<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
tt
{mso-style-priority:99;
font-family:"Courier New";}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle21
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-GB" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Ah, thanks Markus, that’s what I was looking for.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Andrew yes, the service account has been created now, I am more interested in the “what if” we didn’t change things. I suppose this is the result of ~4 years of technical debt on our part!<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Thanks,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Richard<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span lang="EN-US">From:</span></b><span lang="EN-US"> gpfsug-discuss-bounces@spectrumscale.org <gpfsug-discuss-bounces@spectrumscale.org>
<b>On Behalf Of </b>Markus Rohwedder<br>
<b>Sent:</b> 04 September 2018 14:41<br>
<b>To:</b> gpfsug main discussion list <gpfsug-discuss@spectrumscale.org><br>
<b>Cc:</b> gpfsug-discuss-bounces@spectrumscale.org<br>
<b>Subject:</b> Re: [gpfsug-discuss] CES file authentication - bind account deleted?<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p><span style="font-size:10.0pt">Hello.</span><br>
<br>
<span style="font-size:10.0pt">the user name should not matter for operations beyon domain join.</span><br>
<br>
<span style="font-size:10.0pt">mmuserauth man page:</span><br>
<br>
<span style="font-size:10.0pt">--user-name userName</span><br>
<br>
<span style="font-size:10.0pt">....</span><br>
<br>
<span style="font-size:10.0pt">In case of --type ad with</span><br>
<span style="font-size:10.0pt">--data-access-method file, the specified username</span><br>
<span style="font-size:10.0pt">is used to join the cluster to AD domain. It results in</span><br>
<span style="font-size:10.0pt">creating a machine account for the cluster based on the</span><br>
<span style="font-size:10.0pt">--netbios-name specified in the command. After</span><br>
<span style="font-size:10.0pt">successful configuration, the cluster connects with its</span><br>
<span style="font-size:10.0pt">machine account, and not the user used during the domain</span><br>
<span style="font-size:10.0pt">join. So the specified username after domain join has no</span><br>
<span style="font-size:10.0pt">role to play in communication with the AD domain</span><br>
<span style="font-size:10.0pt">controller and can be even deleted from the AD server.</span><br>
<span style="font-size:10.0pt">The cluster can still keep using AD for authentication</span><br>
<span style="font-size:10.0pt">via the machine account created.<br>
</span><br>
<br>
<span style="font-size:10.0pt;font-family:"Arial",sans-serif">Mit freundlichen Grüßen / Kind regards</span><br>
<br>
<b><span style="font-family:"Arial",sans-serif">Dr. Markus Rohwedder</span></b><br>
<br>
<span style="font-size:7.5pt;font-family:"Arial",sans-serif">Spectrum Scale GUI Development</span><o:p></o:p></p>
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0">
<tbody>
<tr>
<td width="600" colspan="4" style="width:450.0pt;padding:0cm 0cm 0cm 0cm">
<div class="MsoNormal">
<hr size="2" width="100%" noshade="" style="color:#0055AA" align="left">
</div>
</td>
</tr>
<tr>
<td width="600" colspan="4" style="width:450.0pt;padding:0cm 0cm 0cm 0cm">
<p class="MsoNormal"><img width="1" height="1" style="width:.0104in;height:.0104in" id="_x0000_i1026" src="cid:image001.png@01D4445D.C716BB30"><o:p></o:p></p>
</td>
</tr>
<tr>
<td width="39" style="width:29.25pt;padding:0cm 0cm 0cm 0cm">
<p class="MsoNormal"><span style="font-size:7.5pt;font-family:"Arial",sans-serif;color:#0055AA">Phone:</span><o:p></o:p></p>
</td>
<td width="157" style="width:117.75pt;padding:0cm 0cm 0cm 0cm">
<p class="MsoNormal"><span style="font-size:7.5pt;font-family:"Arial",sans-serif;color:#0055AA">+49 7034 6430190</span><o:p></o:p></p>
</td>
<td width="246" style="width:184.5pt;padding:0cm 0cm 0cm 0cm">
<p class="MsoNormal"><span style="font-size:7.5pt;font-family:"Arial",sans-serif;color:#0055AA">IBM Deutschland Research & Development</span><o:p></o:p></p>
</td>
<td width="158" rowspan="4" style="width:118.5pt;padding:0cm 0cm 0cm 0cm">
<p class="MsoNormal" align="right" style="text-align:right"><img width="158" height="40" style="width:1.6458in;height:.4166in" id="_x0000_i1027" src="cid:image002.png@01D4445D.C716BB30"><o:p></o:p></p>
</td>
</tr>
<tr>
<td width="39" style="width:29.25pt;padding:0cm 0cm 0cm 0cm">
<p class="MsoNormal"><span style="font-size:7.5pt;font-family:"Arial",sans-serif;color:#0055AA">E-Mail:</span><o:p></o:p></p>
</td>
<td width="157" style="width:117.75pt;padding:0cm 0cm 0cm 0cm">
<p class="MsoNormal"><span style="font-size:7.5pt;font-family:"Arial",sans-serif;color:#0055AA"><a href="mailto:rohwedder@de.ibm.com">rohwedder@de.ibm.com</a></span><o:p></o:p></p>
</td>
<td width="246" style="width:184.5pt;padding:0cm 0cm 0cm 0cm">
<p class="MsoNormal"><span style="font-size:7.5pt;font-family:"Arial",sans-serif;color:#0055AA">Am Weiher 24</span><o:p></o:p></p>
</td>
</tr>
<tr>
<td width="39" style="width:29.25pt;padding:0cm 0cm 0cm 0cm">
<p class="MsoNormal"><img border="0" width="1" height="1" style="width:.0104in;height:.0104in" id="_x0000_i1028" src="cid:image001.png@01D4445D.C716BB30"><o:p></o:p></p>
</td>
<td width="157" style="width:117.75pt;padding:0cm 0cm 0cm 0cm">
<p class="MsoNormal"><img border="0" width="1" height="1" style="width:.0104in;height:.0104in" id="_x0000_i1029" src="cid:image001.png@01D4445D.C716BB30"><o:p></o:p></p>
</td>
<td width="246" style="width:184.5pt;padding:0cm 0cm 0cm 0cm">
<p class="MsoNormal"><span style="font-size:7.5pt;font-family:"Arial",sans-serif;color:#0055AA">65451 Kelsterbach</span><o:p></o:p></p>
</td>
</tr>
<tr>
<td width="39" style="width:29.25pt;padding:0cm 0cm 0cm 0cm">
<p class="MsoNormal"><img border="0" width="1" height="1" style="width:.0104in;height:.0104in" id="_x0000_i1030" src="cid:image001.png@01D4445D.C716BB30"><o:p></o:p></p>
</td>
<td width="157" style="width:117.75pt;padding:0cm 0cm 0cm 0cm">
<p class="MsoNormal"><img border="0" width="1" height="1" style="width:.0104in;height:.0104in" id="_x0000_i1031" src="cid:image001.png@01D4445D.C716BB30"><o:p></o:p></p>
</td>
<td width="246" style="width:184.5pt;padding:0cm 0cm 0cm 0cm">
<p class="MsoNormal"><span style="font-size:7.5pt;font-family:"Arial",sans-serif;color:#0055AA">Germany</span><o:p></o:p></p>
</td>
</tr>
<tr>
<td width="600" colspan="4" style="width:450.0pt;padding:0cm 0cm 0cm 0cm">
<div class="MsoNormal">
<hr size="2" width="100%" noshade="" style="color:#0055AA" align="left">
</div>
</td>
</tr>
<tr>
<td width="600" colspan="4" style="width:450.0pt;padding:0cm 0cm 0cm 0cm">
<p class="MsoNormal"><img border="0" width="1" height="1" style="width:.0104in;height:.0104in" id="_x0000_i1033" src="cid:image001.png@01D4445D.C716BB30"><o:p></o:p></p>
</td>
</tr>
</tbody>
</table>
<p><br>
<img border="0" width="16" height="16" style="width:.1666in;height:.1666in" id="_x0000_i1034" src="cid:image003.gif@01D4445D.C716BB30" alt="Inactive hide details for "Andrew Beattie" ---04.09.2018 15:18:43---Hi Richard,"><span style="font-size:10.0pt;color:#424282">"Andrew
Beattie" ---04.09.2018 15:18:43---Hi Richard,</span><br>
<br>
<span style="font-size:10.0pt;color:#5F5F5F">From: </span><span style="font-size:10.0pt">"Andrew Beattie" <<a href="mailto:abeattie@au1.ibm.com">abeattie@au1.ibm.com</a>></span><br>
<span style="font-size:10.0pt;color:#5F5F5F">To: </span><span style="font-size:10.0pt"><a href="mailto:gpfsug-discuss@spectrumscale.org">gpfsug-discuss@spectrumscale.org</a></span><br>
<span style="font-size:10.0pt;color:#5F5F5F">Cc: </span><span style="font-size:10.0pt"><a href="mailto:gpfsug-discuss@spectrumscale.org">gpfsug-discuss@spectrumscale.org</a></span><br>
<span style="font-size:10.0pt;color:#5F5F5F">Date: </span><span style="font-size:10.0pt">04.09.2018 15:18</span><br>
<span style="font-size:10.0pt;color:#5F5F5F">Subject: </span><span style="font-size:10.0pt">Re: [gpfsug-discuss] CES file authentication - bind account deleted?</span><br>
<span style="font-size:10.0pt;color:#5F5F5F">Sent by: </span><span style="font-size:10.0pt"><a href="mailto:gpfsug-discuss-bounces@spectrumscale.org">gpfsug-discuss-bounces@spectrumscale.org</a></span><o:p></o:p></p>
<div class="MsoNormal">
<hr size="2" width="100%" noshade="" style="color:#8091A5" align="left">
</div>
<p class="MsoNormal"><br>
<br>
<br>
<span style="font-family:"Arial",sans-serif">Hi Richard,</span><br>
<br>
<span style="font-family:"Arial",sans-serif">If you are setting up Protocol authentication against the active directory,</span><br>
<span style="font-family:"Arial",sans-serif">would you not choose to use a service account that isn't going to get deleted?</span><br>
<br>
<span style="font-family:"Arial",sans-serif">If you choose to use an user account of a Sys Admin who has Domain admin privileges and they leave the company and their account is deleted, you would almost certainly have issues with the Scale cluster trying to
validate users permissions and having scale get an error from AD when the credentials that it uses are no longer valid.</span><br>
<br>
<br>
<b><span style="color:#7C7C5F">Andrew Beattie</span></b><br>
<b><span style="font-size:10.0pt">Software Defined Storage - IT Specialist</span></b><br>
<b><span style="font-size:7.5pt;color:#336699">Phone: </span></b><span style="font-size:7.5pt">614-2133-7927</span><br>
<b><span style="font-size:7.5pt;color:#336699">E-mail: </span></b><a href="mailto:abeattie@au1.ibm.com"><span style="font-size:7.5pt;color:#555555">abeattie@au1.ibm.com</span></a><br>
<br>
<br>
<span style="font-family:"Arial",sans-serif">----- Original message -----<br>
From: "Sobey, Richard A" <<a href="mailto:r.sobey@imperial.ac.uk">r.sobey@imperial.ac.uk</a>><br>
Sent by: <a href="mailto:gpfsug-discuss-bounces@spectrumscale.org">gpfsug-discuss-bounces@spectrumscale.org</a><br>
To: "'gpfsug-discuss@spectrumscale.org'" <<a href="mailto:gpfsug-discuss@spectrumscale.org">gpfsug-discuss@spectrumscale.org</a>><br>
Cc:<br>
Subject: [gpfsug-discuss] CES file authentication - bind account deleted?<br>
Date: Tue, Sep 4, 2018 8:45 AM</span><o:p></o:p></p>
<p><span style="font-family:"Arial",sans-serif">Hi all,</span><o:p></o:p></p>
<p><span style="font-family:"Arial",sans-serif">I don’t like using long subject lines as a rule so it probably doesn’t make sense, but consider:</span><o:p></o:p></p>
<p><span style="font-family:"Courier New"">FILE access configuration : AD</span><o:p></o:p></p>
<p><span style="font-family:"Courier New"">PARAMETERS VALUES</span><o:p></o:p></p>
<p><span style="font-family:"Courier New"">-------------------------------------------------</span><o:p></o:p></p>
<p><span style="font-family:"Courier New"">ENABLE_NFS_KERBEROS true</span><o:p></o:p></p>
<p><span style="font-family:"Courier New"">SERVERS domaincontroller.ic.ac.uk</span><o:p></o:p></p>
<p><span style="font-family:"Courier New"">USER_NAME <a href="mailto:joebloggs@IC.AC.UK">
joebloggs@IC.AC.UK</a></span><o:p></o:p></p>
<p><span style="font-family:"Courier New"">NETBIOS_NAME store</span><o:p></o:p></p>
<p><span style="font-family:"Courier New"">IDMAP_ROLE master</span><o:p></o:p></p>
<p><span style="font-family:"Courier New"">IDMAP_RANGE 10000000-299999999</span><o:p></o:p></p>
<p><span style="font-family:"Courier New"">IDMAP_RANGE_SIZE 1000000</span><o:p></o:p></p>
<p><span style="font-family:"Courier New"">UNIXMAP_DOMAINS IC(500 - 2000000)</span><o:p></o:p></p>
<p><span style="font-family:"Courier New"">LDAPMAP_DOMAINS none</span><o:p></o:p></p>
<p><span style="font-family:"Arial",sans-serif">If “joebloggs” was to leave the organization and that account deleted from Active Directory, what is the impact on file authentication in CES?</span><o:p></o:p></p>
<p><span style="font-family:"Arial",sans-serif">Thanks</span><o:p></o:p></p>
<p><span style="font-family:"Arial",sans-serif">Richard</span><o:p></o:p></p>
<p style="margin-bottom:12.0pt"><tt><span style="font-size:10.0pt">_______________________________________________</span></tt><span style="font-size:10.0pt;font-family:"Courier New""><br>
<tt>gpfsug-discuss mailing list</tt><br>
<tt>gpfsug-discuss at spectrumscale.org</tt><u><span style="color:blue"><br>
</span></u></span><a href="http://gpfsug.org/mailman/listinfo/gpfsug-discuss" target="_blank"><tt><span style="font-size:10.0pt">http://gpfsug.org/mailman/listinfo/gpfsug-discuss</span></tt></a><br>
<br>
<tt><span style="font-size:10.0pt">_______________________________________________</span></tt><span style="font-size:10.0pt;font-family:"Courier New""><br>
<tt>gpfsug-discuss mailing list</tt><br>
<tt>gpfsug-discuss at spectrumscale.org</tt><br>
<tt><a href="http://gpfsug.org/mailman/listinfo/gpfsug-discuss">http://gpfsug.org/mailman/listinfo/gpfsug-discuss</a></tt><br>
</span><br>
<br>
<o:p></o:p></p>
</div>
</body>
</html>