search

gssapi / gssproxy

A proxy for GSSAPI | Docs at https://github.com/gssapi/gssproxy/tree/main/docs
Other
44 stars 28 forks source link

Change nfs-client to network-fs-clients #37

Closed jacobshivers closed 3 years ago

jacobshivers commented 3 years ago

Proposed patches for cifs.upcall extending the binary to leverage gssapi have been slated for inclusion into cifs-utils. A drop file for gssproxy is needed to go along with the patch. The drop file is a near match for nfs-client with the difference in the "program" option. Both cifs-client and nfs-client can use the same default socket, but the configuration files need to be distinguished otherwise gssproxy will not start.

Proposing "cifs-client" drop file to go along with patches and modifying the existing "nfs-client" drop file so that it can continue to work.

Link for cifs.upcall patch as discussed above: https://github.com/piastry/cifs-utils/commit/3d681bb5c140376ccc19e48711231aeef1e87aa9

simo5 commented 3 years ago

@jacobshivers Is there any difference between configuration files other than the program option ?

jacobshivers commented 3 years ago

@simo5 No, there are no other differences for nfs-client than adding the program option. cifs-client is a near copy of nfs-client, but with a different program. This avoids having to maintain a separate socket for cifs-client, which while possible is not necessary.

simo5 commented 3 years ago

Then why not simply rename the file to network-fs-clients.conf and use the same file for both cifs and nfs? It is quite likely that the default case is to have the same config for both. We can add documentation to show how to manually differentiate in the odd case someone want to actually have different options between the two?

jacobshivers commented 3 years ago

That works for me. I defaulted to having them distinct, but like you mentioned, having appropriate documentation can assist those who either choose to have different requirements for different remote filesystems or want the separation for tracking purposes in gssproxy logs.

simo5 commented 3 years ago

Ok, can you change this PR in that direction ?

I think doc can either be a change of dcos/NFS.md or a separate document for the general idea which has a section specific to NFS vs CIFS

Doesn't need to be a lot of words, just a few sentences of: "do you need diff behavior for nfs v cifs? Remove network-fs-clients.conf and replace withe these two files" (list them with the program config option) and "then customize them at will"

jacobshivers commented 3 years ago

Yes, I will change the direction and add some suggested doc changes.

jacobshivers commented 3 years ago

Added the changes for 99-nfs-client.conf to 99-network-fs-clients.conf and created a small md file describing how to have differentiated access for client side NFS and SMB. The only other thing I added to the new doc is a small blurb about Resource Based Constrained Delegation as some users may use that in their environment. Simply noted that as RBCD is a server side change, there are no additional steps required for gssproxy to use RBCD over CD.

simo5 commented 3 years ago

LGTM, can you squash all commits and add Sign-by line? (git commit -s)

simo5 commented 3 years ago

@jacobshivers CI is not happy, seem like you missed to change Makefile.am, and you should probably also fix contrib/gssproxy.spec.in

jacobshivers commented 3 years ago

I'll make those fixes

jacobshivers commented 3 years ago

Made the requested fixes. I did not modify the line after %changelog in contrib/gssproxy.spec.in as I did not think I that was intended for me.

jacobshivers commented 3 years ago

Squashed everything into one commit as it makes more sense to keep everything together.

simo5 commented 3 years ago

LGTM