From 819f7209cf3990bfe718a0ad4b4e49d780b0479c Mon Sep 17 00:00:00 2001 From: GNU Hurd wiki engine Date: Thu, 23 Aug 2007 09:21:32 +0000 Subject: web commit by NealWalfield: Create. --- hurd/authentication.mdwn | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) create mode 100644 hurd/authentication.mdwn (limited to 'hurd') diff --git a/hurd/authentication.mdwn b/hurd/authentication.mdwn new file mode 100644 index 00000000..0d52a0ba --- /dev/null +++ b/hurd/authentication.mdwn @@ -0,0 +1,17 @@ +UIDs on the Hurd are separate from processes. A process has +[[capabilities]] designating so-called UID vectors that +are implemented by an [[auth]] server. This +makes them easily [[virtualizable]]. + +When a process wishes to gain access to a resource provided by a third +party (e.g., a file system) and that party wishes to authenticate the client +so as to implement some identity-based access control ([[IBAC]]) policy, +the latter initiates a three-way authentication handshake. The server +and client each then begin an authentication sequence with +their respective [[trust]]ed auth servers. If they have +a mutally trusted ancestor and an auth server does not abort the +transaction, then the client is delivered a new capability +naming a newly authenticated session with the server +and the server is delivered the client's designated UID vector. + +For more details, see section 2.3 of the [[HurdCritique]]. -- cgit v1.2.3