NFSv4 rpc.idmapd plugin

PATCH In review Noam Meltzer 5 participants 15 messages Mar 4, 2014 – May 27, 2014 1 message not in the archive

Subsystems (3)

Kbuild NFS client NFS server

lore

Share & tools

lore

Noam Meltzer

author

2014-03-04 07:38 UTC #0 lore raw

v2 cover NFSv4 rpc.idmapd plugin

Hello sssd-devel & linux-nfs,

This is v2 of the patch set. It is now sent to linux-nfs as weel, following Steve Dickson request.

The code in the next 5 patches implements the design document:
https://fedorahosted.org/sssd/wiki/DesignDocs/rpc.idmapd%20plugin

The changes in the code (compared to v1) are following the review done in sssd-devel.
I believe that there are still two items in dispute (no final verdict was given in the sssd mailing list) but this new patch set will give a chance to have a cleaner look on things.

Noam Meltzer
Linux Software Engineer
PRIMARY DATA

P.O. Box 12650, Herzliya Pituach 4673300
9 Hamenofim St. Akerstein Towers, Tower A, 5th fl. Herzliya

Office: +972-77-8981888 | Fax: +972-3-7617140 | Mobile: +972-54-5873843

Email: [email protected]

Noam Meltzer (5):
NEW CLIENT: plugin for NFSv4 rpc.idmapd NFSv4 client: (private) headers from libnfsidmap NFSv4 client: add to build system
NFSv4 client: man page
NFSv4 client: add to RPM spec

 Makefile.am                            |  19 ++
 configure.ac                           |  10 +
 contrib/sssd.spec.in                   |   8 +
 src/conf_macros.m4                     |  30 ++
 src/external/libnfsidmap.m4            |  17 +
 src/man/Makefile.am                    |   4 +-
 src/man/include/seealso.xml            |   4 +
 src/man/sss_rpcidmapd.5.xml            |  97 ++++++
 src/sss_client/common.c                |   5 +
 src/sss_client/nfs/nfsidmap_internal.h |  78 +++++
 src/sss_client/nfs/sss_nfs_client.c    | 569 +++++++++++++++++++++++++++++++++
 src/sss_client/sss_cli.h               |   2 +
 12 files changed, 842 insertions(+), 1 deletion(-)
 create mode 100644 src/external/libnfsidmap.m4
 create mode 100644 src/man/sss_rpcidmapd.5.xml
 create mode 100644 src/sss_client/nfs/nfsidmap_internal.h
 create mode 100644 src/sss_client/nfs/sss_nfs_client.c

Signature · 1 line

1.8.5.3

Noam Meltzer

author

2014-03-04 07:38 UTC #1 lore raw

PATCH v2 1/5 NEW CLIENT: plugin for NFSv4 rpc.idmapd

Implementation of design document:
https://fedorahosted.org/sssd/wiki/DesignDocs/rpc.idmapd%20plugin

---
 src/sss_client/common.c             |   5 +
 src/sss_client/nfs/sss_nfs_client.c | 569 ++++++++++++++++++++++++++++++++++++
 src/sss_client/sss_cli.h            |   2 +
 3 files changed, 576 insertions(+)
 create mode 100644 src/sss_client/nfs/sss_nfs_client.c

src/sss_client/common.c +5 -0

index 6044af0..58a9eca 100644
@@ -936,6 +936,11 @@ int sss_ssh_make_request(enum sss_cli_command cmd,
     return ret;
 }
 
+int sss_nfs_make_request(enum sss_cli_command cmd, struct sss_cli_req_data *rd,
+                         uint8_t **rep, size_t *replen, int *errnop)
+{
+    return sss_nss_make_request(cmd, rd, rep, replen, errnop);
+}
 
 const char *ssscli_err2string(int err)
 {

src/sss_client/nfs/sss_nfs_client.c new file +569 -0

569 lines not on this page · raw message

src/sss_client/sss_cli.h +2 -0

index 285a297..7e488e4 100644
@@ -527,6 +527,8 @@ int sss_ssh_make_request(enum sss_cli_command cmd,
                          struct sss_cli_req_data *rd,
                          uint8_t **repbuf, size_t *replen,
                          int *errnop);
+int sss_nfs_make_request(enum sss_cli_command cmd, struct sss_cli_req_data *rd,
+                         uint8_t **rep, size_t *replen, int *errnop);
 
 #if 0

Signature · 1 line

1.8.5.3

Noam Meltzer

author

2014-03-04 07:38 UTC #2 lore raw

PATCH v2 2/5 NFSv4 client: (private) headers from libnfsidmap

In reply to Noam Meltzer

The private headers are needed in order to:
nfsidmap_internal.h:
* definition of struct trans_func
* prototype for logger function
cfg.h + queue.h:
* prototype(s) for accessing rpc.idmpad configuration file

---
 src/sss_client/nfs/nfsidmap_internal.h | 78 ++++++++++++++++++++++++++++++++++
 1 file changed, 78 insertions(+)
 create mode 100644 src/sss_client/nfs/nfsidmap_internal.h

src/sss_client/nfs/nfsidmap_internal.h new file +78 -0

new file mode 100644
index 0000000..a598c10
@@ -0,0 +1,78 @@
+/*
+ *  nfsidmap_internal.h
+ *
+ *  nfs idmapping library, primarily for nfs4 client/server kernel idmapping
+ *  and for userland nfs4 idmapping by acl libraries.
+ *
+ *  Copyright (c) 2004 The Regents of the University of Michigan.
+ *  All rights reserved.
+ *
+ *  Andy Adamson <[email protected]>
+ *
+ *  Redistribution and use in source and binary forms, with or without
+ *  modification, are permitted provided that the following conditions
+ *  are met:
+ *
+ *  1. Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ *  2. Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *  3. Neither the name of the University nor the names of its
+ *     contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ *  THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
+ *  WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ *  MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ *  DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ *  FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ *  CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ *  SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
+ *  BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+ *  LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+ *  NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ *  SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+char *get_default_domain(void);
+struct conf_list *get_local_realms(void);
+
+typedef struct trans_func * (*libnfsidmap_plugin_init_t)(void);
+
+struct trans_func {
+	char *name;
+	int (*init)(void);
+	int (*princ_to_ids)(char *secname, char *princ, uid_t *uid, gid_t *gid, 
+		extra_mapping_params **ex);
+	int (*name_to_uid)(char *name, uid_t *uid);
+	int (*name_to_gid)(char *name, gid_t *gid);
+	int (*uid_to_name)(uid_t uid, char *domain, char *name, size_t len);
+	int (*gid_to_name)(gid_t gid, char *domain, char *name, size_t len);
+	int (*gss_princ_to_grouplist)(char *secname, char *princ, gid_t *groups,
+		int *ngroups, extra_mapping_params **ex);
+};
+
+struct mapping_plugin {
+	void *dl_handle;
+	struct trans_func *trans;
+};
+
+typedef enum {
+	IDTYPE_USER = 1,
+	IDTYPE_GROUP = 2
+} idtypes;
+
+extern int idmap_verbosity;
+extern nfs4_idmap_log_function_t idmap_log_func;
+/* Level zero always prints, others print depending on verbosity level */
+#define IDMAP_LOG(LVL, MSG) \
+	do { if (LVL <= idmap_verbosity) (*idmap_log_func)MSG; } while (0)
+
+
+/*
+ * from libnfsidmap's cfg.h (same license as above)
+ * Copyright (c) 1998, 1999, 2001 Niklas Hallqvist.  All rights reserved.
+ * Copyright (c) 2000, 2003 H�kan Olsson.  All rights reserved.
+ */
+extern char    *conf_get_str(char *, char *);

Signature · 1 line

1.8.5.3

Noam Meltzer

author

2014-03-04 07:38 UTC #3 lore raw

PATCH v2 3/5 NFSv4 client: add to build system

In reply to Noam Meltzer

---
 Makefile.am                 | 19 +++++++++++++++++++
 configure.ac                | 10 ++++++++++
 src/conf_macros.m4          | 30 ++++++++++++++++++++++++++++++
 src/external/libnfsidmap.m4 | 17 +++++++++++++++++
 4 files changed, 76 insertions(+)
 create mode 100644 src/external/libnfsidmap.m4

Makefile.am +19 -0

index 9f010d9..23f6093 100644
@@ -47,6 +47,7 @@ localedir = @localedir@
 nsslibdir = @nsslibdir@
 pamlibdir = @pammoddir@
 autofslibdir = @appmodpath@
+nfslibdir = @nfsidmaplibdir@
 
 dbpath = @dbpath@
 pluginpath = @pluginpath@

@@ -526,6 +527,7 @@ dist_noinst_HEADERS = \
     src/tests/cmocka/common_mock_sysdb_objects.h \
     src/sss_client/ssh/sss_ssh_client.h \
     src/sss_client/sudo/sss_sudo.h \
+    src/sss_client/nfs/nfsidmap_internal.h \
     src/lib/idmap/sss_idmap_private.h

@@ -1666,6 +1668,23 @@ libnss_sss_la_LDFLAGS = \
     -version-info 2:0:0 \
     -Wl,--version-script,$(srcdir)/src/sss_client/sss_nss.exports
 
+
+if BUILD_NFS
+nfslib_LTLIBRARIES = sss_nfs.la
+sss_nfs_la_SOURCES = \
+    src/sss_client/common.c \
+    src/sss_client/nss_mc_common.c \
+    src/util/io.c \
+    src/util/murmurhash3.c \
+    src/sss_client/nss_mc_passwd.c \
+    src/sss_client/nss_mc_group.c \
+    src/sss_client/nfs/sss_nfs_client.c \
+    $(NULL)
+sss_nfs_la_CFLAGS = $(AM_CFLAGS)
+sss_nfs_la_LIBADD = $(CLIENT_LIBS) $(NFSIDMAP_LIBS)
+sss_nfs_la_LDFLAGS = -module -avoid-version
+endif
+
 pamlib_LTLIBRARIES = pam_sss.la
 pam_sss_la_SOURCES = \
     src/sss_client/pam_sss.c \

configure.ac +10 -0

index 8295139..b440f92 100644
@@ -91,6 +91,13 @@ AC_ARG_ENABLE([pammoddir], [AS_HELP_STRING([--enable-pammoddir],
               [pammoddir=$libdir/security])
 AC_SUBST(pammoddir)
 
+#Set the NFSv4 idmapd library install path
+AC_ARG_ENABLE([nfsidmaplibdir], [AS_HELP_STRING([--enable-nfsidmaplibdir],
+                                        [Where to install libnfsidmap libraries ($libdir/libnfsidmap)])],
+              [nfsidmaplibdir=$enableval],
+              [nfsidmaplibdir=$libdir/libnfsidmap])
+AC_SUBST(nfsidmaplibdir)
+
 #Include here cause WITH_INIT_DIR requires $osname set in platform.m4
 m4_include([src/external/platform.m4])

@@ -127,6 +134,8 @@ WITH_AUTOFS
 WITH_SSH
 WITH_CRYPTO
 WITH_SYSLOG
+WITH_NFS
+WITH_NFS_LIB_PATH
 
 m4_include([src/external/pkg.m4])
 m4_include([src/external/libpopt.m4])

@@ -159,6 +168,7 @@ m4_include([src/external/signal.m4])
 m4_include([src/external/inotify.m4])
 m4_include([src/external/libndr_nbt.m4])
 m4_include([src/external/sasl.m4])
+m4_include([src/external/libnfsidmap.m4])
 
 WITH_UNICODE_LIB
 if test x$unicode_lib = xlibunistring; then

src/conf_macros.m4 +30 -0

index 7111859..3f59b1f 100644
@@ -646,3 +646,33 @@ AC_DEFUN([WITH_SSH],
     fi
     AM_CONDITIONAL([BUILD_SSH], [test x"$with_ssh" = xyes])
   ])
+
+  AC_DEFUN([WITH_NFS],
+  [ AC_ARG_WITH([nfs],
+                [AC_HELP_STRING([--with-nfs],
+                                [Whether to build with NFSv4 IDMAP support [yes]]
+                               )
+                ],
+                [with_nfs=$withval],
+                with_nfs=yes
+               )
+
+    if test x"$with_nfs" = xyes; then
+        AC_DEFINE(BUILD_NFS, 1, [whether to build with NFSv4 IDMAP support])
+    fi
+    AM_CONDITIONAL([BUILD_NFS], [test x"$with_nfs" = xyes])
+  ])
+
+AC_DEFUN([WITH_NFS_LIB_PATH],
+  [ AC_ARG_WITH([nfs-lib-path],
+                [AC_HELP_STRING([--with-nfs-lib-path=<path>],
+                                [Path to the nfs library [${libdir}]]
+                               )
+                ]
+               )
+    nfslibpath="${libdir}"
+    if test x"$with_nfs_lib_path" != x; then
+        nfslibpath=$with_nfs_lib_path
+    fi
+    AC_SUBST(nfslibpath)
+  ])

src/external/libnfsidmap.m4 new file +17 -0

new file mode 100644
index 0000000..5bb6d86
@@ -0,0 +1,17 @@
+AC_SUBST(NFSIDMAP_OBJ)
+AC_SUBST(NFSIDMAP_CFLAGS)
+AC_SUBST(NFSIDMAP_LIBS)
+
+PKG_CHECK_MODULES([NFSIDMAP], [libnfsidmap], [found_nfsidmap=yes],
+		  [found_nfsidmap=no])
+
+SSS_AC_EXPAND_LIB_DIR()
+AS_IF([test x"$with_nfs" = xyes -a x"$found_nfsidmap" != xyes],
+    [AC_CHECK_HEADER([nfsidmap.h],
+        [AC_CHECK_LIB([nfsidmap],
+                      [nfs4_init_name_mapping],
+                      [NFSIDMAP_LIBS="-L$sss_extra_libdir -lnfsidmap"],
+                      [AC_MSG_ERROR([libnfsidmap missing nfs4_init_name_mapping])],
+                      [-L$sss_extra_libdir])],
+        [AC_MSG_ERROR([libnfsidmap header files are not installed])])]
+)

Signature · 1 line

1.8.5.3

Noam Meltzer

author

2014-03-04 07:38 UTC #4 lore raw

PATCH v2 4/5 NFSv4 client: man page

In reply to Noam Meltzer

---
 src/man/Makefile.am         |  4 +-
 src/man/include/seealso.xml |  4 ++
 src/man/sss_rpcidmapd.5.xml | 97 +++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 104 insertions(+), 1 deletion(-)
 create mode 100644 src/man/sss_rpcidmapd.5.xml

src/man/Makefile.am +3 -1

index eb87980..97a1b66 100644
@@ -42,7 +42,9 @@ man_MANS = \
     sssd.8 sssd.conf.5 sssd-ldap.5 \
     sssd-krb5.5 sssd-ipa.5 sssd-simple.5 sssd-ad.5 \
     sssd_krb5_locator_plugin.8 sss_groupshow.8 \
-    pam_sss.8 sss_obfuscate.8 sss_cache.8 sss_debuglevel.8 sss_seed.8
+    pam_sss.8 sss_obfuscate.8 sss_cache.8 sss_debuglevel.8 sss_seed.8 \
+    sss_rpcidmapd.5 \
+    $(NULL)
 
 if BUILD_SSH
 man_MANS += sss_ssh_authorizedkeys.1 sss_ssh_knownhostsproxy.1

src/man/include/seealso.xml +4 -0

index 4f79431..ad6aaab 100644
@@ -77,5 +77,9 @@
             <citerefentry>
                 <refentrytitle>pam_sss</refentrytitle><manvolnum>8</manvolnum>
             </citerefentry>.
+            <citerefentry>
+                <refentrytitle>sss_rpcidmapd</refentrytitle>
+                <manvolnum>5</manvolnum>
+            </citerefentry>
         </para>
     </refsect1>

src/man/sss_rpcidmapd.5.xml new file +97 -0

97 lines not on this page · raw message

Signature · 1 line

1.8.5.3

Noam Meltzer

author

2014-03-04 07:38 UTC #5 lore raw

PATCH v2 5/5 NFSv4 client: add to RPM spec

In reply to Noam Meltzer

---
 contrib/sssd.spec.in | 8 ++++++++
 1 file changed, 8 insertions(+)

contrib/sssd.spec.in +8 -0

index 055de4a..30ab9a5 100644
@@ -138,6 +138,11 @@ BuildRequires: systemd-devel
 %if (0%{?with_cifs_utils_plugin} == 1)
 BuildRequires: cifs-utils-devel
 %endif
+%if ((0%{?fedora} >= 15) || (0%{?rhel} >= 7))
+BuildRequires: libnfsidmap-devel
+%else
+BuildRequires: nfs-utils-lib-devel
+%endif
 
 # RHEL 5 is too old to support samba4 and the PAC responder
 %if !0%{?is_rhel5}

@@ -418,6 +423,7 @@ autoreconf -ivf
     --with-krb5-rcache-dir=%{_localstatedir}/cache/krb5rcache \
     --enable-nsslibdir=/%{_lib} \
     --enable-pammoddir=/%{_lib}/security \
+    --enable-nfsidmaplibdir=%{_libdir}/libnfsidmap \
     --disable-static \
     --disable-rpath \
     %{?with_ccache} \

@@ -567,6 +573,7 @@ rm -rf $RPM_BUILD_ROOT
 # 3rd party application libraries
 %{_libdir}/sssd/modules/libsss_autofs.so
 %{_libdir}/libsss_sudo.so
+%{_libdir}/libnfsidmap/sss_nfs.so
 
 %{ldb_modulesdir}/memberof.so
 %{_bindir}/sss_ssh_authorizedkeys

@@ -597,6 +604,7 @@ rm -rf $RPM_BUILD_ROOT
 %{_mandir}/man5/sssd.conf.5*
 %{_mandir}/man5/sssd-simple.5*
 %{_mandir}/man5/sssd-sudo.5*
+%{_mandir}/man5/sss_rpcidmapd.5*
 %{_mandir}/man8/sssd.8*
 %{_mandir}/man8/sss_cache.8*
 %{_mandir}/man1/sss_ssh_authorizedkeys.1*

Signature · 1 line

1.8.5.3

Steve Dickson

2014-03-13 15:24 UTC #6 lore raw

In reply to Noam Meltzer

Hello,

Quoted 5 lines · Noam Meltzer

Hello sssd-devel & linux-nfs,
This is v2 of the patch set. It is now sent to linux-nfs as weel, following Steve Dickson request.

Quoted 8 lines

The code in the next 5 patches implements the design document:
https://fedorahosted.org/sssd/wiki/DesignDocs/rpc.idmapd%20plugin
The changes in the code (compared to v1) are following the review done in sssd-devel.
I believe that there are still two items in dispute (no final verdict was given in the sssd mailing list) but this new patch set will give a chance to have a cleaner look on things.

What exactly are you looking for from us to move this forward?

I would like to point out that the NFS client no longer uses the rpc.idmapd daemon to do its id mapping. Instead the kernel now does an upcall to the nfsidmap(5) command and the resulting uid/gid is stored in the kernel key chain, if a mapping is done at all...

V4 servers now have an option of returning a uid string (aka "3606") where the NFS client just converts that into the uid.

steved.

Quoted 42 lines

--
Noam Meltzer
Linux Software Engineer
PRIMARY DATA
P.O. Box 12650, Herzliya Pituach 4673300
9 Hamenofim St. Akerstein Towers, Tower A, 5th fl. Herzliya
Office: +972-77-8981888 | Fax: +972-3-7617140 | Mobile: +972-54-5873843
Email: [email protected]
--
Noam Meltzer (5):
NEW CLIENT: plugin for NFSv4 rpc.idmapd NFSv4 client: (private) headers from libnfsidmap NFSv4 client: add to build system
NFSv4 client: man page
NFSv4 client: add to RPM spec
 Makefile.am                            |  19 ++
 configure.ac                           |  10 +
 contrib/sssd.spec.in                   |   8 +
 src/conf_macros.m4                     |  30 ++
 src/external/libnfsidmap.m4            |  17 +
 src/man/Makefile.am                    |   4 +-
 src/man/include/seealso.xml            |   4 +
 src/man/sss_rpcidmapd.5.xml            |  97 ++++++
 src/sss_client/common.c                |   5 +
 src/sss_client/nfs/nfsidmap_internal.h |  78 +++++
 src/sss_client/nfs/sss_nfs_client.c    | 569 +++++++++++++++++++++++++++++++++
 src/sss_client/sss_cli.h               |   2 +
 12 files changed, 842 insertions(+), 1 deletion(-)
 create mode 100644 src/external/libnfsidmap.m4
 create mode 100644 src/man/sss_rpcidmapd.5.xml
 create mode 100644 src/sss_client/nfs/nfsidmap_internal.h
 create mode 100644 src/sss_client/nfs/sss_nfs_client.c

Simo Sorce

2014-03-13 16:59 UTC #7 lore raw

Quoted 2 lines · Steve Dickson

V4 servers now have an option of returning a uid string (aka "3606") where the NFS client just converts that into the uid.

Can the client tell the server *not to do that* ?

Simo.

Signature · 1 line

Simo Sorce * Red Hat, Inc * New York

J. Bruce Fields

2014-03-13 17:25 UTC #8 lore raw

Quoted 6 lines · Simo Sorce

Quoted 2 lines · Steve Dickson
V4 servers now have an option of returning a uid string (aka "3606") where the NFS client just converts that into the uid.
Can the client tell the server *not to do that* ?

The client can use kerberos, in which case the server won't do that.

Other than that, no, the behavior can only be controlled by server-side configuration.

--b.

Simo Sorce

2014-03-13 17:41 UTC #9 lore raw

Quoted 9 lines · J. Bruce Fields

Quoted 6 lines · Simo Sorce
Quoted 2 lines · Steve Dickson
V4 servers now have an option of returning a uid string (aka "3606") where the NFS client just converts that into the uid.
Can the client tell the server *not to do that* ?
The client can use kerberos, in which case the server won't do that.

This is sufficient, thanks.

Quoted 2 lines

Other than that, no, the behavior can only be controlled by server-side configuration.

A little sub-optimal if the server can do either but the client can have a choice, but ok.

Simo.

Signature · 1 line

Simo Sorce * Red Hat, Inc * New York

A message that is not in the archive (sent off-list or not yet received): 1394732462.32465.235.camel-Hs+ccMQdwurzDu64bZtGtWD2FQJk+8+b@public.gmane.org

Noam Meltzer

author

2014-03-20 07:33 UTC #11 lore raw

Quoted 11 lines · Simo Sorce

Quoted 9 lines · J. Bruce Fields
Quoted 6 lines · Simo Sorce
Quoted 2 lines · Steve Dickson
V4 servers now have an option of returning a uid string (aka "3606") where the NFS client just converts that into the uid.
Can the client tell the server *not to do that* ?
The client can use kerberos, in which case the server won't do that.

Quoted 8 lines

This is sufficient, thanks.
Quoted 2 lines
Other than that, no, the behavior can only be controlled by server-side configuration.
A little sub-optimal if the server can do either but the client can have a choice, but ok.

Sorry for the late response. A misplaced email filtering rule had moved it away from my inbox.
How can we push this forward?

Signature · 10 lines

Noam Meltzer
Linux Software Engineer
PRIMARY DATA

P.O. Box 12650, Herzliya Pituach 4673300
9 Hamenofim St. Akerstein Towers, Tower A, 5th fl. Herzliya

Office: +972-77-8981888 | Fax: +972-3-7617140 | Mobile: +972-54-5873843

Email: [email protected]

_______________________________________________
sssd-devel mailing list
[email protected]
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel

Steve Dickson

2014-03-20 13:49 UTC #12 lore raw

Quoted 21 lines · Noam Meltzer

On Thu, Mar 13, 2014 at 7:41 PM, Simo Sorce <[email protected] <mailto:[email protected]>> wrote:
On Thu, 2014-03-13 at 13:25 -0400, J. Bruce Fields wrote:
> On Thu, Mar 13, 2014 at 12:58:59PM -0400, Simo Sorce wrote:
> > On Thu, 2014-03-13 at 11:24 -0400, Steve Dickson wrote:
> >
> > > V4 servers now have an option of returning a uid string (aka "3606") > > > where the NFS client just converts that into the uid.
> >
> > Can the client tell the server *not to do that* ?
>
> The client can use kerberos, in which case the server won't do that.
This is sufficient, thanks.
> Other than that, no, the behavior can only be controlled by server-side > configuration.

Quoted 7 lines

A little sub-optimal if the server can do either but the client can have a choice, but ok.
Sorry for the late response. A misplaced email filtering rule had moved it away from my inbox. How can we push this forward?

Not sure since I don't maintain any of the code these patches change...

steved.

Jakub Hrozek

2014-05-27 19:46 UTC #13 lore raw

Quoted 28 lines · Steve Dickson

Quoted 25 lines · Noam Meltzer
On Thu, Mar 13, 2014 at 7:41 PM, Simo Sorce <[email protected] <mailto:[email protected]>> wrote:
On Thu, 2014-03-13 at 13:25 -0400, J. Bruce Fields wrote:
> On Thu, Mar 13, 2014 at 12:58:59PM -0400, Simo Sorce wrote:
> > On Thu, 2014-03-13 at 11:24 -0400, Steve Dickson wrote:
> >
> > > V4 servers now have an option of returning a uid string (aka "3606") > > > where the NFS client just converts that into the uid.
> >
> > Can the client tell the server *not to do that* ?
>
> The client can use kerberos, in which case the server won't do that.
This is sufficient, thanks.
> Other than that, no, the behavior can only be controlled by server-side > configuration.
A little sub-optimal if the server can do either but the client can have a choice, but ok.

Quoted 6 lines

Quoted 3 lines
Sorry for the late response. A misplaced email filtering rule had moved it away from my inbox. How can we push this forward?
Not sure since I don't maintain any of the code these patches change...
steved.

Does the code work with the current NFS idmap implementation or are there any changes on either side needed?

Simo, are there still any issues that would prevent us from merging the code into SSSD?

Simo Sorce

2014-05-27 20:02 UTC #14 lore raw

Quoted 34 lines · Jakub Hrozek

Quoted 33 lines · Steve Dickson
Quoted 21 lines · Noam Meltzer
On Thu, Mar 13, 2014 at 7:41 PM, Simo Sorce <[email protected] <mailto:[email protected]>> wrote:
On Thu, 2014-03-13 at 13:25 -0400, J. Bruce Fields wrote:
> On Thu, Mar 13, 2014 at 12:58:59PM -0400, Simo Sorce wrote:
> > On Thu, 2014-03-13 at 11:24 -0400, Steve Dickson wrote:
> >
> > > V4 servers now have an option of returning a uid string (aka "3606") > > > where the NFS client just converts that into the uid.
> >
> > Can the client tell the server *not to do that* ?
>
> The client can use kerberos, in which case the server won't do that.
This is sufficient, thanks.
> Other than that, no, the behavior can only be controlled by server-side > configuration.
Quoted 7 lines
A little sub-optimal if the server can do either but the client can have a choice, but ok.
Sorry for the late response. A misplaced email filtering rule had moved it away from my inbox. How can we push this forward?
Not sure since I don't maintain any of the code these patches change...

Quoted 7 lines

Quoted 1 line
steved.
Does the code work with the current NFS idmap implementation or are there any changes on either side needed?
Simo, are there still any issues that would prevent us from merging the code into SSSD?

I am not aware of any issue, but I have not found any time to do any testing, sorry :-/

Simo.

Signature · 1 line

Simo Sorce * Red Hat, Inc * New York

Noam Meltzer

author

2014-03-20 07:36 UTC #15 lore raw

In reply to Simo Sorce

Quoted 12 lines · Simo Sorce

Quoted 9 lines · J. Bruce Fields
Quoted 6 lines · Simo Sorce
Quoted 2 lines · Steve Dickson
V4 servers now have an option of returning a uid string (aka "3606") where the NFS client just converts that into the uid.
Can the client tell the server *not to do that* ?
The client can use kerberos, in which case the server won't do that.

Quoted 8 lines

This is sufficient, thanks.
Quoted 2 lines
Other than that, no, the behavior can only be controlled by server-side configuration.
A little sub-optimal if the server can do either but the client can have a choice, but ok.

Sorry for the late response. A misplaced email filtering rule had moved it away from my inbox.
How can we push this forward?

Signature · 10 lines

Noam Meltzer
Linux Software Engineer
PRIMARY DATA

P.O. Box 12650, Herzliya Pituach 4673300
9 Hamenofim St. Akerstein Towers, Tower A, 5th fl. Herzliya

Office: +972-77-8981888 | Fax: +972-3-7617140 | Mobile: +972-54-5873843

Email: [email protected]