<font size=2 face="sans-serif">Thanks for the responses, using iptrace
on AIX I was able to confirm that indeed the following is passed and cannot
be matched by the AIX NFSV4 client. </font>
<br><font size=2 face="sans-serif">SPECTRUMSCALE\testuser1@virtual1.com
. This is in the response packet sent back from the CES server to
the AIX NFSV4 client.</font>
<br>
<br><font size=2 face="sans-serif">Sent by Spectrum CES SPECTRUMSCALE\testuser1@virtual1.com</font>
<br><font size=2 face="sans-serif">Expected by AIX NFSV4 testuser1@virtual1.com</font>
<br><font size=2 face="sans-serif">!!!!!!!! NO MATCH !!!!!!!</font>
<br>
<br><font size=2 face="sans-serif">00000200 00000180 00000001
00000024 53504543 |...........$SPEC|</font>
<br><font size=2 face="sans-serif">00000210 5452554d 5343414c
455c7465 73747573 |TRUMSCALE\testus|</font>
<br><font size=2 face="sans-serif">00000220 65723140 76697274
75616c31 2e636f6d |er1@virtual1.com|</font>
<br><font size=2 face="sans-serif">00000230 0000001f 53504543
5452554d 5343414c |....SPECTRUMSCAL|</font>
<br><font size=2 face="sans-serif">00000240 455c7465 73744076
69727475 616c312e |E\test@virtual1.|</font>
<br><font size=2 face="sans-serif">00000250 636f6d00 00000000
00000000 00000000 |com.............|</font>
<br>
<br><font size=2 face="sans-serif">Out of interest I setup an AIX 7.1 NFSV4
Server and AIX 7.1 NFSV4 client both authenticating against the AD
LDAP. This worked</font>
<br><font size=2 face="sans-serif">fine. I suspect this is because
the AIX LDAP (Posix) does attribute mapping so we only see the UID not
DOMAIN\uid ..</font>
<br>
<br><font size=2 face="sans-serif">vi /etc/security/ldap/ldap.cfg</font>
<br><font size=2 face="sans-serif"><extract></font>
<br><font size=2 face="sans-serif"># AIX-LDAP attribute map path.</font>
<br><font size=2 face="sans-serif">userattrmappath:/etc/security/ldap/sfur2user.map</font>
<br><font size=2 face="sans-serif">groupattrmappath:/etc/security/ldap/sfur2group.map</font>
<br>
<br><font size=2 face="sans-serif"># grep -i uid sfur2user.map
</font>
<br><font size=2 face="sans-serif">username SEC_CHAR
uid
s na yes</font>
<br><font size=2 face="sans-serif">id
SEC_INT uidNumber
s na
yes</font>
<br>
<br><font size=2 face="sans-serif">I wonder if Solaris 10/11 and HP-UX
11 are also not supported using NFSv4. Does anyone know if the SpectrumScale
CES (NFS/SMB) has a supported</font>
<br><font size=2 face="sans-serif">operating systems list published. I
checked here but nothing found.</font>
<br>
<br><a href=http://www.ibm.com/support/knowledgecenter/STXKQY_4.2.1/com.ibm.spectrum.scale.v4r21.doc/bl1adm_authenticationlimitations.htm><font size=2 color=blue face="sans-serif">http://www.ibm.com/support/knowledgecenter/STXKQY_4.2.1/com.ibm.spectrum.scale.v4r21.doc/bl1adm_authenticationlimitations.htm</font></a>
<br>
<br><font size=2 face="sans-serif"># Going Forward</font>
<br>
<br><font size=2 face="sans-serif">Initially we want to provide only NFS
and SMB CesNode services. So we based our decision to use AD + RFC2307
</font>
<br><font size=2 face="sans-serif">based on this table, believing that
it would provide what we need today and future proof us a little by potentially
allowing</font>
<br><font size=2 face="sans-serif">expansion to OBJ in the future.
</font>
<br>
<br><a href=http://www.ibm.com/support/knowledgecenter/STXKQY_4.2.1/com.ibm.spectrum.scale.v4r21.doc/bl1ins_authconcept.htm><font size=2 color=blue face="sans-serif">http://www.ibm.com/support/knowledgecenter/STXKQY_4.2.1/com.ibm.spectrum.scale.v4r21.doc/bl1ins_authconcept.htm</font></a>
<br>
<br><font size=2 face="sans-serif">NFSv4 is pretty mandatory in our design,
we want to get rid of using Netgroup's and NFS V3 UID/GID mapping which
as weak security.</font>
<br><font size=2 face="sans-serif">Ideally on day one we would want NFSV4
and Kerberos to provide better security for our clients. Its also
likely that in the future corporate</font>
<br><font size=2 face="sans-serif">security policies may ban netgroup's
for NFS authorization so using NFSv4 + kerberos would position my department
well for future changes.</font>
<br>
<br><font size=2 face="sans-serif">Based on the table I guess I need to
setup LDAP / TLS / Kerberos as the authentication service which will cover
all bases expect OBJECT.</font>
<br>
<br><font size=2 face="sans-serif">Thanks again for everyone's comments,
this was my first post and the responses were all very welcome.</font>
<br>
<br><font size=2 face="sans-serif">Rgds Andy</font>
<br>
<br>
<table width=821 style="border-collapse:collapse;">
<tr height=8>
<td width=489 bgcolor=#616161 style="border-style:none none none none;border-color:#000000;border-width:0px 0px 0px 0px;padding:0px 0px;"><font size=3 color=white> </font><font size=3 color=white face="Verdana"><b>Andy
Parker</b></font>
<td width=332 colspan=2 bgcolor=#616161 style="border-style:none none none none;border-color:#000000;border-width:0px 0px 0px 0px;padding:0px 0px;">
<div align=right><font size=3 color=white face="Verdana"><b>Cloud &
Development Platforms (C&DP)</b></font><a href=http://it.hursley.ibm.com/><font size=3 color=white><u>
</u></font></a></div>
<tr valign=top height=8>
<td width=489 style="border-style:none none none none;border-color:#000000;border-width:0px 0px 0px 0px;padding:0px 0px;">
<br><font size=1><br>
</font>
<table width=491 style="border-collapse:collapse;">
<tr height=8>
<td width=491 style="border-style:none none none none;border-color:#000000;border-width:0px 0px 0px 0px;padding:0px 0px;"><a href=mailto:Andy_parker1@uk.ibm.com><font size=2 color=blue face="Verdana"><u>Andy_Parker1@uk.ibm.com</u></font></a><font size=2 color=#5f5f5f face="Verdana"><br>
Desk: </font><a href="http://maps.hursley.ibm.com/showmap.html?q=Andy+Parker"><font size=2 color=blue face="Verdana"><u>DW1B14</u></font></a><font size=2 color=#5f5f5f face="Verdana">
</font><font size=3><br>
</font></table>
<br>
<p><font size=3><br>
</font>
<td width=147 style="border-style:none none none none;border-color:#000000;border-width:0px 0px 0px 0px;padding:0px 0px;"><font size=2 color=#5f5f5f face="Verdana">Tel:
37-245326 (01962-815326)</font>
<td width=185 style="border-style:none none none none;border-color:#000000;border-width:0px 0px 0px 0px;padding:0px 0px;"><font size=2 color=#5f5f5f face="Verdana">Post:
MP100, IBM Hursley Park, Winchester, SO21 2JN</font></table>
<br>
<p><font size=3><br>
</font>
<br>
<br>
<br>
<br><font size=1 color=#5f5f5f face="sans-serif">From:
</font><font size=1 face="sans-serif">"Chetan R Kulkarni"
<chetkulk@in.ibm.com></font>
<br><font size=1 color=#5f5f5f face="sans-serif">To:
</font><font size=1 face="sans-serif">gpfsug-discuss@spectrumscale.org</font>
<br><font size=1 color=#5f5f5f face="sans-serif">Date:
</font><font size=1 face="sans-serif">15/11/2016 06:01</font>
<br><font size=1 color=#5f5f5f face="sans-serif">Subject:
</font><font size=1 face="sans-serif">[gpfsug-discuss]
SS 4.2.1 + CES NFS / SMB</font>
<br><font size=1 color=#5f5f5f face="sans-serif">Sent by:
</font><font size=1 face="sans-serif">gpfsug-discuss-bounces@spectrumscale.org</font>
<br>
<hr noshade>
<br>
<br>
<br><tt><font size=3>>> Summary / Question:<br>
>> Can anybody explain why I do not see userID / Group names when
viewing <br>
>> via a NFS4 client and ideally how to fix this.</font></tt><font size=3><br>
<br>
This is not supported by Spectrum Scale (i.e. NFSv4 mount/access on AIX
clients with AD+RFC2307 file authentication). <br>
<br>
Reason being AIX client integrates with AD like LDAP i.e. AIX client can't
resolve the user in format "DOMAIN\user".<br>
NFSv4 server returns user in "DOMAIN\user" format and as AIX
client doesn't understand "DOMAIN\user"; it translates to "nobody".
Hence you see "nobody" under AIX NFSv4 mount.<br>
<br>
Please note that; with RHEL clients we see correct ownership under NFSv4
mounts. This is because RHEL clients integrate with AD as pure AD client
(using winbind or SSSD) i.e. users resolve successfully in "DOMAIN\user"
format on RHEL clients.<br>
<br>
Thanks,<br>
Chetan.</font><tt><font size=2>_______________________________________________<br>
gpfsug-discuss mailing list<br>
gpfsug-discuss at spectrumscale.org<br>
</font></tt><a href="http://gpfsug.org/mailman/listinfo/gpfsug-discuss"><tt><font size=2>http://gpfsug.org/mailman/listinfo/gpfsug-discuss</font></tt></a><tt><font size=2><br>
</font></tt>
<br>
<br><font size=2 face="sans-serif"><br>
Unless stated otherwise above:<br>
IBM United Kingdom Limited - Registered in England and Wales with number
741598. <br>
Registered office: PO Box 41, North Harbour, Portsmouth, Hampshire PO6
3AU<br>
</font>