On 14 Feb 2013, at 23:10, Andrew Deason <[email protected]> wrote:
> My thinking was that servers with the cell-wide key would just > use afs-rxgk@_afs.cell, and servers that don't have the cell-wide key > would use afs3-bos@host. The client would try with afs3-bos@host, but if > that doesn't exist (or the connection negotiation fails), we would retry > assuming that we can use afs-rxgk@_afs.cell. That's a problem? There's two issues here. Firstly, only machines hosting vlservers have access to the key material necessary to accept GSSNegotiate calls for afs-rxgk@_afs.cell. Machines with the rxgk cell-wide key can accept rxgk challenges using cell-wide tokens, but the failure mode here is such that I don't think you'd want to base a key negotiation on it. Secondly, in situations where bos is managing servers for multiple cells, how do you decide which afs-rxgk@_afs.cell to use? S._______________________________________________ AFS3-standardization mailing list [email protected] http://lists.openafs.org/mailman/listinfo/afs3-standardization
