0

I am trying to connect a Linux machine to a new IBM GPFS-based storage via NFS4. The Linux machine uses an LDAP server and the IBM storage uses another ActiveDirectory. For now, we are in a test net, there is no Kerberos yet and no_root_squash is enabled. Changing this is of course planned before productivity.

As root, I can use nfs4_*facl to edit permissions, and they show up and seem to work on Windows CIFS clients that are connected to the Active Directory.

What does not work is the user mapping. This is what I get from grep idmap syslog:

Jul 18 14:49:54 bbo3083 nfsidmap[19620]: key: 0x236cf574 type: gid value: AD01\mygroup@localdomain timeout 600
Jul 18 14:56:20 bbo3083 nfsidmap[20977]: key: 0x1a0a5a1 type: uid value: AD01\myuser@localdomain timeout 600
Jul 18 14:56:20 bbo3083 nfsidmap[20977]: nss_getpwnam: name 'AD01\myuser@localdomain' does not map into domain 'mylinux.example.org'
Jul 18 14:59:46 bbo3083 nfsidmap[21738]: key: 0x1628ad74 type: uid value: nfsnobody@localdomain timeout 600
Jul 18 14:59:46 bbo3083 nfsidmap[21738]: nss_getpwnam: name 'nfsnobody@localdomain' does not map into domain 'mylinux.example.org'
Jul 18 14:59:46 bbo3083 nfsidmap[21739]: key: 0x209ae6ba type: uid value: root@localdomain timeout 600
Jul 18 14:59:46 bbo3083 nfsidmap[21739]: nss_getpwnam: name 'root@localdomain' does not map into domain 'mylinux.example.org'
Jul 18 14:59:46 bbo3083 nfsidmap[21740]: key: 0x35a81492 type: gid value: AD01\mygroup-data@localdomain timeout 600
Jul 18 14:59:46 bbo3083 nfsidmap[21741]: key: 0x20a64e16 type: gid value: AD01\mygroup-students@localdomain timeout 600
Jul 18 14:59:46 bbo3083 nfsidmap[21742]: key: 0xb474b26 type: gid value: root@localdomain timeout 600
Jul 18 15:00:06 bbo3083 nfsidmap[21835]: key: 0x3a1d5bea type: gid value: AD01\mygroup@localdomain timeout 600
Jul 18 15:07:49 bbo3083 nfsidmap[23556]: key: 0x249efef6 type: uid value: AD01\myuser@localdomain timeout 600
Jul 18 15:07:49 bbo3083 nfsidmap[23556]: nss_getpwnam: name 'AD01\myuser@localdomain' does not map into domain 'mylinux.example.org'

myuser does exist on the LDAP, but 'AD01\myuser' does not, of course, because AD01 is the ActiveDirectory. Note that AD01\myuser@localdomain is what I get from the storage, while mylinux.example.org is the idmap domain of my Linux machine.

Any approaches how to solve this?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.