Hello -

Does anyone the syntax or an example to modify or set the share permission on an Isilon using a SID when there are multiple AD domains?

In my example, the provider is ADS:FOOINC.ORG with two active directory domains: fooinc.org and fooroot.org. In this case, all my SIDs are from the "fooinc.org" active directory domain.

Leveraging commands from https://community.emc.com/docs/DOC-7112 I am able to list permissions for a share with the SIDs. 

Here an example output:

ACL DUMP REPORT

Share        : \\FOO-ISFIL1\ServerTechs

UID          : 32772

GID          : 32776

Rights       : rwxr-xr-x

owner SID    : S-1-5-15-70cd0fe5-61e22ca0-17c15952-1e2a

group SID    : S-1-5-15-70cd0fe5-61e22ca0-17c15952-201

DACL

GROUP 33028 S-1-5-15-70cd0fe5-61e22ca0-17c15952-1d58d

ALLOWED 0x0 0x1f01ff RWXPDO

GROUP 32780 S-1-5-15-70cd0fe5-61e22ca0-17c15952-4b3a

ALLOWED 0x0 0x1f01ff RWXPDO

While that same document also includes a method to map the SID back to a friendlier FOOCORP\USER1 account, I am looking to bypass that step if possible.

nasadmin@FOO-VNX-CS0 ~]$ server_cifssupport FOO-vdm1 -secmap -list -sid  S-1-5-15-70cd0fe5-61e22ca0-17c15952-4b3a -acl -share "ServerTechs"

FOO-vdm1 : done

SECMAP GROUP MAPPING TABLE

GID         Origin      Date of creation         Name                            SID

32780       usermapper  Wed Nov 16 10:56:12 2011 FOOCORP\USER1         S-1-5-15-70cd0fe5-61e22ca0-17c15952-4b3a

Due to internal regulations, the shares are configured with share-level permissions in addition to the NTFS permissions on the folders and files themselves. 

Here are the results of my attempt to set the permissions using the SID>

ISILON-1# isi smb shares permission create testshare1 --zone=System --permission-type allow --permission change --sid S-1-5-15-70cd0fe5-61e22ca0-17c15952-4b3a

Failed to create persona 'SID:S-1-5-15-70cd0fe5-61e22ca0-17c15952-4b3a'

ISLION-1#

There are 300 shares to recreate and configure with share-level permissions. 

Many thanks in advance for any help or ideas.