This post is more than 5 years old
1 Message
0
665
June 7th, 2007 14:00
Windows Server 2003 R2 and Celerra UNIX User Management MMC
Hi Folks --
We have Windows AD Domain running on Server 2003 R2 platforms. We've also have installed the Identity Management for UNIX Windows component to take advantage of the schema extension in R2; there is a tab in the Active Directory Users and Computers MMC labelled 'UNIX Attributes' that allows us to set uid, gid, home directory, shell, etc. Our environment here is a mix of Windows and Linux hosts. We have a Celerra NS502:
$ nas_version -l
Name : emcnas Relocations: /nas
Version : 5.5.23 Vendor: EMC
Release : 2 Build Date: Wed 30 Aug 2006 03:36:41 PM PDT
Size : 473649772 License: EMC Copyright
Packager : EMC Corporation
URL : http://www.emc.com
Summary : EMC nfs base install
Description :
EMC nfs base install
The Linux hosts use Kerberos from AD for authentication, and LDAP from AD for authorization.
We have also installed the Celerra UNIX User Management MMC, to map SIDs->UIDs on the Celerra.
However, once a SID is mapped, we cannot make any changes to this mapping; e.g. trying to change UID for a user will not work, as we have to destroy and recreate the account from scratch with new SID and UID mapping.
We were told that the R2 schema extensions were problematic. That we should have installed Windows Server 2003 SP1 with the Celerra UNIX User Management MMC (as this would extend the schema) to correctly setup the SIDs->UIDs translations.
Can you let us know if my knowlege on this subject is correct? Would the Celerra UNIX User Management MMC shema extension work with our Linix clients, like the R2 schema extensions do? Will the Celerra software support R2 in the future?
Thanks for any help you can provide!
We have Windows AD Domain running on Server 2003 R2 platforms. We've also have installed the Identity Management for UNIX Windows component to take advantage of the schema extension in R2; there is a tab in the Active Directory Users and Computers MMC labelled 'UNIX Attributes' that allows us to set uid, gid, home directory, shell, etc. Our environment here is a mix of Windows and Linux hosts. We have a Celerra NS502:
$ nas_version -l
Name : emcnas Relocations: /nas
Version : 5.5.23 Vendor: EMC
Release : 2 Build Date: Wed 30 Aug 2006 03:36:41 PM PDT
Size : 473649772 License: EMC Copyright
Packager : EMC Corporation
URL : http://www.emc.com
Summary : EMC nfs base install
Description :
EMC nfs base install
The Linux hosts use Kerberos from AD for authentication, and LDAP from AD for authorization.
We have also installed the Celerra UNIX User Management MMC, to map SIDs->UIDs on the Celerra.
However, once a SID is mapped, we cannot make any changes to this mapping; e.g. trying to change UID for a user will not work, as we have to destroy and recreate the account from scratch with new SID and UID mapping.
We were told that the R2 schema extensions were problematic. That we should have installed Windows Server 2003 SP1 with the Celerra UNIX User Management MMC (as this would extend the schema) to correctly setup the SIDs->UIDs translations.
Can you let us know if my knowlege on this subject is correct? Would the Celerra UNIX User Management MMC shema extension work with our Linix clients, like the R2 schema extensions do? Will the Celerra software support R2 in the future?
Thanks for any help you can provide!
No Events found!
Rainer_EMC
6 Operator
•
8.6K Posts
0
June 13th, 2007 07:00
the reason that a UID change seemingly doesnt work is that the Celerra (specifically each data mover and virtual data mover) has a so-called secmap cache for SID-UID mappings.
This is there for performance reasons so that we dont have to do expensive LDAP calls every time.
To view or change these mappings there is a new server_cifssupport command. You might have to ask for a DART update - I think it has been added in 5.5.24
server_cifssupport { | ALL }
{ -pingdc
{-netbios | -compname }
[-dc ]
[-verbose]}
| {-accessright
{{-name [-domain ]}
|-sid | -uname | -uid }
{-path | -share }
[-policy {mixed | native | secure | nt | unix}]
[-build [-admin ]]
[-netbios | -compname
| -standalone ]}
| { -cred {{-name [-domain ]}
| -sid | -uname | -uid }
[ -build [-ldap][-admin ]]
[ -netbios | -compname
| -standalone ]}
| { -secmap
{-list
[-name [-domain ]]
| -domain
| -sid
| -uid
| -gid }
|{-create
{-name [-domain ]}
| -sid }
|{-verify
{-name [-domain ]}
| -domain
| -sid }
|{-update
{-name [-domain ]}
| -domain
| -sid }
|{-delete
{-name [-domain ]}
| -sid }
|{-export [-file ]}
|{-import -file }
|{-report}}
Rainer_EMC
6 Operator
•
8.6K Posts
1
June 13th, 2007 07:00
1) the EMC AD schema extension that the Celerra Unix User Management mmc plugin installs - that one is queried by the Celerra directly. This is proprietary so the Windows Identity management wouldnt know about these fields
2) the Microsoft AD schema extension that comes with the Identity Management (previously Services for Unix) - that one the Celerra doesnt know directly. You can however setup the Microsoft AD controller to provide a NIS map with these mappings that the Celerra then uses thru NIS
yes, there are plans to change that in the future - please contact your local EMC Celerra specialist for details
It would also be nice if you could file a product enhancement request through Powerlink asking for Windows IM schema support
Showing that there is customer demand is certainly helpfull for getting something implemented
For both of the user mapping methods my secmap comments apply though - you'd have to manually delete the secmap entry when chaning a SID-UID mapping.
Plus going thru the users files already on the Celerra and changing their Unix ownership
There also is an option to turn off secmap completely - but that could have a performance impact.