Subject: [nfsv4] New version of NFSv4 multi-domain access draft (

From: "William A. (Andy) Adamson" <[email-masked]>
Date: Thu, 30 Sep 2010 13:40:23 -0400

Hello

I uploaded a new version of our internet draft "NFSv4 Multi-Domain Access"

http://www.ietf.org/id/draft-adamson-nfsv4-multi-domain-access-03.txt

Please have a look and give us any feedback.

There are a number of sections that need text. Here are some issues
that need discussion.

1)  NFSv4 is not the only potential consumer. NFSv3, and SFTP, for
example. Do we mention these and/or other potential consumers.

2) Section 5.4.3.  Resolving Domain Names to Domain IDs

We need to have a common way to map Domain Names to Domain IDs.
Currently we have two suggestions
- Just use SIDs, first asking MSFT to allocate a suitable authority
for non-Windows domain SIDs.
- Store 96-bit numeric IDs
     a) cast those to domain SIDs later.
     b) define a non-SID large ID format

3) Section 6.1.2.  RPCSEC_GSS Authorization Context Credential Data

Do we want to define a new "PAC" for multi-domain access for those
implementations that don't provide the Windows PAC, or just insist
upon the use of the Microsoft PAC.

4) General review of section 6.3.  User Group Membership Determination
- Do we depend upon 2307bis
- Do we require groups within groups

5) Do we need a section on service discovery.  Two potential methods:
- Use local methods (configuration, DNS SRV RR lookups, ...) to
  discover local domain's servers, then depend on LDAP referrals for
  discovering all other domains' s
- Use DNS SRV RRs much the way AD does.ervers.

-->Andy