<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title></title>
</head>
<body>
<div name="messageBodySection" style="font-size: 14px; font-family: -apple-system, BlinkMacSystemFont, sans-serif;">Hello All,
<div><br /></div>
<div>I am trying to export a single remote filesystem over NFS/SMB using GPFS CES. ( GPFS 5.0.0.2 and CentOS 7 ).</div>
<div><br /></div>
<div>We need NFS exports to be accessible on client nodes, that use public key authentication and ldap authorization. I already have this working with a previous CES setup on user-defined authentication, where users can just login to the client nodes, and access NFS mounts.</div>
<div><br /></div>
<div>However, i will also need SAMBA exports for the same GPFS filesystem with AD/kerberos authentication.</div>
<div>Previously, we used to have a working SAMBA export for a local filesystem with SSSD and AD integration with SAMBA as mentioned in the below solution from redhat.</div>
<div><a href="https://access.redhat.com/solutions/2221561">https://access.redhat.com/solutions/2221561</a><br /></div>
<div>We find the above as cleaner solution with respect to AD and Samba integration compared to centrify or winbind. </div>
<div><br /></div>
<div>I understand that GPFS does offer AD authentication, however i believe i cannot use the same since NFS will need user-defined authentication and SAMBA will need AD authentication.</div>
<div><br /></div>
<div>I have thus been trying to use user-defined authentication.</div>
<div>I tried to edit smb.cnf from GPFS ( with a bit of help from this blog, written by Simon. <a href="https://www.roamingzebra.co.uk/2015/07/smb-protocol-support-with-spectrum.html">https://www.roamingzebra.co.uk/2015/07/smb-protocol-support-with-spectrum.html</a>)</div>
<div><br /></div>
<div>/usr/lpp/mmfs/bin/net conf list<br /></div>
<div><br /></div>
<div>realm = xxxx</div>
<div>workgroup = xxxx</div>
<div>security = ads</div>
<div>kerberos method = secrets and key tab </div>
<div>idmap config * : backend = tdb template </div>
<div>homedir = /home/%U </div>
<div>dedicated keytab file = /etc/krb5.keytab</div>
<div><br /></div>
<div>I had joined the node to AD with realmd and i do get relevant AD info when i try: </div>
<div>/usr/lpp/mmfs/bin/net ads info<br /></div>
<div><br /></div>
<div>However, when i try to display keytab or add principals to keytab. It just does not work.</div>
<div>/usr/lpp/mmfs/bin/net ads keytab list -> does not show the keys present in /etc/krb5.keytab.</div>
<div>/usr/lpp/mmfs/bin/net ads keytab add cifs -> does not add the keys to the /etc/krb5.keytab<br /></div>
<div><br /></div>
<div>As per the samba documentation, these two parameters should help samba automatically find the keytab file.</div>
<div>kerberos method = secrets and key tab<br /></div>
<div>dedicated keytab file = /etc/krb5.keytab</div>
<div><br /></div>
<div>I have not yet tried to see, if a SAMBA export is working with AD authentication but i am afraid it might not work.</div>
<div><br /></div>
<div>Have anyone tried the AD integration with SSSD/SAMBA for GPFS, and any suggestions on how to debug the above would be really helpful.</div>
</div>
<div name="messageSignatureSection" style="font-size: 14px; font-family: -apple-system, BlinkMacSystemFont, sans-serif;"><br />
Thanks,
<div>Lohit</div>
</div>
<div name="messageReplySection" style="font-size: 14px; font-family: -apple-system, BlinkMacSystemFont, sans-serif;"><br />
<div></div>
</div>
</body>
</html>