Hi!

I faced with the domains integration problem. Especially with LDAP integration.

We have:

... Celerra: two blades (server_2 is a standby)

... Windows Domain: domain.local, Sub-domain windows: sib.domain.local, trused windows forest/doman: ext-domain.local

... EMC storage is placed on domain.local

... Two CIFS servers: stor-1.domain.local and stor-2.sib.domain.local. Each of which has been joined to their domains.

... Usermapper has been disabled. Resolver param is 1. Autobroadcast is 1. LDAP has been enabled. nsswitch.conf and ldap.conf were configured. As kerberos account system uses stor-1$. On each domain UNIX UID/GID, Primary group for each used account or group are configured in Active Directory.

... VDM "vdm_sib_0" on server_3 with connected CIFS server stor-2.sib.domain.local.

... Users from default domain.local domain are able to connect to stor-1.domain.local and stor-2.sib.domain.local. ACLs on folders work only for them too.

Secmap worked fine until we decided to make a sub-domain and trusted forest: sib.domain.local, ext-domain.local. As I understand only one domain is possible per DM. VDM as I also understand takes the same LDAP settings as DM-owner. However, I guess that in my network where domain has trusts to subdomain and neighbor domain CIFS server stor-1$ are able get UID/GID but I can't understand how to make that (if is possible of course). Because now I can set ACLs, authorizate users, grand permissions to connect to CIFS servers only for my domain accounts: domain.local. secmap shows Origin ldap. I have a few users from sib.domain.local and ext-domain.local but I guess it's because I have the same name-accounts in my AD.

Ideas: I can set server_2 (standby) as primary server, move VDM "vdm_sib_0" to it, set ldap for sib.domain.local domain. However, I don't want to do that. I can enable usermapper/disable ldap - this is the last thing which I want to make. Probably I can enable secondary usermapper (or main?) with ldap but as I read it's a bad idea.

Question: Is it possible to serve different domains on one DM or different VDMs on it (how to be better?) with LDAP not usermapper? How can I set that? If not should I disable LDAP, clean secmap cache and enable usermapper? What about nsswitch.conf? If usermapper is enabled should I back original file?

Thank you!