I manage users using an OpenLDAP server. I now want to connect a NAS as the main file server using NFSv4. The NAS allows me to import LDAP users and groups, but it maps them to email@example.com. So I must somehow explain NFS4 that user here is firstname.lastname@example.org there. I believe that this is the task of idmapd, but reading the man pages and several howtos, I couldn't figure out how to actually do it.
Any pointer to useful practical examples is welcome.
Update: Having found a pointer to increase debugging vebosity:
sysctl -w sunrpc.nfs_debug=1023 I figured out that idmapd tried to resolve email@example.com@fqdn. Setting the domain parameter accordingly, resolves the right users. Obviously
rpc.idmapd caches results even across restarts, which makes troubleshooting tedious.
So I think I've resolved the first issue. The next are
- Mapping of exceptions: root is not on the LDAP and the group users also exists locally on the NAS, so these still map to nobody or nogroup
- Finding an effective way to clear the cache. On the net I found claims about
nfsidmap -cto do the job, but this results in an error telling that the
id_resolverkeyring was not found. Also, I did stop
Any pointer especially for the second item would be valuable.