Requirements for NFSv4 Multi-Domain Namespace Deployment
RFC 8000
Document | Type | RFC - Proposed Standard (November 2016; No errata) | |
---|---|---|---|
Authors | Andy Adamson , Nicolás Williams | ||
Last updated | 2016-11-30 | ||
Stream | Internent Engineering Task Force (IETF) | ||
Formats | plain text html pdf htmlized (tools) htmlized bibtex | ||
Reviews | |||
Stream | WG state | Submitted to IESG for Publication | |
Document shepherd | Spencer Shepler | ||
Shepherd write-up | Show (last changed 2016-05-08) | ||
IESG | IESG state | RFC 8000 (Proposed Standard) | |
Action Holders |
(None)
|
||
Consensus Boilerplate | Yes | ||
Telechat date | |||
Responsible AD | Spencer Dawkins | ||
Send notices to | (None) | ||
IANA | IANA review state | Version Changed - Review Needed | |
IANA action state | No IANA Actions |
Internet Engineering Task Force (IETF) W. Adamson Request for Comments: 8000 NetApp Category: Standards Track N. Williams ISSN: 2070-1721 Cryptonector November 2016 Requirements for NFSv4 Multi-Domain Namespace Deployment Abstract This document presents requirements for the deployment of the NFSv4 protocols for the construction of an NFSv4 file namespace in environments with multiple NFSv4 Domains. To participate in an NFSv4 multi-domain file namespace, the server must offer a multi-domain- capable file system and support RPCSEC_GSS for user authentication. In most instances, the server must also support identity-mapping services. Status of This Memo This is an Internet Standards Track document. This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community. It has received public review and has been approved for publication by the Internet Engineering Steering Group (IESG). Further information on Internet Standards is available in Section 2 of RFC 7841. Information about the current status of this document, any errata, and how to provide feedback on it may be obtained at http://www.rfc-editor.org/info/rfc8000. Copyright Notice Copyright (c) 2016 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License. Adamson & Williams Standards Track [Page 1] RFC 8000 Multi NFSv4 Domain November 2016 Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 1.1. Requirements Language . . . . . . . . . . . . . . . . . . 3 2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 3 3. Federated File System . . . . . . . . . . . . . . . . . . . . 5 4. Identity Mapping . . . . . . . . . . . . . . . . . . . . . . 6 4.1. NFSv4 Server Identity Mapping . . . . . . . . . . . . . . 6 4.2. NFSv4 Client Identity Mapping . . . . . . . . . . . . . . 7 5. Stand-Alone NFSv4 Domain Deployment Examples . . . . . . . . 7 5.1. AUTH_SYS with Stringified UID/GID . . . . . . . . . . . . 7 5.2. AUTH_SYS with Name@domain . . . . . . . . . . . . . . . . 8 5.3. RPCSEC_GSS with Name@domain . . . . . . . . . . . . . . . 8 6. Multi-Domain Constraints to the NFSv4 Protocol . . . . . . . 9 6.1. Name@domain Constraints . . . . . . . . . . . . . . . . . 9 6.1.1. NFSv4 Domain and DNS Services . . . . . . . . . . . . 9 6.1.2. NFSv4 Domain and Name Services . . . . . . . . . . . 10 6.2. RPC Security Constraints . . . . . . . . . . . . . . . . 10 6.2.1. NFSv4 Domain and Security Services . . . . . . . . . 11 7. Stand-Alone Examples in an NFSv4 Multi-Domain Deployment . . 11 8. Resolving Multi-Domain Authorization Information . . . . . . 12 9. Security Considerations . . . . . . . . . . . . . . . . . . . 13 10. References . . . . . . . . . . . . . . . . . . . . . . . . . 14 10.1. Normative References . . . . . . . . . . . . . . . . . . 14 10.2. Informative References . . . . . . . . . . . . . . . . . 15 Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . . . 17 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 17 1. Introduction The NFSv4 protocols NFSv4.0 [RFC7530], NFSv4.1 [RFC5661], and NFSv4.2 [RFC7862] introduce the concept of an NFS Domain. An NFSv4 Domain is defined as a set of users and groups using the NFSv4 name@domain user and group identification syntax with the same specified @domain. Previous versions of the NFS protocol, such as NFSv3 [RFC1813], use the UNIX-centric user identification mechanism of numeric user and group ID for the uid3 and gid3 [RFC1813] file attributes and for identity in the authsys_parms AUTH_SYS credential defined in the Open Network Computing (ONC) Remote Procedure Call (RPC) protocol [RFC5531]. Section 6.1 of [RFC2624] notes that the use of UNIX- centric numeric IDs limits the scale of NFS to large local work groups. UNIX-centric numeric IDs are not unique across NFSv3Show full document text