute 
> dereferencing) forfederated-fs
> 
> 
> 
> Hi,
> 
> I'm trying to understand what the direction is for identity 
> management for federated-fs, specifically how to dereference 
> group membership in a federation of fileservers that cross 
> administrative boundaries.
> 
> If all federation fs:en share a single identity and group 
> namespace then you might be able to get away with looking up 
> group membership in a single identity store based on the 
> authenticated user identity, but if you build federations 
> across administrative boundaries then experience from the web 
> identity federation space shows what the only thing that has 
> any chance of working is session-oriented claims-based 
> attribute _push_. In other words I think building federated 
> identity management based on a directory look-up has little 
> chance of real-world deployment.
>

---

From: Leif Johansson <[email-masked]>
Date: Wed, 19 Nov 2008 20:53:44 +0100

> potentially propose solutions for discussion.

Well authentication is relatively easy compared to attribute lookup (eg
group membership). I don't think this can be left up to implementers
if there is any chance of real-world deployment of cross-domain NFS.

	Cheers Leif