Subject: Re: [nfsv4] draft-adamson-nfsv4-multi-domain-federated-fs-reqs-04 review comments

From: "McDonald, Alex" <[email-masked]>
Date: Wed, 6 Aug 2014 23:03:25 +0000

Grammar nazi here. Lists are of the form
a, b and c
But not 
a, b, and c

Also see inline below. 

Sent from my iPhone

On 31 Jul 2014, at 14:28, "Tom Haynes" <[email-masked]> wrote:

>>   This document describes constraints to the NFSv4.0 and NFSv4.1
> 
> Need to define NFS here (first use in abstract and in body).
> 
>>   1.  NFSv4 Domain, Pseudo file system and referrals: The NFSv4.0
> 
> “,” after system.
> 
> 
>>         entity.  E.g. a Kerberos Realm.  While a typical configuration
> 
> ‘,’ after either “e.g.” or “i.e.
> 

This should be a sentence as in "... entity, for example a Kerberos realm."

---

From: "J. Bruce Fields" <[email-masked]>
Date: Wed, 6 Aug 2014 23:02:05 -0400

> Grammar nazi here. Lists are of the form

See section 3.3 of

	www.rfc-editor.org/rfc-style-guide/rfc-style

and

	http://en.wikipedia.org/wiki/Serial_comma

--b.

---

From: Nico Williams <[email-masked]>
Date: Thu, 7 Aug 2014 00:14:03 -0500

On Wed, Jul 23, 2014 at 03:00:01PM -0400, Brian Reitz wrote:
> 1)  In section 4.1:
> 
>       The name portion of name@domain MUST be unique within the
>       specified NFSv4 domain.
> 
> Is this really a unique/new requirement of multi-domain FedFS?  Seems
> like this really is a requirement in 3530 but perhaps not stated as
> succinctly in that document?

It's at least strongly implied.  And how else could it be?  :)

---

From: Nico Williams <[email-masked]>
Date: Thu, 7 Aug 2014 00:21:51 -0500

On Thu, Jul 31, 2014 at 05:28:26PM -0400, Tom Haynes wrote:
> How do we tell if [email-masked] is the same as
> [email-masked]?

The name service (LDAP, whatever) is responsible for dealing with
aliases.  If getpwnam() (or whatever) on both those names produces the
same UIDs, they they are the same user.

> >    services.  In order to interoperate in a multi-domain NFSv4 FedFS
> >    file system, NFSv4 servers must use such services in compatible ways.
> > 
> 
> Is this a MUST?

To me it seems descriptive.  The "compatible ways" need to be prescribed
somewhere, with RFC2119 language.

Incidentally, RFC2119 says nothing about the case of the terms it
defines...

> > AUTH_SYS
> >    can not be used in an NFSv4 multi-domain federated file system.
> > 
> 
> MUST?

I'd make that a MUST solely on the basis of its not being secure.  And
to egg on RPCSEC_GSSv3 (which has the functionality we really need to
replace AUTH_SYS).

---

From: Tom Haynes <[email-masked]>
Date: Thu, 7 Aug 2014 09:54:06 -0400

> same UIDs, they they are the same user.

I wasn’t talking about aliases.

Some examples in the text would help set up the requirements and also
delineate the different terms.

For example, if I am reading the terms correctly, 

[email-masked]

and 

[email-masked]

are in the same name service, which is EXCFB.COM, but they could be in
multiple security domains, MARKETING.EXCFB.COM and EXCFB.COM.

So multi-realm but not multi-domain?

BTW - I’m aware that according to Section 4.1, these two examples would
actually come from different name services. Or is this covered by the
talk of canonical here:

>       Every local representation of a user and of a group MUST have a
>       canonical name@domain, and it must be possible to return the
>       canonical name@domain for any identity stored on disk, at least
>       when required infrastructure servers (such as name services) are
>       online.

But [email-masked] is in a different name service altogether
and may have a different UID than the one inside EXCFB.COM. As I
understand the requirements of this document, the intent is to provide
a means to map these to the same principal.

---

From: Tom Haynes <[email-masked]>
Date: Thu, 7 Aug 2014 09:56:18 -0400

>  o  The NFSv4 domain portion of name@domain MUST be unique within the
>       FedFS NFSv4 multi-domain namespace.  See
>       [I-D.ietf-nfsv4-rfc3530bis] section 5.9 "Interpreting owner and
>       owner_group" for a discussion on NFSv4 domain configuration.

I found this confusing in that it makes an assertion about FedFS and then provides a reference to 3530bis.

Could you quote the relevant section in the FedFS document first and then also tie in the motivation as to why the section from 3530bis is relevant here?

---

From: "Adamson, Andy" <[email-masked]>
Date: Thu, 7 Aug 2014 14:22:03 +0000

On Aug 7, 2014, at 9:54 AM, Tom Haynes <[email-masked]> wrote:

> Joe.Schmoo@ marketing.excfb.com
> 
> and 
> 
> [email-masked]
> 
> are in the same name service, which is EXCFB.COM,

I don’t see how you can claim that. If the above names are NFSv4 name@domain syntax then
excfb.com and marketing.excfb.com are separate NFSv4 domains and therefore
use separate name services.

If the above examples are simply DNS names, then it is possible that they share an NFSv4 domain name and a naming service, or it is possible that they are in separate NFSv4 domains, or have nothing at all to do with NFSv4!

> but they could be in
 
Yes, an NFSv4domain can have multiple kerberos realms, but only one name service.  The UoM did this with AFS - one ID mapping for _all_ users in the many kerberos realms. [email-masked] = [email-masked] = [email-masked] = 27395.

>>      when required infrastructure servers (such as name services) are

Yes, the above requirement covers your example, and as I said above, if [email-masked] and Joe.Schmoo@ marketing.excfb.com are NFSv4 name@domain syntax, they are in different NFSv4 domains.

> and may have a different UID than the one inside EXCFB.COM.

Different name service == different NFSv4 domain.
NFSv4 domain can have multiple DNS realms, multiple Kerberos Realms

> As I

No!  Simply how to join two NFSv4 domains (e.g. two name-service spaces) in a FedFS name space.

I can tell I didn’t do a good job at explaining this :( I’ll provide examples and dig into the difference between a DNS domain and an NFSv4domain.

—>Andy

> 
> 
> 
> _______________________________________________
> nfsv4 mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/nfsv4

---

From: "Adamson, Andy" <[email-masked]>
Date: Thu, 7 Aug 2014 14:24:58 +0000

> I found this confusing in that it makes an assertion about FedFS and then provides a reference to 3530bis.

AFAICS hat reference is the ONLY place that any NFSv4 doc that attempts to explain the relationship between a DNS domain name and an NFSv4 name@domain name.

> 
> Could you quote the relevant section in the FedFS document first

FedFS does not concern itself with NFSv4 name to ID mapping, nor with DNS domain vrs NFSv4 domain.

> and then also tie in the motivation as to why the section from 3530bis is relevant here?

I can clear this up.

—>Andy

---

From: "Adamson, Andy" <[email-masked]>
Date: Thu, 7 Aug 2014 14:45:52 +0000

> somewhere, with RFC2119 language.

Fair enough. The ‘compatible ways’ are all of the requirements in this doc.

> I'd make that a MUST solely on the basis of its not being secure.  

I’d make it a MUST on the basis of UID collisions.

> And

Well, I don’t see the motivation for GSSv3 helping AUTH_SYS as you need to set up a Kerberos realm in order to use GSSv3, and so you might as well just use Kerberos principals. That said, yes, one could define a GSSv3 structured privilege that would allow AUTH_SYS to be use in a multi-domain enviroment.

—>Andy

---

From: "McDonald, Alex" <[email-masked]>
Date: Fri, 8 Aug 2014 00:59:46 +0000

Thanks for the clarification. I wasn't aware of that particular style convention.

Interestingly, the serial comma is advised in the RFC to avoid ambiguity. The authors are confused as they illustrate with an example reference [Panda04] that is plainly incorrect. The sentence "Eats, Shoots and Leaves" is used as the example. The serial comma would make that "Eats, Shoots, and Leaves" which has exactly the same sense. Whether the "leaves " is a noun or verb is still undecidable in both.

The Wikipedia article is better.

Alex McDonald
Standards & Industry Associations Group
CTO Office
NetApp
+44 7795 046686 Mobile Phone
[email-masked]
twitter: @alextangent
Follow us: 

> -----Original Message-----
> From: J. Bruce Fields [mailto:[email-masked]]
> Sent: 06 August 2014 20:02
> To: McDonald, Alex
> Cc: Tom Haynes; Adamson, Andy; [email-masked]
> Subject: Re: [nfsv4] draft-adamson-nfsv4-multi-domain-federated-fs-reqs-
> 04 review comments
> 
> > Grammar nazi here. Lists are of the form a, b and c But not a, b, and
> > c
> 
> See section 3.3 of
>