[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: MEMORY credential cache interop between Heimdal and MIT?
> >The interesting thing about this thread, to me, is that we seem to
> >have people interested in pushing the envelope, and using new
> >userland capabilities to get better scoping semantics.
> The kernel hacks in AFS/DFS were only necessary because their respective
> filesystem drivers wanted to use those credentials instead of the standard
> Unix credentials. The reason we can have a discussion about userland
> solutions for Kerberos in general is because there are no kernel/filesystem
> considerations to muddy the water, the information is only needed in
> userland. If you decide that you want a credential cache that will also
> work for AFS and OpenDCE then efficiency will dictate bringing us back to
> kernel mode.
It's not just AFS and OpenDCE (does anyone use OpenDCE?).. NFSv4 and
Lustre are two other kernel-level filesystems that want to share
credentials with userspace.
The linux kernel keyring model looks like it has potential to support a
lot of these things, and it has buy-in from the linux community. If we
are going to do anything with more advanced credential
sharing/management, it needs to take advantage of OS-kernel features for
secure keyrings on platforms that have it. I would also suggest that
those interested in other platforms also lobby the platform developers.