I wouldn’t recommend to manually edit the secmap – please see the User Mapping manual for your options

It really depends on where you want to store/administer your mapping.

What are you doing right now?

Do you have usermapper disabled ?

Dear Rainer

thank you so much for your advice

what we have now that the default user mapping in our celerra now disabled

and we use external user mapping because we have multiprotocole environment which let the unix users and windows users access the same data at the same time so

as you know from EMC doc there is 4 methods to configure user mapping for mutliprotocole environment

1- LDAP-based directory services, such as the Active Directory (that uses Microsoft Windows

Services for UNIX [SFU] or Identity Management for UNIX [IdMU])

2-  A Data Mover’s local user and group files

3-  Network Information Service (NIS)

4-  Active Directory (by using Celerra CIFS Microsoft Management Console [MMC] snap-ins)

and in our environment all unix users registered in our NIS  so we used method number  3

so now the secmap build automatically get the UID from NIS and SID from active directory because the cifis server jioned to the AD domain

but in the secmap you will find just UID to SID  so secmap in our case cover just the usermapping

but in our environment we have alot of AD groups and unix groups   and we need to cover the groups mapping part too

so what we can do it such case

is there any command to insert record manually in the secmap ?

or can i keep everything as it is and build local group file to let data mover  query the groups mapping  from local groups file as in  method number 2 for external usermapping  (( A Data Mover’s local user and group files ))

if this possible that mean data mover will use secamp to cover the usermapping part and local groups file to cover the groups mapping 

but if this not possible what i can do in such case

please help if you can and we will keep in touch

have a nice day

regards

Hussam

Dear Rainer

i would like to thank you so much because you try to help me in my case

now in our current ruining environment the user mapping work very well

as i told you the data mover client for our NIS and the the cifs server joined  to the domain 

and we have no VDM  and we will not configure VDM at all

all what we need to share 5 files systems as cifs and NFS  because this shared file system will be accessible from both users UNIX users and windows users

and we have alot of differences between the AD groups and UNIX groups names for this we need to make sure that the groups mapping work very well 

in current configuration the secmap look very good  UID to SID so i think user mapping work well

but if there is no way to let  groups mapping work automatically like our current user mapping

so what you think i have to stop use this way and build the local passwd and groups and put them in DM and that it

but for sure i prefer if i can have any configuration will provide automatic user mapping and groups mapping  

i found something online said

#####################################################

Once you have NIS configured, the Data Mover automatically checks NIS for a user

and group name. By default, it checks for a username in the form username.domain

and a group name in the form groupname.domain. If you have added usernames

and groupnames to NIS without a domain association, you can set the cifs resolver

parameter so the Data Mover looks for the names without appending the domain.

server_param server_2  -facility cifs -info resolver

server_param server_2  -facility cifs -modify resolver -value 1

repeat to all DM, but not applicable to VDM

Setting the above will allow CIFS username lookup from NIS to match based on username,

without the .domain suffix.  Use it!  (Haven't seen a situation where this is bad)

server_param server_2 -f cifs -m acl.useUnixGid -v 1

Repeat for for all DM, but not for VDM.

This setting affect only files created on windows. UID is mapped by usermapper.

GID of the file will by default map to whatever GID that Domain User maps to.

Setting this setting, unix primary group of the user is looked up and used as

the GID of any files created from windows.

Windows group permission settings retains whatever config is on windows

(eg inherit from parent folder).

############################################################

but i don't understand this sentence very well

(( GID of the file will by default map to whatever GID that Domain User maps to.

Setting this setting, unix primary group of the user is looked up and used as

the GID of any files created from windows ))

if my current configuration OK and will cover for me user mapping and groups mapping so i will do nothing . again i am satisfied about user mapping by UID to SID which i have now but is this configuration will cover groups mapping too if yes i will do nothing but if no i need your help and i want you to be patient

again thanks alot for your help

regards

Hussam

NIS isnt really great for group mapping – it’s a Unix based directory service and only covers the way Unix groups work.

Unix group cannot contain other groups and they are often limited to 16 members – Windows groups are very different there.

If your Unix groups are the same literal name as the Windows groups and you only have one Windows domain then you can set the param cifs.resolv to 1 to drop the domain name from mapping.

Watch out for uppercase/lowercase differences there.

User mapping and multi-protocol can get a bit complicated – I recommend to try on a simulator first and maybe get professional services involved.

Secmap is really only meant as a persistent cache so that we don’t have latency of asking the user mapping sources every time – so I don’t recommend it to do manual mapping.

Besides secmap is per VDM – so you would have to do that on every VDM and every VNX

Rainer

I assume you mean the useUnixGid – yes that can be a bit confusing.

That’s another difference between Windows and Unix – In Unix every user has a primary group and then optional some secondary groups he also belongs to.

IN Unix every file/dir has both a user and group owner.

In Windows there is no notion of a primary group – you can be in no group at all and all groups are equal.

Normal Active Directory has no setting for what your primary group is – only if you use the RFC extension but then you need to also manually maintain it.

Also there is only one owner for a file/dir in Windows – that can be either a user or a group

So when you create a file through CIFS we have to also store a UID and GID owner in the file system.

The UID is simply from the user mapping – for the GID by default we would take the mapped GID of the first Windows group the user is a member of.

This param allows you to change that behaviour and use the GID as defined in NIS or password file instead of the mapped GID

Hope that explains it.

Technically you can mix different user mapping methods like NIS and local files or ntxmap – we just normally don’t recommend it because it can get quite confusing – especially when they contain different information.

Which of the params do you currently have set ?

yes 100 %  you got it this is my situation

so now what you command me to do to cover the groups mapping in my situation

1- creat local groups file which will inculde the GUIfrom unix side and GSID  from windows side and move this file to DM

or you think no need to do this the current configuration (( secmap which inculde UID to SID )) enough

or maybe you can tell me step by step what i have to do to cover the groups mapping

in case you need some file from DM  i can attach them to you and then maybe you can give me the perfect advice

thanks again

regards

Hussam

thank you alot the information you gave to me it very good

and now i have to install simulator to test this

so you think i can install celerra simulator on our vsphere environmental (( deploy OVA file ))

and configure this simulator as NIS client and creat cifs server and join to the same domain and try to test to usemapping  and group mapping as i want

then we will see what the best configuration  to cover our needs

but maybe i need your help during build this test environment  i will update this question in case i faced any issue during  prepare this test environment

but in the celerra simulator is there any space to create for test at least one shard file system ?

i never used celerra simulator before i will do it and we will  see

thank you alot alot alot

regards

Hussam 

Simulator works with vmWare Player, Workstation or vpSphere as long as you have a 64bit CPU

Just follow the installation manual

I think default gets you about 22GB of virtual storage – that should be enough for a few test file systems