I understand what you're trying to do in here, but maybe I forgot to mention something...the 2 domains are trusted each other according to AD admins, I can double check on Isilon directly, here the output:
Could it be that security groups are not configured as they should be on AD? The AD groups are created on first forest and added into same AD to user from other forest...maybe the universal groups from first forest need to be added directly on second forest?
First, putting a SAMBA server in front of an Isilon cluster, and connecting back with NFS to a directory that doesn't have real POSIX permissions, only synthetic POSIX permissions generated based upon a real ACL (what the + sign means next to your RWXRWX--- + output above), is never going to be very reliable or get your desired result. I would suggest instead that you create another access zone on the Isilon cluster, but leave the base root path at /ifs (overlapping or duplicate access zone base root paths aren't generally a good idea, but in your case you have 2 different non-trusted AD forests that need access to the same data. So now in your new access zone, join it to the other domain, and then add appropriate ACEs to the ACLs of the target data for the users on the other side to have access.
Put security groups from domain2 and domain1 in the SMB Share ACL and the NTFS ACL and you should be fine. The only other issue that I've seen with this sort of thing is if you have RFC2307 aka Services for Unix enabled in one of those domains, but not in the other.
One way to test, is to use 'isi auth mapping token domain2\\username' for some user that should have access. Open a support ticket if you need a hand troubleshooting.
PPBejarano
2 Posts
0
July 17th, 2018 10:00
I understand what you're trying to do in here, but maybe I forgot to mention something...the 2 domains are trusted each other according to AD admins, I can double check on Isilon directly, here the output:
dc2isi1-16# isi auth ads trusts list
--------------------------------------------------------------------------------
Domain: bhtcgroup.de
NetBIOS Name: BHTCGROUP
SID: S-1-5-21-1645522239-507921405-1957994488
GUID: 00000000-0000-0000-0000-000000000000
Trust Type: 2-way
Status: online
DC Site: bhtc1
Client Site: bhtc1
DC Name: desbhtcdc05.bhtcgroup.de
DC Address: 10.28.8.254
--------------------------------------------------------------------------------
Could it be that security groups are not configured as they should be on AD? The AD groups are created on first forest and added into same AD to user from other forest...maybe the universal groups from first forest need to be added directly on second forest?
crklosterman
450 Posts
0
July 17th, 2018 10:00
First, putting a SAMBA server in front of an Isilon cluster, and connecting back with NFS to a directory that doesn't have real POSIX permissions, only synthetic POSIX permissions generated based upon a real ACL (what the + sign means next to your RWXRWX--- + output above), is never going to be very reliable or get your desired result. I would suggest instead that you create another access zone on the Isilon cluster, but leave the base root path at /ifs (overlapping or duplicate access zone base root paths aren't generally a good idea, but in your case you have 2 different non-trusted AD forests that need access to the same data. So now in your new access zone, join it to the other domain, and then add appropriate ACEs to the ACLs of the target data for the users on the other side to have access.
~Chris
crklosterman
450 Posts
0
July 23rd, 2018 14:00
Put security groups from domain2 and domain1 in the SMB Share ACL and the NTFS ACL and you should be fine. The only other issue that I've seen with this sort of thing is if you have RFC2307 aka Services for Unix enabled in one of those domains, but not in the other.
One way to test, is to use 'isi auth mapping token domain2\\username' for some user that should have access. Open a support ticket if you need a hand troubleshooting.