> The single central auth server approach uses the > outside.plan9.bell-labs.com auth server allowing anyone who has > a sources account (I.E. anyone who wants to), to attach to grid nodes
Yes. But that's not the problem both multi authdom proposals are trying to solve, I guess. If you don't like the way sources accounts are distributed (I.E. anyone who wants to), you can choose not to trust the sources auth server and use others instead, like 9grid.de and/or tip9ug. Both proposals are allowing you which authdom you trust or not. Also, both proposals solved the username crash between multiple authdoms. Oh wait, what's the difference between the two proposals, btw? > and run arbitary software, and read any world readable files > on any node. These are next hurdles I would like to jump over. How about constructing the namespace of a grid user only from /mnt/term/* ? > how can an adminstrator on one side of the world trust an unknwon > user on the other side? Maybe he can't confidently trust unknown users in an authdom on the other side of the world, but he may trust the admin of the authdom reasonably. I think this is the heart of grid's authentication in general. > Unfortunately in the current implementation, exchanges between the auth > servers rely on DNS for mutual authentication. I'm sorry. I'm left behind here. Which parts of the current implementation rely on DNS for mutual authentication? > Next we need some way to stop grid users hogging too much of a nodes > cpu capacity, network bandwidth, disk space, and to stop them posting spam > or organising DDoS attacks... I wonder how globus is managing these issues... --
