From: Haynes, Tom (thomas@netapp.com)
Date: 12/16/04-04:23:48 PM Z
From: "Haynes, Tom" <thomas@netapp.com> Message-Id: <200412162223.iBGMNnd26907@orbit-fe.eng.netapp.com> Date: Thu, 16 Dec 2004 14:23:48 -0800 (PST) Subject: [nfsv4] Why can't SECINFO return NFS4ERR_WRONGSEC? DESCRIPTION The SECINFO operation is used by the client to obtain a list of valid RPC authentication flavors for a specific directory filehandle, file name pair. SECINFO should apply the same access methodology used for LOOKUP when evaluating the name. Therefore, if the requester does not have the appropriate access to LOOKUP the name then SECINFO must behave the same way and return NFS4ERR_ACCESS. If a client sends a SECINFO request for a file handle and the underlying security flavor for the request does not meet the exported flavors, then the only option is to return NFS4ERR_ACCESS instead of NFS4ERR_WRONGSEC. But, this is incomplete information. The issue wasn't that the client could not get access, just that we could not determine it with the current flavor. Or do client implementations, when they get NFS4ERR_ACCESS on SECINFO, then start trying other underlying security flavors? A forgiving server could say, ahh, what the hey, here is the SECINFO. But, I take *must* as saying the server can not be forgiving. -- Tom Haynes, ex-cfb thomas@netapp.com _______________________________________________ nfsv4 mailing list nfsv4@ietf.org https://www1.ietf.org/mailman/listinfo/nfsv4
This archive was generated by hypermail 2.1.2 : 03/04/05-02:13:48 AM Z CST