NFSv4 16 group limit

This is a complex answer, so i'll just point you here Eisler's NFS Blog: What's the deal on the 16 group id limitation in NFS?

Hi Pwjackson,

In a NFS user can belongs to many groups, when a user is authenticated a credential is created, where this information is stored. By default, VNX is supporting only 16 groups stored in the credential for authentication. I noticed you have set the parameter allows to extend the number of groups to 128. However, we need to ensure the linux clinet supports 128 group. Mark has recommended a great technical blog to explain how to deal on the 16 group ID limitation in NFS, you may refer to this blog.

Thanks, you two. I've seen the blog post before but had only skimmed it. Reading in more detail, it says to me:

1. NFSv3's AUTH_SYS standard is to use only 16 groups.

2. To get around that limitation but still use NFSv3:

     a) Create your own AUTH_SYS version that allows more than 16 groups (not very feasible)

     b) Use RPCSEC_GSS which basically sends the user ID to the server and then the server performs the group lookup. The caveat with this is that some version of NLM (used for byte-locking) do not support RPCSEC_GSS.

3. To get around the NLM issue, you can use NFSv4 with RPCSEC_GSS. This is because NFSv4 includes byte-locking. Caveat here is that the client may not support more than 16 groups.

4. The final (and what I thought I implemented) solution is to NFSv4 with ACLs. My understanding is that the client no longer sends all of the group IDs to the NFS server and instead uses some sort of AD credentials that the NFS server understands and compares to the ACLs on the file/folder.

Initially it seems that I'm using ACLs (I can add multiple group permissions to a file granting access and then have someone in that same group successfully access the file on the linux side. But once I test with a user in more than 16 groups and assign just that 17th group with access rights, they're denied access.

So isn't the 16-group limitation moot because I'm using NFSv4 with ACLs?

Further research seems to indicate that the NFS version really doesn't have anything to do with the limitation: Solving the NFS 16-Group Limit Problem - Postmodern Sysadmin.

The post recommends on an NFS server to run rcp.mountd using the "--manage-gids" option. This tells the NFS server to ignore the group IDs that are sent from the client and perform a group lookup based on the user ID. I scoured the Parameters Guide for VNX for File but didn't see anything that quite matched what "--manage-gids" does.

Does anyone know of an equivalent parameter or configuration change on VNX to have it ignore the GIDs from the NFS client?

Thanks,

Paul

Have you tried this work-around?

https://support.emc.com/kb/89550

Specifically, the map-lookup-uid setting for NFS exports.