Adding local access zone user to folder permissions

specifying clustername\localaccount is the same thing as going to location and changing it there. Neither option allows it to find the local account.

Thought of explicitly using a SID?

Either the one generated by the cluster for the local user,

or the well-known generic S-1-3-0 for Creator-Owner.

-- Peter

i am trying to set folder permission in Windows explorer, not share permissions in Isilon WebUI.

Yes you can:

Each access zone has it's own local auth provider:

isilon3-1# mkdir /ifs/zone2

isilon3-1# isi zone zones create zone2 /ifs/zone2

isilon3-1# isi zone zones view zone2

                Name: zone2

                Path: /ifs/zone2

            Groupnet: groupnet0

       Map Untrusted: -

      Auth Providers: lsa-local-provider:zone2

        NetBIOS Name: -

  User Mapping Rules: -

Home Directory Umask: 0077

  Skeleton Directory: /usr/share/skel

  Cache Entry Expiry: 4H

             Zone ID: 2

isilon3-1# isi auth user create localuser2 --enabled true --password abcd --zone=zone2

isilon3-1#

Chris,

the local account you created is in the system zone, can you create one in another access zone and perform the same steps ?

Personally I'd set the filesystem permissions on the empty folder from the CLI.  Isilon enhanced chmod in OneFS to interact with ACLs.  For details on the exact syntax just do 'man chmod'.

I ran through all the steps you'd need for something like this.  Hope it helps (see below):

isilon3-1# isi auth user create localuser1 --enabled true --password abcd --zone system

isilon3-1# isi auth user view localuser1

                    Name: localuser1

                      DN: CN=localuser1,CN=Users,DC=ISILON3

              DNS Domain: -

                  Domain: ISILON3

                Provider: lsa-local-provider:System

        Sam Account Name: localuser1

                     UID: 2000

                     SID: S-1-5-21-3876962227-3662236066-2290214838-1000

                 Enabled: Yes

                 Expired: No

                  Expiry: -

                  Locked: No

                   Email: -

                   GECOS: -

           Generated GID: No

           Generated UID: No

           Generated UPN: Yes

           Primary Group

                          ID: GID:1800

                        Name: Isilon Users

          Home Directory: /ifs/home/localuser1

        Max Password Age: 4W

        Password Expired: No

         Password Expiry: 2017-08-22T16:46:46

       Password Last Set: 2017-07-25T16:46:46

        Password Expires: Yes

                   Shell: /bin/zsh

                     UPN: localuser1@ISILON3

User Can Change Password: Yes

isilon3-1# mkdir /ifs/application

isilon3-1# chown 2000:1800 /ifs/application

isilon3-1# chmod +a user localuser1 allow generic_all,object_inherit,container_inherit /ifs/application

isilon3-1# isi smb share create application /ifs/application

isilon3-1# isi smb share permission create application localuser1 -d allow -p full --zone system

isilon3-1# isi smb share permission list application

Account    Account Type  Run as Root  Permission Type  Permission

------------------------------------------------------------------

Everyone   wellknown     False        allow            read

localuser1 user          False        allow            full

------------------------------------------------------------------

Total: 2

isilon3-1# isi smb share permission delete application --wellknown Everyone

Are you sure you want to delete persona from application? (yes/[no]): yes

---DONE---

~Chris

Chris,

how do i display the UID of an account the resides inside of an access zone from cli  ?  When i look at my local account in WebUI, it  has UID 2000, so i tried to use that in my chmod command. Well, UID 2000 is also assigned to local account in system zone and that's what actually got set.

Of course, if you just want to display the UID based on the name, you could just use isi auth users --name=X --provider=Y --zone=Z

If you're running a FreeBSD command like 'ls' (as opposed to an isi command that has a --zone flag), you can use the isi_run command to run the command within the context of a particular access zone.  It requires the numeric zone ID.  So for the above example where the zone ID is 2 you could run:

# isi_run -z 2 ls -led /ifs/my/path/file.txt

This will cause the ls command to use the authentication providers in zone 2 rather than the System zone.

AdamFox wrote: Of course, if you just want to display the UID based on the name, you could just use isi auth users --name=X --provider=Y --zone=Z

Adam,

does this syntax work in 8.x   ?  It's complaining about "unknow option name"

Adam,

When i create a local account within my access zone and select provider "LOCAL:system",  i am able to connect to share with that account.  When I use provider "LOCAL:myzonename", i am not able to connect to the share, it keeps prompting for credentials.

When i look at my access zone, Local:myzonename is listed in the list of authentication providers.

When i run isi_run -z 1 ls -led foldername, the LOCAL:system account is listed as it's name, where the account created under LOCAL:myzonename listed with its UID.

Any thoughts on what i am doing wrong ?

Thank you

dynamox

Use the explicit UPN username

From Chris example:

   UPN: localuser1@ISILON3

Phil,

that does not work, keeps prompting to authenticate.

dynamox

Is the local provider listed as Auth Providers? Please give output of # isi zone zones view MyZoneName

example:

# isi zone zones view MyZoneName

                Name: MyZoneName

                Path: /ifs/MyZoneName

            Groupnet: groupnet0

       Map Untrusted: -

      Auth Providers: lsa-local-provider:MyZoneName

        NetBIOS Name: -

  User Mapping Rules:

Home Directory Umask: 0077

  Skeleton Directory: /usr/share/skel

  Cache Entry Expiry: 4H

             Zone ID: 1

#

Glad you got it sorted out Dynamox.  I've found with Isilon that when I apply permissions in the GUI that Isilon does not apply it immediately (or sometimes never).  I find myself running CHMOD commands.

I have a 3 node test cluster on 8.0.1.1 so I can run some tests here for you.  Since you're on our approved version (8.0.0.4) it should work.

Also, if you're doing any SNMP alerting, you might want to reach out to me.  The new 9 digit codes work well but I've found not it doesn't in 8.0.04 but only 8.0.1.X versions.  Long story