[OpenAFS] Re: Any budding documentation writers

[Russ Allbery]

Simon Wilkinson <sxw@inf.ed.ac.uk> writes:

> Because rxgk doesn't care what GSSAPI mechanism is being used to get the
> initial credentials. The tools that AFS provides assume that a set of
> credentials are available (from Kerberos, from GSI, from a local smart
> card ...), and simply does GSSAPI calls from then on.

> Building specific Kerberos knowledge into rxgk is a non-goal - one of
> the primary aims of rxgk is to build an rx security layer which is
> mechanism independent.

Hm, at first glance this seems like a bad choice to me.

In practice, at least 95% of our users are going to be using Kerberos.
Making the common case go more smoothly is a good idea, and that includes
at least documenting things like how you make aklog use a different ticket
cache and possibly some Kerberos-specific glue if anything like the
allow_weak_crypto case comes up down the road.  I think it's also fairly
important to support the historic klog interface, at least in the near
term and for the common case, to avoid confusing users who are used to it,
so one of the first things I'd do in that world is write klog.krb5 for
rxgk and then ask for it to be included in the distribution.

I'm all in favor of the core code being mechanism-agnostic, but I don't
think we should extend that line to all of the userspace tools when we
know what mechanisms many of our users will be using and can make their
lives easier and the transition less abrupt.

-- 
Russ Allbery (rra@stanford.edu)             <http://www.eyrie.org/~eagle/>