Subject: [nfsv4] On the (lack of) replication semantics in draft-ietf-nfsv4-federated-fs-protocol-00

From: Leif Johansson <[email-masked]>
Date: Sun, 16 Nov 2008 21:00:04 +0100

Hi,

I'm new to this group but not new to the IETF. I have a background in AFS, 
security protocols (notably federated identity) and LDAP. Lisa D asked me
to put on those glasses and read the federated-fs drafts and provide 
feedback to the wg.

In section 3.4 there is a discussion about the "volume location server" i.e
the NSDB and here I think there is some confusion about the role of LDAP.

In the 4:th paragraph it is stated that the NSDB should have an LDAP 
interface but in the discussion of replication it sais that since most LDAP 
implementations support replication this problem can be left to the 
implementations of NSDB.

This betrays a confusion between LDAP as an interface to a traditional 
directory service and LDAP as a protocol which can be used to access
almost anything that looks like hierarchical datasets. The LDAP protocol
doesn't say anything about the semantics of multiple servers serving a
single dataset through replication. Implementations in fact differ quite 
a bit in this respect - some support multi-master replication, others only
support single-master replication or token-based hopping-master schemes.

I think it critically important for the document to state in some detail the
_semantics_ of replication of NSDB needed to support federated nfsv4!

Compare with the semantics of ubik-style replication of AFSDB-servers 
which is _quite_ different from the semantics provided by any current
LDAP implementation. 

The point I wish to make very clear is that the implied semantics of 
distributed LDAP you get from common LDAP implementations may or 
may _not_ be what you need in order to support filesystem semantics.

Naturally using LDAP would need work on schema etc but I assume this
would be done in a separate document. Lets not forget it though :-)

I'll probably have more comments on other parts of the federated-fs
drafts but I'll keep the threads separate.

	Cheers Leif
_______________________________________________
nfsv4 mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/nfsv4

---

From: Leif Johansson <[email-masked]>
Date: Sun, 16 Nov 2008 21:34:04 +0100

need in order to support filesystem semantics.
> would be done in a separate document. Lets not forget it though :-)

NB - I know there is some work on schema in the document. What I meant
by the above is that the schema needs to be formalized.

	Cheers Leif

---

From: James Lentini <[email-masked]>
Date: Mon, 17 Nov 2008 10:10:47 -0500 (EST)

> drafts but I'll keep the threads separate.

Thank you for your comments Leif.

Where are the semantics of the three LDAP replication mechanisms you 
mention defined?

The challenge we've faced is that the LDAP replication protocols are 
not standardized. As a result, we've expected the NSDB to be 
replicated, but avoided requiring a particular implementation.
_______________________________________________
nfsv4 mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/nfsv4

---

From: James Lentini <[email-masked]>
Date: Mon, 17 Nov 2008 10:19:49 -0500 (EST)

> by the above is that the schema needs to be formalized.

Is there an example of how this should be presented? An appendix with 
LDIF? Something else?
_______________________________________________
nfsv4 mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/nfsv4

---

From: Leif Johansson <[email-masked]>
Date: Mon, 17 Nov 2008 16:26:09 +0100

> Where are the semantics of the three LDAP replication mechanisms you

That's the problem: they are only defined in vendor documentation :-( The 
now defunct LDUP wg was unable to agree on replication semantics and nor 
has any other LDAP-related wg to date.

The only general reference I can provide is RFC 3254 - Haralds discussion
about directories in general. In section 2.3 he speaks about the consistency
models that different directories (not just LDAP) are based on. This text may
be a starting-point for a discussion about replication requirements for NSDB.

> replicated, but avoided requiring a particular implementation.

Right and my argument is that you (as in people who care about federated
nfsv4) need to at least write down necessary requirements on replication 
semantics for NSDB to work.

	Cheers Leif

---

From: Leif Johansson <[email-masked]>
Date: Mon, 17 Nov 2008 16:33:39 +0100

> Is there an example of how this should be presented? An appendix with

A good example is RFC 3112 where you fold in the schema definition and any
ABNF in line with the normative text. I would add a combined schema as an 
appendix too. The use of LDIF for schema is actually a sun-directory-serverism
and should be avoided in favor of RFC2252-style definitions of objectclasses
and attribute types.

	Cheers Leif