NFSv4 Multi-Domain FedFS Requirements

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in .

The NFSv4.0 and NFSv4.1 (NFSv4) protocols enable the construction of a distributed file system which can join NFSv4 servers from multiple administrative domains, each potentially using separate name resolution services and separate security services, into a common multi-domain name space. The Federated File System (FedFS) describes requirements and adminstrative tools to construct a uniform server-based namespace that is capable of spanning a whole enterprise and that is easy to manage. A multi-domain capable filesystem uses local ID forms that can represent identities from both local and remote domains. A multi-domain NFSv4 FedFS joins multiple NFSv4 administrative domains each consisting of NFSv4 servers that export multi-domain capable filesystems, and that employ separate name resolution services and separate security services into a uniform server-based name space capable of spanning multiple enterprises. This document describes constraints to the NFSv4.0 and NFSv4.1 protocols as well as the use of multi-domain capable file systems, name resolution services, and security services to fully enable a multi-domain NFSv4 federated file system.

NFSv4 deals with two kinds of identities: authentication identities (referred to here as "principals") and authorization identities ("users" and "groups" of users). NFSv4 supports multiple authentication methods, each authenticating an "initiator principal" (typically representing a user) to an "acceptor principals" (always corresponding to the server). NFSv4 does not prescribe how to represent authorization identities on file systems. All file access decisions constitute "authorization" and are made by servers using information about principals (such as username, group memberships, and so on) and file metadata related to authorization, such as a file's access control list (ACL). NFSv4 servers therefore must perform two kinds of mappings: Between the authentication identity and the authorization context (a principal's user ID, group memberships, etcetera) Between the on-the-wire authorization identity representation and the on-disk authorization identity representation. Many aspects of these mappings are entirely implementation specific, but some require multi-domain capable name resolution and security services. In order to inter operate in a multi-domain NFSv4 FedFS servers must use such services in compatible ways.

NFSv4 uses a syntax of the form "name@dns_domain" as the on wire representation of the "who" field of an NFSv4 access control entry (ACE) for users and groups. This design provides a level of indirection that allows a client and server with different internal representations of authorization identity to inter operate even when referring to authorization identities from different administrative domains. Multi-domain capable sites need to meet the following requirements in order to ensure that clients and servers can map name@dns_domain to internal representations reliably: The dns_domain portion of name@dns_domain MUST be unique within the FedFS NFSv4 multi-domain namespace. [ANDROS: IANA help here?] See section 5.9 "Interpreting owner and owner_group", for a discussion on dns_domain configuration. The name portion of name@dns_domain MUST be unique within the specified dns_domain. Every local representation of a user and of a group MUST have a canonical name@dns_domain, and it must be possible to return the canonical name@dns_domain for any identity stored on disk, at least when required infrastructure servers (such as name services) are online.

As described in section 2.2.1.1 "RPC Security Flavors": NFSv4.1 clients and servers MUST implement RPCSEC_GSS. (This requirement to implement is not a requirement to use.) Other flavors, such as AUTH_NONE, and AUTH_SYS, MAY be implemented as well. The underlying RPCSEC_GSS security service used in a multi-domain NFSv4 FedFS is REQUIRED to employ a method of cross domain trust so that a principal from a security service in one domain can be authenticated in another domain that uses the same security service. Kerberos, and PKU2U are examples of such security services. The AUTH_NONE security flavor can be useful in a multi-domain NFSv4 FedFS to grant universal access to public data without any credentials. The AUTH_SYS security flavor uses a host-based authentication model where the weakly authenticated host (the NFS client) asserts the user's authorization identities using small integers, uidNumber and gidNumber , as user and group identity representations. Because this authorization ID representation has no DNS domain component, AUTH_SYS can only be used in a name space where all clients and servers share an name service. A shared name service is required because uidNumbers and gidNumbers are passed in the RPC credential; there is no negotiation of namespace in AUTH_SYS. Collisions can occur if multiple name services are used. A new version of RPCSEC_GSS includes a modernized replacement for AUTH_SYS which addresses this issue.

In order to authorize client principal access to files, the NFS server must map the RPCSEC_GSS client principal name or the underlying GSS-API security context to authorization information meaningful to the file system being exported.

Here we list the authorization information that a multi-domain FedFS NFSv4 server needs in order to make a file access decision. Note that the server may need to map the global IDs to a local representation. UserID: This field contains the principal's global ID and the name@dns_domain form thereof. PrimaryGroupID: This field contains the global ID for the principal's primary group, and the name@dns_domain form thereof. Groups: This field contains an array of global ID for the groups that the principal is a member of, and the name@dns_domain forms thereof. Optional field(s) for privileges, authorizations, implementation-specific items, etcetera, relevant to authorization.

In the cross-domain case where a client principal is seeking access to files on a server in a different NFSv4 domain, the NFS server needs to obtain, in a secure manner, the authorization information from an authoritative source: e.g. a name service in the client principals NFS domain. There are several methods the cross-domain authoritative authorization information can be obtained: A mechanism specific GSS-API authorization payload containing credential authorization data. An NFS server local domain name query when there is a security agreement between the two cross-domain name services plus regular update data feeds so that the NFS server local domain name service is authoritative for the client principal domain. A direct query from the NFS server to the client principal authoritative name service. The authorization data information SHOULD be obtained via the GSS-API name attribute interface either via a single attribute for the credential authorization data or via discrete GSS-API name attributes corresponding to the authorization data elements. Note that the retrieval of attribute values used by the GSS-API name attribute interface implementation could utilize any of the above mentioned methods of obtaining the authorization information.

Authorization context information can sometimes be obtained from the credentials authenticating a principal; the GSS-API represents such information as attributes of the initiator principal name. For example: Kerberos 5 has a method for conveying "authorization data", both client-asserted as well as KDC-authenticated authorization data. Some KDC implementation, notably Windows KDCs, use this feature to convey a "privilege attribute certificate" listing the principal's user and group global IDs as "security identifiers" (SIDs). Some KDCs (will) issue Kerberos Tickets with the General PAD as authorization data. The General PAD authorization data MUST be authenticated in the sense that its contents must come from an authenticated, trusted source, such as a name server or the issuer of the client principal's credential. The General PAD lists user and group global IDs as "universal user identifiers" (UUIDs) as well as their string representations and DNS domains. PKIX certificates allow for extensions that could be used similarly. When a client principal is authenticated using a GSS-API authorization payload, the server SHOULD extract the payload from the client's ticket and map, if need be, the global IDs to local ID representations. The authorization context information in a GSS-API authorization payload can be considered a single, authenticated, discrete GSS-API name attribute, in which case the server must parse it into its individual elements.

If a GSS-API authorization payload for the client principal is not available, then the server SHOULD try to map the client principal name to a local notion of user account, and then lookup that user account's authorization context information through authenticated name service lookups. Authoritative name service queries may also be necessary to construct the name@dns_domain form of a global ID obtained from a GSS-API authorization payload.

Some considerations to come