<font size=2 face="sans-serif">>>Currently I am looking to reconfigure
and address the AD server's LDAP and Kerberos components natively
and so hopefully remove the need</font><font size=3> </font><font size=2 face="sans-serif"><br>
>>for 'SSSD'. So we plan to configure using mmuserauth -type
LDAP and provide all the required parameters in steady of -type AD. </font><font size=3>
</font><font size=2 face="sans-serif"><br>
>>Not 100% sure this will work, but this is what we are about to
try.</font><font size=3> </font>
<br>
<br><font size=2 face="sans-serif">Just to report back, you cannot
just use --type ldap and point it at the AD ldap server (389 / 636).
Its fails because mmuserauth expects the</font>
<br><font size=2 face="sans-serif">Samba schema and other pre-reqs to be
in place. We do not wish to mess to much with our AD schema so we
will drop this approach.</font>
<br>
<br><font size=2 face="sans-serif">Summary:</font>
<br><font size=2 face="sans-serif">Looks like we have the following options
on our 'SS' CES nodes with AD RFC2307 in place:</font>
<br><font size=2 face="sans-serif">SMB to all windows clients</font>
<br><font size=2 face="sans-serif">NFS3 access to all RFC2307 clients</font>
<br><font size=2 face="sans-serif">NFS4 access to Linux clients only</font>
<br>
<br><font size=2 face="sans-serif">Using the OpenLDAP / MIT Kerberos Servers
approach would create to much of an over head for our team to manage 1000's
of users. Using AD pretty much looks after</font>
<br><font size=2 face="sans-serif">this for us today and we have tooling
in place namely IBM's Identity Manager to automate the user management.
Our only change needed on the AD </font>
<br><font size=2 face="sans-serif">was to enable UNIX Services RFC2307
to allow the ID-MAPPING.</font>
<br>
<br><font size=2 face="sans-serif">Rgds AndyP</font>
<br>
<br>
<table width=821 style="border-collapse:collapse;">
<tr height=8>
<td width=489 bgcolor=#616161 style="border-style:none none none none;border-color:#000000;border-width:0px 0px 0px 0px;padding:0px 0px;"><font size=3 color=white> </font><font size=3 color=white face="Verdana"><b>Andy
Parker</b></font>
<td width=332 colspan=2 bgcolor=#616161 style="border-style:none none none none;border-color:#000000;border-width:0px 0px 0px 0px;padding:0px 0px;">
<div align=right><font size=3 color=white face="Verdana"><b>Cloud &
Development Platforms (C&DP)</b></font><a href=http://it.hursley.ibm.com/><font size=3 color=white><u>
</u></font></a></div>
<tr valign=top height=8>
<td width=489 style="border-style:none none none none;border-color:#000000;border-width:0px 0px 0px 0px;padding:0px 0px;">
<br><font size=1><br>
</font>
<table width=491 style="border-collapse:collapse;">
<tr height=8>
<td width=491 style="border-style:none none none none;border-color:#000000;border-width:0px 0px 0px 0px;padding:0px 0px;"><a href=mailto:Andy_parker1@uk.ibm.com><font size=2 color=blue face="Verdana"><u>Andy_Parker1@uk.ibm.com</u></font></a><font size=2 color=#5f5f5f face="Verdana"><br>
Desk: </font><a href="http://maps.hursley.ibm.com/showmap.html?q=Andy+Parker"><font size=2 color=blue face="Verdana"><u>DW1B14</u></font></a><font size=2 color=#5f5f5f face="Verdana">
</font><font size=3><br>
</font></table>
<br>
<p><font size=3><br>
</font>
<td width=147 style="border-style:none none none none;border-color:#000000;border-width:0px 0px 0px 0px;padding:0px 0px;"><font size=2 color=#5f5f5f face="Verdana">Tel:
37-245326 (01962-815326)</font>
<td width=185 style="border-style:none none none none;border-color:#000000;border-width:0px 0px 0px 0px;padding:0px 0px;"><font size=2 color=#5f5f5f face="Verdana">Post:
MP100, IBM Hursley Park, Winchester, SO21 2JN</font></table>
<br>
<p><font size=3><br>
</font>
<br>
<br>
<br>
<br><font size=1 color=#5f5f5f face="sans-serif">From:
</font><font size=1 face="sans-serif">Andy Parker1/UK/IBM@IBMGB</font>
<br><font size=1 color=#5f5f5f face="sans-serif">To:
</font><font size=1 face="sans-serif">gpfsug main discussion
list <gpfsug-discuss@spectrumscale.org></font>
<br><font size=1 color=#5f5f5f face="sans-serif">Cc:
</font><font size=1 face="sans-serif">Jo Woods/UK/IBM@IBMGB</font>
<br><font size=1 color=#5f5f5f face="sans-serif">Date:
</font><font size=1 face="sans-serif">17/11/2016 11:57</font>
<br><font size=1 color=#5f5f5f face="sans-serif">Subject:
</font><font size=1 face="sans-serif">Re: [gpfsug-discuss]
SS 4.2.1 + CES NFS / SMB</font>
<br><font size=1 color=#5f5f5f face="sans-serif">Sent by:
</font><font size=1 face="sans-serif">gpfsug-discuss-bounces@spectrumscale.org</font>
<br>
<hr noshade>
<br>
<br>
<br><font size=2 face="sans-serif">>>S Scale CES side RHEL and SLES
are supported as of date. </font><font size=3><br>
</font><font size=2 face="sans-serif"><br>
Thanks for the update, the SLES & RHEL are the supported platforms
for the SES Servers agreed. </font><font size=3><br>
</font><font size=2 face="sans-serif"><br>
My question was possibly not fair / clear, I was trying to establish
what NFS clients are supported to connect to the CES devices.</font><font size=3>
<br>
</font><font size=2 face="sans-serif"><br>
I configured 'SS' with mmuserauth for AD and RFC2307 support, making
a dangerous assumption that the RFC2307 would mean</font><font size=3>
</font><font size=2 face="sans-serif"><br>
I would be able to use any RFC2307 compliant client NFS for NFS V3
& V4.</font><font size=3> <br>
</font><font size=2 face="sans-serif"><br>
This was true for NFS V3 and we connected AIX & Linux with
no issues. However our aim is to remove NFSv3 and provide
only</font><font size=3> </font><font size=2 face="sans-serif"><br>
NFSv4 + kerberos support. With NFS V4 only Linux clients worked
OK due to the use of 'SSSD'. So we are broken for NFSV4 in</font><font size=3>
</font><font size=2 face="sans-serif"><br>
our diverse environment ( AIX*, SOLARIS*, HPUX*) for the ID
mapping at NFSV4 becomes broken.</font><font size=3> <br>
</font><font size=2 face="sans-serif"><br>
Currently I am looking to reconfigure and address the AD server's LDAP
and Kerberos components natively and so hopefully remove the need</font><font size=3>
</font><font size=2 face="sans-serif"><br>
for 'SSSD'. So we plan to configure using mmuserauth -type LDAP and
provide all the required parameters in steady of -type AD. </font><font size=3>
</font><font size=2 face="sans-serif"><br>
Not 100% sure this will work, but this is what we are about to try.</font><font size=3>
<br>
</font><font size=2 face="sans-serif"><br>
Rgds Andy</font><font size=3> <br>
<br>
<br>
</font>
<table width=826 style="border-collapse:collapse;">
<tr height=8>
<td width=490 bgcolor=#616161 style="border-style:none none none none;border-color:#000000;border-width:0px 0px 0px 0px;padding:1px 1px;"><font size=3 color=white> </font><font size=3 color=white face="Verdana"><b>Andy
Parker</b></font><font size=3> </font>
<td width=331 colspan=2 bgcolor=#616161 style="border-style:none none none none;border-color:#000000;border-width:0px 0px 0px 0px;padding:1px 1px;">
<div align=right><font size=3 color=white face="Verdana"><b>Cloud &
Development Platforms (C&DP)</b></font><a href=http://it.hursley.ibm.com/><font size=3 color=white><u>
</u></font></a></div>
<tr valign=top height=8>
<td width=490 style="border-style:none none none none;border-color:#000000;border-width:0px 0px 0px 0px;padding:1px 1px;"><font size=1><br>
</font>
<br>
<table width=491 style="border-collapse:collapse;">
<tr height=8>
<td width=489 style="border-style:none none none none;border-color:#000000;border-width:0px 0px 0px 0px;padding:1px 1px;"><a href=mailto:Andy_parker1@uk.ibm.com><font size=2 color=blue face="Verdana"><u>Andy_Parker1@uk.ibm.com</u></font></a><font size=2 color=#5f5f5f face="Verdana"><br>
Desk: </font><a href="http://maps.hursley.ibm.com/showmap.html?q=Andy+Parker"><font size=2 color=blue face="Verdana"><u>DW1B14</u></font></a><font size=2 color=#5f5f5f face="Verdana">
</font></table>
<br>
<p>
<td width=145 style="border-style:none none none none;border-color:#000000;border-width:0px 0px 0px 0px;padding:1px 1px;"><font size=2 color=#5f5f5f face="Verdana">Tel:
37-245326 (01962-815326)</font><font size=3> </font>
<td width=183 style="border-style:none none none none;border-color:#000000;border-width:0px 0px 0px 0px;padding:1px 1px;"><font size=2 color=#5f5f5f face="Verdana">Post:
MP100, IBM Hursley Park, Winchester, SO21 2JN</font></table>
<br>
<p><font size=3><br>
<br>
<br>
<br>
</font><font size=1 color=#5f5f5f face="sans-serif"><br>
From: </font><font size=1 face="sans-serif">Ravi
K Komanduri/India/IBM</font><font size=3> </font><font size=1 color=#5f5f5f face="sans-serif"><br>
To: </font><font size=1 face="sans-serif">gpfsug
main discussion list <gpfsug-discuss@spectrumscale.org>, Andy Parker1
<andy_parker1@uk.ibm.com></font><font size=3> </font><font size=1 color=#5f5f5f face="sans-serif"><br>
Date: </font><font size=1 face="sans-serif">17/11/2016
11:20</font><font size=3> </font><font size=1 color=#5f5f5f face="sans-serif"><br>
Subject: </font><font size=1 face="sans-serif">Re:
[gpfsug-discuss] SS 4.2.1 + CES NFS / SMB</font><font size=3> <br>
</font>
<hr noshade><font size=3><br>
</font><font size=2 face="sans-serif"><br>
Andy </font><font size=3><br>
</font><font size=2 face="sans-serif"><br>
>> Does anyone know if the SpectrumScale CES (NFS/SMB) has a supported</font><font size=3>
</font><font size=2 face="sans-serif"><br>
operating systems list published. I checked here but nothing found.</font><font size=3>
<br>
</font><font size=2 face="sans-serif"><br>
S Scale CES side RHEL and SLES are supported as of date. </font><font size=3><br>
</font><font size=2 face="sans-serif"><br>
Refer to the S Scale FAQ link (</font><a href=http://www.ibm.com/support/knowledgecenter/STXKQY/ibmspectrumscale_welcome.html><font size=2 color=blue face="sans-serif"><u>http://www.ibm.com/support/knowledgecenter/STXKQY/ibmspectrumscale_welcome.html</u></font></a><font size=2 face="sans-serif">)</font><font size=3>
<br>
<br>
</font><font size=2 face="sans-serif"><br>
With Regards,<br>
Ravi K Komanduri</font><font size=3><br>
<br>
<br>
<br>
<br>
</font><font size=1 color=#5f5f5f face="sans-serif"><br>
From: </font><font size=1 face="sans-serif">Andy
Parker1 <andy_parker1@uk.ibm.com></font><font size=3> </font><font size=1 color=#5f5f5f face="sans-serif"><br>
To: </font><font size=1 face="sans-serif">gpfsug
main discussion list <gpfsug-discuss@spectrumscale.org></font><font size=3>
</font><font size=1 color=#5f5f5f face="sans-serif"><br>
Date: </font><font size=1 face="sans-serif">11/15/2016
09:05 PM</font><font size=3> </font><font size=1 color=#5f5f5f face="sans-serif"><br>
Subject: </font><font size=1 face="sans-serif">Re:
[gpfsug-discuss] SS 4.2.1 + CES NFS / SMB</font><font size=3> </font><font size=1 color=#5f5f5f face="sans-serif"><br>
Sent by: </font><font size=1 face="sans-serif">gpfsug-discuss-bounces@spectrumscale.org</font><font size=3>
<br>
</font>
<hr noshade><font size=3><br>
<br>
</font><font size=2 face="sans-serif"><br>
Thanks for the responses, using iptrace on AIX I was able to confirm
that indeed the following is passed and cannot be matched by the AIX NFSV4
client. </font><font size=3> </font><font size=2 face="sans-serif"><br>
SPECTRUMSCALE\testuser1@virtual1.com . This is in the response packet
sent back from the CES server to the AIX NFSV4 client.</font><font size=3>
</font><font size=2 face="sans-serif"><br>
<br>
Sent by Spectrum CES SPECTRUMSCALE\testuser1@virtual1.com</font><font size=3>
</font><font size=2 face="sans-serif"><br>
Expected by AIX NFSV4 testuser1@virtual1.com</font><font size=3>
</font><font size=2 face="sans-serif"><br>
!!!!!!!! NO MATCH !!!!!!!</font><font size=3> </font><font size=2 face="sans-serif"><br>
<br>
00000200 00000180 00000001 00000024 53504543
|...........$SPEC|</font><font size=3> </font><font size=2 face="sans-serif"><br>
00000210 5452554d 5343414c 455c7465 73747573
|TRUMSCALE\testus|</font><font size=3> </font><font size=2 face="sans-serif"><br>
00000220 65723140 76697274 75616c31 2e636f6d
|er1@virtual1.com|</font><font size=3> </font><font size=2 face="sans-serif"><br>
00000230 0000001f 53504543 5452554d 5343414c
|....SPECTRUMSCAL|</font><font size=3> </font><font size=2 face="sans-serif"><br>
00000240 455c7465 73744076 69727475 616c312e
|E\test@virtual1.|</font><font size=3> </font><font size=2 face="sans-serif"><br>
00000250 636f6d00 00000000 00000000 00000000
|com.............|</font><font size=3> </font><font size=2 face="sans-serif"><br>
<br>
Out of interest I setup an AIX 7.1 NFSV4 Server and AIX 7.1 NFSV4
client both authenticating against the AD LDAP. This worked</font><font size=3>
</font><font size=2 face="sans-serif"><br>
fine. I suspect this is because the AIX LDAP (Posix) does attribute
mapping so we only see the UID not DOMAIN\uid ..</font><font size=3> </font><font size=2 face="sans-serif"><br>
<br>
vi /etc/security/ldap/ldap.cfg</font><font size=3> </font><font size=2 face="sans-serif"><br>
<extract></font><font size=3> </font><font size=2 face="sans-serif"><br>
# AIX-LDAP attribute map path.</font><font size=3> </font><font size=2 face="sans-serif"><br>
userattrmappath:/etc/security/ldap/sfur2user.map</font><font size=3> </font><font size=2 face="sans-serif"><br>
groupattrmappath:/etc/security/ldap/sfur2group.map</font><font size=3>
</font><font size=2 face="sans-serif"><br>
<br>
# grep -i uid sfur2user.map <br>
username SEC_CHAR uid
s
na yes</font><font size=3> </font><font size=2 face="sans-serif"><br>
id SEC_INT
uidNumber
s na yes</font><font size=3> </font><font size=2 face="sans-serif"><br>
<br>
I wonder if Solaris 10/11 and HP-UX 11 are also not supported using NFSv4.
Does anyone know if the SpectrumScale CES (NFS/SMB) has a supported</font><font size=3>
</font><font size=2 face="sans-serif"><br>
operating systems list published. I checked here but nothing found.</font><font size=3>
</font><font size=3 color=blue><u><br>
<br>
</u></font><a href=http://www.ibm.com/support/knowledgecenter/STXKQY_4.2.1/com.ibm.spectrum.scale.v4r21.doc/bl1adm_authenticationlimitations.htm><font size=2 color=blue face="sans-serif"><u>http://www.ibm.com/support/knowledgecenter/STXKQY_4.2.1/com.ibm.spectrum.scale.v4r21.doc/bl1adm_authenticationlimitations.htm</u></font></a><font size=3>
</font><font size=2 face="sans-serif"><br>
<br>
# Going Forward</font><font size=3> </font><font size=2 face="sans-serif"><br>
<br>
Initially we want to provide only NFS and SMB CesNode services. So
we based our decision to use AD + RFC2307 </font><font size=3> </font><font size=2 face="sans-serif"><br>
based on this table, believing that it would provide what we need today
and future proof us a little by potentially allowing</font><font size=3>
</font><font size=2 face="sans-serif"><br>
expansion to OBJ in the future. </font><font size=3 color=blue><u><br>
<br>
</u></font><a href=http://www.ibm.com/support/knowledgecenter/STXKQY_4.2.1/com.ibm.spectrum.scale.v4r21.doc/bl1ins_authconcept.htm><font size=2 color=blue face="sans-serif"><u>http://www.ibm.com/support/knowledgecenter/STXKQY_4.2.1/com.ibm.spectrum.scale.v4r21.doc/bl1ins_authconcept.htm</u></font></a><font size=3>
</font><font size=2 face="sans-serif"><br>
<br>
NFSv4 is pretty mandatory in our design, we want to get rid of using Netgroup's
and NFS V3 UID/GID mapping which as weak security.</font><font size=3>
</font><font size=2 face="sans-serif"><br>
Ideally on day one we would want NFSV4 and Kerberos to provide better security
for our clients. Its also likely that in the future corporate</font><font size=3>
</font><font size=2 face="sans-serif"><br>
security policies may ban netgroup's for NFS authorization so using NFSv4
+ kerberos would position my department well for future changes.</font><font size=3>
</font><font size=2 face="sans-serif"><br>
<br>
Based on the table I guess I need to setup LDAP / TLS / Kerberos as the
authentication service which will cover all bases expect OBJECT.</font><font size=3>
</font><font size=2 face="sans-serif"><br>
<br>
Thanks again for everyone's comments, this was my first post and the responses
were all very welcome.</font><font size=3> </font><font size=2 face="sans-serif"><br>
<br>
Rgds Andy</font><font size=3> </font>
<table width=825 style="border-collapse:collapse;">
<tr height=8>
<td width=490 bgcolor=#616161 style="border-style:none none none none;border-color:#000000;border-width:0px 0px 0px 0px;padding:1px 1px;"><font size=3 color=white> </font><font size=3 color=white face="Verdana"><b>Andy
Parker</b></font><font size=3> </font>
<td width=331 colspan=2 bgcolor=#616161 style="border-style:none none none none;border-color:#000000;border-width:0px 0px 0px 0px;padding:1px 1px;">
<div align=right><font size=3 color=white face="Verdana"><b>Cloud &
Development Platforms (C&DP)</b></font><a href=http://it.hursley.ibm.com/><font size=3 color=white><u>
</u></font></a></div>
<tr valign=top height=8>
<td width=490 style="border-style:none none none none;border-color:#000000;border-width:0px 0px 0px 0px;padding:1px 1px;"><font size=3><br>
</font>
<br>
<table width=491 style="border-collapse:collapse;">
<tr height=8>
<td width=489 style="border-style:none none none none;border-color:#000000;border-width:0px 0px 0px 0px;padding:1px 1px;"><a href=mailto:Andy_parker1@uk.ibm.com><font size=2 color=blue face="Verdana"><u>Andy_Parker1@uk.ibm.com</u></font></a><font size=2 color=#5f5f5f face="Verdana"><br>
Desk: </font><a href="http://maps.hursley.ibm.com/showmap.html?q=Andy+Parker"><font size=2 color=blue face="Verdana"><u>DW1B14</u></font></a><font size=2 color=#5f5f5f face="Verdana">
</font></table>
<br>
<td width=145 style="border-style:none none none none;border-color:#000000;border-width:0px 0px 0px 0px;padding:1px 1px;"><font size=2 color=#5f5f5f face="Verdana">Tel:
37-245326 (01962-815326)</font><font size=3> </font>
<td width=184 style="border-style:none none none none;border-color:#000000;border-width:0px 0px 0px 0px;padding:1px 1px;"><font size=2 color=#5f5f5f face="Verdana">Post:
MP100, IBM Hursley Park, Winchester, SO21 2JN</font></table>
<br>
<p><font size=3><br>
<br>
<br>
</font><font size=1 color=#5f5f5f face="sans-serif"><br>
<br>
From: </font><font size=1 face="sans-serif">"Chetan
R Kulkarni" <chetkulk@in.ibm.com></font><font size=3> </font><font size=1 color=#5f5f5f face="sans-serif"><br>
To: </font><font size=1 face="sans-serif">gpfsug-discuss@spectrumscale.org</font><font size=3>
</font><font size=1 color=#5f5f5f face="sans-serif"><br>
Date: </font><font size=1 face="sans-serif">15/11/2016
06:01</font><font size=3> </font><font size=1 color=#5f5f5f face="sans-serif"><br>
Subject: </font><font size=1 face="sans-serif">[gpfsug-discuss]
SS 4.2.1 + CES NFS / SMB</font><font size=3> </font><font size=1 color=#5f5f5f face="sans-serif"><br>
Sent by: </font><font size=1 face="sans-serif">gpfsug-discuss-bounces@spectrumscale.org</font><font size=3>
<br>
</font>
<hr noshade><font size=3><br>
</font><tt><font size=3><br>
<br>
>> Summary / Question:<br>
>> Can anybody explain why I do not see userID / Group names when
viewing <br>
>> via a NFS4 client and ideally how to fix this.</font></tt><font size=3><br>
<br>
This is not supported by Spectrum Scale (i.e. NFSv4 mount/access on AIX
clients with AD+RFC2307 file authentication). <br>
<br>
Reason being AIX client integrates with AD like LDAP i.e. AIX client can't
resolve the user in format "DOMAIN\user".<br>
NFSv4 server returns user in "DOMAIN\user" format and as AIX
client doesn't understand "DOMAIN\user"; it translates to "nobody".
Hence you see "nobody" under AIX NFSv4 mount.<br>
<br>
Please note that; with RHEL clients we see correct ownership under NFSv4
mounts. This is because RHEL clients integrate with AD as pure AD client
(using winbind or SSSD) i.e. users resolve successfully in "DOMAIN\user"
format on RHEL clients.<br>
<br>
Thanks,<br>
Chetan.</font><tt><font size=2>_______________________________________________<br>
gpfsug-discuss mailing list<br>
gpfsug-discuss at spectrumscale.org</font></tt><font size=3 color=blue><u><br>
</u></font><a href="http://gpfsug.org/mailman/listinfo/gpfsug-discuss"><tt><font size=2 color=blue><u>http://gpfsug.org/mailman/listinfo/gpfsug-discuss</u></font></tt></a><font size=3><br>
</font><font size=2 face="sans-serif"><br>
<br>
<br>
Unless stated otherwise above:<br>
IBM United Kingdom Limited - Registered in England and Wales with number
741598. <br>
Registered office: PO Box 41, North Harbour, Portsmouth, Hampshire PO6
3AU</font><tt><font size=2>_______________________________________________<br>
gpfsug-discuss mailing list<br>
gpfsug-discuss at spectrumscale.org</font></tt><font size=3 color=blue><u><br>
</u></font><a href="http://gpfsug.org/mailman/listinfo/gpfsug-discuss"><tt><font size=2 color=blue><u>http://gpfsug.org/mailman/listinfo/gpfsug-discuss</u></font></tt></a>
<p><font size=2 face="sans-serif"><br>
<br>
Unless stated otherwise above:<br>
IBM United Kingdom Limited - Registered in England and Wales with number
741598. <br>
Registered office: PO Box 41, North Harbour, Portsmouth, Hampshire PO6
3AU</font><tt><font size=2>_______________________________________________<br>
gpfsug-discuss mailing list<br>
gpfsug-discuss at spectrumscale.org<br>
</font></tt><a href="http://gpfsug.org/mailman/listinfo/gpfsug-discuss"><tt><font size=2>http://gpfsug.org/mailman/listinfo/gpfsug-discuss</font></tt></a><tt><font size=2><br>
</font></tt>
<p>
<br><font size=2 face="sans-serif"><br>
Unless stated otherwise above:<br>
IBM United Kingdom Limited - Registered in England and Wales with number
741598. <br>
Registered office: PO Box 41, North Harbour, Portsmouth, Hampshire PO6
3AU<br>
</font>