Whamcloud - gitweb
LU-17930 gss: node principal expectations 92/55392/4
authorSebastien Buisson <sbuisson@ddn.com>
Tue, 11 Jun 2024 10:40:26 +0000 (12:40 +0200)
committerOleg Drokin <green@whamcloud.com>
Tue, 25 Jun 2024 03:31:51 +0000 (03:31 +0000)
commitd83be78be789f1d0b04301cd088fb30deeed9b0a
tree03ccb986473f23991b0ea4adfbaa2b40a539aa25
parentfc00b7e3d1bbb6ad390c5d69a73353cb7b61960a
LU-17930 gss: node principal expectations

When a credentials cache exists for Kerberos, lgss_keyring looks into
it to find a valid entry. The cache's principal must match the
expected role for the GSS request being processed:
- LGSS_ROOT_CRED_MDT: expect "lustre_mds" principal;
- LGSS_ROOT_CRED_OST: expect "lustre_oss" principal;
- LGSS_ROOT_CRED_ROOT: expect "lustre_root" or "host" principal.
And there is the special case of the GSS request on the MGC, for which
by convention all 3 roles are applied at the same time.

Test-Parameters: trivial
Test-Parameters: kerberos=true testlist=sanity-krb5
Signed-off-by: Sebastien Buisson <sbuisson@ddn.com>
Change-Id: I4c46b03bb012c5f56bd26efdfaa6dab5fc7de31a
Reviewed-on: https://review.whamcloud.com/c/fs/lustre-release/+/55392
Tested-by: jenkins <devops@whamcloud.com>
Tested-by: Maloo <maloo@whamcloud.com>
Reviewed-by: Andreas Dilger <adilger@whamcloud.com>
Reviewed-by: Aurelien Degremont <adegremont@nvidia.com>
Reviewed-by: Oleg Drokin <green@whamcloud.com>
lustre/utils/gss/lgss_krb5_utils.c