The option in the NFS Export map-lookup-uid can achieve what you are trying to do here.
What that does to the User coming in from NFS client is lookup his identity (UID,GID and Supplemental Groups) from the AD instead of trusting what he provides directly over the wire.
Example:
Lets say a user BOB from Unix/Linux performs "ls -l" on /nfs1 which is an export (enabled with map-lookup-uid) mounted from OneFS; OneFS will not take BOB's UID and GID that he provides over the wire; but instead look-up BOB in AD and get his identity information if AD is configured. Assumption is that AD provides UID,GID (either via SFU/RFC2307) or some other mechanism.
When a UNIX user attempts to access a file shared by Server for NFS, Server for NFS uses either Active Directory Lookup or User Name Mapping to obtain the corresponding Windows user name of that UNIX user. When the Windows user name is obtained, Server for NFS then passes this information to either a domain controller or the security authority of the local server, depending on the type of account (domain or local):
If the Windows user name is a domain account, then the domain controller authenticates the user with Kerberos extensions called Services-For-User (S4U).
If the Windows user name is a local account, then the local security authority needs the assistance of Server for NFS Authentication. Without Server for NFS Authentication, the local security authority cannot authenticate the user and access will be denied.
To install Server for NFS Authentication
In Control Panel, click Add or Remove Programs. Then click Add/Remove Windows Components.
From the list of components, in the Windows Components Wizard dialog box, select Other Network File and Print Services, and click Details.
From the list of subcomponents, select Microsoft Services for NFS, and click Details again.
Select Server For NFS Authentication, and click OK.
Click OK again and then Next, and after the configuration of the new component has completed, click Finish.
ACHOUKEKAR
22 Posts
14073
0
Posted June 5th, 2014 21:00
The option in the NFS Export map-lookup-uid can achieve what you are trying to do here.
What that does to the User coming in from NFS client is lookup his identity (UID,GID and Supplemental Groups) from the AD instead of trusting what he provides directly over the wire.
Example:
Lets say a user BOB from Unix/Linux performs "ls -l" on /nfs1 which is an export (enabled with map-lookup-uid) mounted from OneFS; OneFS will not take BOB's UID and GID that he provides over the wire; but instead look-up BOB in AD and get his identity information if AD is configured. Assumption is that AD provides UID,GID (either via SFU/RFC2307) or some other mechanism.