<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title></title>
</head>
<body>
<div name="messageBodySection" style="font-size: 14px; font-family: -apple-system, BlinkMacSystemFont, sans-serif;">Thanks a lot Andrew.
<div><br /></div>
<div>It does look promising but It does not strike me immediately on how this could solve the SMB export where user authenticates with an AD username but the gpfs files that are present are owned by LDAP username.</div>
<div>May be you are saying that if i enable GPFS to use these scripts - then GPFS will map the AD username to the LDAP username?</div>
<div><br /></div>
<div>I found this url too..</div>
<div><br /></div>
<div><a href="https://www.ibm.com/support/knowledgecenter/en/SSFKCN/com.ibm.cluster.gpfs.doc/gpfs_uid/uid_gpfs.html">https://www.ibm.com/support/knowledgecenter/en/SSFKCN/com.ibm.cluster.gpfs.doc/gpfs_uid/uid_gpfs.html</a></div>
<div><br /></div>
<div>I will give it a read, try to understand how to implement it and get back if i have any more questions. </div>
<div><br /></div>
<div>If this works, it should help me configure and use the CES SMB. (Hopefully, CES file based authentication will allow both ssh key authentication for NFS and AD for SMB in same CES cluster).</div>
</div>
<div name="messageSignatureSection"><br />
<div class="matchFont"></div>
<div class="matchFont">Regards,<br style="font-size: 14px; font-family: -apple-system, BlinkMacSystemFont, sans-serif;" />
Lohit</div>
</div>
<div name="messageReplySection" style="font-size: 14px; font-family: -apple-system, BlinkMacSystemFont, sans-serif;"><br />
On Mar 7, 2019, 4:52 PM -0600, Andrew Beattie <abeattie@au1.ibm.com>, wrote:<br />
<blockquote type="cite" style="margin: 5px 5px; padding-left: 10px; border-left: thin solid #1abc9c;">
<div class="socmaildefaultfont" dir="ltr" style="font-family:Arial, Helvetica, sans-serif;font-size:10.5pt">
<div dir="ltr">Lohit</div>
<div dir="ltr"> </div>
<div dir="ltr">Have you looked at mmUIDtoName mmNametoUID</div>
<div dir="ltr"> </div>
<div dir="ltr">Yes it will require some custom scripting on your behalf but it would be a far more elegant solution and not run the risk of data corruption issues.</div>
<div dir="ltr"> </div>
<div dir="ltr">There is at least one university on this mailing list that is doing exactly what you are talking about, and they successfully use</div>
<div dir="ltr">mmUIDtoName / mmNametoUID to provide the relevant mapping between different authentication environments - both internally in the university and externally from other institutions.</div>
<div dir="ltr"> </div>
<div dir="ltr">They use AFM to move data between different storage clusters, and mmUIDtoName / mmNametoUID, to manage the ACL and permissions, they then move the data from the AFM filesystem to the HPC scratch filesystem for processing by the HPC (different filesystems within the same cluster)</div>
<div dir="ltr"> </div>
<div dir="ltr"> </div>
<div dir="ltr">Regards,</div>
<div dir="ltr">
<div class="socmaildefaultfont" dir="ltr" style="font-family:Arial, Helvetica, sans-serif;font-size:10.5pt">
<div class="socmaildefaultfont" dir="ltr" style="font-family:Arial;font-size:10.5pt">
<div class="socmaildefaultfont" dir="ltr" style="font-family:Arial;font-size:10.5pt">
<div class="socmaildefaultfont" dir="ltr" style="font-family:Arial;font-size:10.5pt">
<div dir="ltr" style="margin-top: 20px;">
<div style="font-size: 12pt; font-weight: bold; font-family: sans-serif; color: #7C7C5F;">Andrew Beattie</div>
<div style="font-size: 10pt; font-weight: bold; font-family: sans-serif;">File and Object Storage Technical Specialist - A/NZ</div>
<div style="font-size: 10pt; font-weight: bold; font-family: sans-serif;">IBM Systems - Storage</div>
<div style="font-size: 8pt; font-family: sans-serif; margin-top: 10px;">
<div><span style="font-weight: bold; color: #336699;">Phone:</span> 614-2133-7927</div>
<div><span style="font-weight: bold; color: #336699;">E-mail:</span> <a href="mailto:abeattie@au1.ibm.com" style="color: #555">abeattie@au1.ibm.com</a></div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<div dir="ltr"> </div>
<div dir="ltr"> </div>
<blockquote data-history-content-modified="1" data-history-expanded="1" dir="ltr" style="margin: 5px 5px; padding-left: 10px; border-left: thin solid #e67e22;">----- Original message -----<br />
From: valleru@cbio.mskcc.org<br />
Sent by: gpfsug-discuss-bounces@spectrumscale.org<br />
To: gpfsug-discuss@spectrumscale.org, gpfsug main discussion list <gpfsug-discuss@spectrumscale.org><br />
Cc:<br />
Subject: Re: [gpfsug-discuss] Exporting remote GPFS mounts on a non-ces SMB share<br />
Date: Fri, Mar 8, 2019 8:21 AM<br />
<div name="messageBodySection" style="font-size: 14px; font-family: -apple-system, BlinkMacSystemFont, sans-serif;">We have many current usernames from LDAP that do not exactly match with the usernames from AD.
<div>Unfortunately, i guess CES SMB will need us to use either AD or LDAP or use the same usernames in both AD and LDAP.
<div>I have been looking for a solution where could map the different usernames from LDAP and AD but have not found a solution. So exploring ways to do this from RHEL SMB.</div>
</div>
<div>I would appreciate if you have any solution to this issue.</div>
<div> </div>
<div>As of now we use LDAP uids/gids and SSH keys for authentication to the HPC cluster. </div>
<div>We want to use CES SMB to export the same mounts which have LDAP usernames/uids/gids however because of different usernames in AD - it has become a challenge.</div>
<div>Even if we do find a solution to this, i want to be able to use AD authentication for SMB and ssh key authentication for NFS.</div>
<div> </div>
<div>The above are the reasons we are just using CES with NFS and user defined authentication for users to have access with login through ssh keys.</div>
</div>
<div name="messageSignatureSection" style="font-size: 14px; font-family: -apple-system, BlinkMacSystemFont, sans-serif;"><br />
Regards,<br />
Lohit</div>
<div name="messageReplySection" style="font-size: 14px; font-family: -apple-system, BlinkMacSystemFont, sans-serif;"><br />
On Mar 7, 2019, 3:12 PM -0600, Andrew Beattie <abeattie@au1.ibm.com>, wrote:
<blockquote style="margin: 5px 5px; padding-left: 10px; border-left: thin solid #3498db;" type="cite">
<div dir="ltr" style="font-family:Arial, Helvetica, sans-serif;font-size:10.5pt">
<div dir="ltr">That would not be supported</div>
<div dir="ltr"> </div>
<div dir="ltr">You shouldn't publish a remote mount Protocol cluster , and then connect a native client to that cluster and create a non CES protocol export</div>
<div dir="ltr">if you are going to use a Protocol cluster that's how you present your protocols.</div>
<div dir="ltr">otherwise don't set up the remote mount cluster.</div>
<div dir="ltr"> </div>
<div dir="ltr">Why are you trying to publish a non HA RHEL SMB share instead of using the HA CES protocols?</div>
<div dir="ltr">
<div dir="ltr" style="font-family:Arial, Helvetica, sans-serif;font-size:10.5pt">
<div dir="ltr" style="font-family:Arial;font-size:10.5pt">
<div dir="ltr" style="font-family:Arial;font-size:10.5pt">
<div dir="ltr" style="font-family:Arial;font-size:10.5pt">
<div dir="ltr" style="margin-top: 20px;">
<div style="font-size: 12pt; font-weight: bold; font-family: sans-serif; color: #7C7C5F;">Andrew Beattie</div>
<div style="font-size: 10pt; font-weight: bold; font-family: sans-serif;">File and Object Storage Technical Specialist - A/NZ</div>
<div style="font-size: 10pt; font-weight: bold; font-family: sans-serif;">IBM Systems - Storage</div>
<div style="font-size: 8pt; font-family: sans-serif; margin-top: 10px;">
<div><span style="font-weight: bold; color: #336699;">Phone:</span> 614-2133-7927</div>
<div><span style="font-weight: bold; color: #336699;">E-mail:</span> <a href="mailto:abeattie@au1.ibm.com" style="color: #555" target="_blank">abeattie@au1.ibm.com</a></div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<div dir="ltr"> </div>
<div dir="ltr"> </div>
<blockquote data-history-content-modified="1" dir="ltr" style="margin: 5px 5px; padding-left: 10px; border-left: thin solid #d35400;">----- Original message -----<br />
From: valleru@cbio.mskcc.org<br />
Sent by: gpfsug-discuss-bounces@spectrumscale.org<br />
To: gpfsug-discuss@spectrumscale.org, gpfsug main discussion list <gpfsug-discuss@spectrumscale.org><br />
Cc:<br />
Subject: Re: [gpfsug-discuss] Exporting remote GPFS mounts on a non-ces SMB share<br />
Date: Fri, Mar 8, 2019 7:05 AM<br />
<div name="messageBodySection" style="font-size: 14px; font-family: -apple-system, BlinkMacSystemFont, sans-serif;">Thank you Andrew.
<div> </div>
<div>However, we are not using SMB from the CES cluster but instead running a Redhat based SMB on a GPFS client of the CES cluster and exporting it from the GPFS client.</div>
<div>Is the above supported, and not known to cause any issues?</div>
</div>
<div name="messageSignatureSection" style="font-size: 14px; font-family: -apple-system, BlinkMacSystemFont, sans-serif;"><br />
Regards,<br />
Lohit</div>
<div name="messageReplySection" style="font-size: 14px; font-family: -apple-system, BlinkMacSystemFont, sans-serif;"><br />
On Mar 7, 2019, 2:45 PM -0600, Andrew Beattie <abeattie@au1.ibm.com>, wrote:
<blockquote style="margin: 5px 5px; padding-left: 10px; border-left: thin solid #34495e;" type="cite">
<div><a href="https://www.ibm.com/support/knowledgecenter/en/STXKQY_5.0.2/com.ibm.spectrum.scale.v5r02.doc/bl1adv_configprotocolsonremotefs.htm" target="_blank">https://www.ibm.com/support/knowledgecenter/en/STXKQY_5.0.2/com.ibm.spectrum.scale.v5r02.doc/bl1adv_configprotocolsonremotefs.htm</a></div>
</blockquote>
</div>
<div><font size="2" face="Default Monospace,Courier New,Courier,monospace">_______________________________________________<br />
gpfsug-discuss mailing list<br />
gpfsug-discuss at spectrumscale.org<br />
<a href="http://gpfsug.org/mailman/listinfo/gpfsug-discuss" target="_blank">http://gpfsug.org/mailman/listinfo/gpfsug-discuss</a></font></div>
</blockquote>
<div dir="ltr"> </div>
</div>
<br />
_______________________________________________<br />
gpfsug-discuss mailing list<br />
gpfsug-discuss at spectrumscale.org<br />
<span><a href="http://gpfsug.org/mailman/listinfo/gpfsug-discuss" target="_blank">http://gpfsug.org/mailman/listinfo/gpfsug-discuss</a></span></blockquote>
</div>
<div><font size="2" face="Default Monospace,Courier New,Courier,monospace">_______________________________________________<br />
gpfsug-discuss mailing list<br />
gpfsug-discuss at spectrumscale.org<br />
<a href="http://gpfsug.org/mailman/listinfo/gpfsug-discuss" target="_blank">http://gpfsug.org/mailman/listinfo/gpfsug-discuss</a></font></div>
</blockquote>
<div dir="ltr"> </div>
</div>
<br />
_______________________________________________<br />
gpfsug-discuss mailing list<br />
gpfsug-discuss at spectrumscale.org<br />
http://gpfsug.org/mailman/listinfo/gpfsug-discuss<br /></blockquote>
</div>
</body>
</html>