We have set up NFSv4 w/ kerberos on our Isilon and I am able to mount the NFSv4 export but am unable to write to it.

It seems that I have the proper permissions but I am unable to figure out why I am getting Permission Denied when I try and touch a file.

Any ideas?

Isilon OneFS v8.0.0.4

Client Side Info:

server1 = Red Hat Enterprise Linux Server release 7.4 (Maipo)

[brian@server1 ~]$ mount

nfsv4.storage.edu:/brian-v4 on /mnt/brian-v4 type nfs4 (rw,relatime,vers=4.0,rsize=32768,wsize=32768,namlen=255,hard,proto=tcp,port=0,timeo=600,retrans=2,sec=krb5p,clientaddr=xxx.xxx.xxx.xxx,local_lock=none,addr=xxx.xxx.xxx.xxx)

[brian@server1 ~]$ ls -al /mnt/brian-v4

total 40

drwxr-xr-x. 2 brian root  0 Apr 19 09:30 .

drwxr-xr-x. 6 root     root 74 Apr  4 13:36 ..

[brian@server1 ~]$ id

uid=12345678(brian) gid=100(users) groups=100(users),44444(sanadmin) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023

[brian@server1 ~]$ touch /mnt/brian-v4/test.txt

touch: cannot touch ‘/mnt/brian-v4/test.txt’: Permission denied

Isilon Side Info:

isilon-1# ls -al /ifs/data/nfs4/b/brian-v4

total 43

drwxr-xr-x    2 12345678  wheel   0 Apr 19 09:30 .

drwxr-xr-x    3 root      wheel  29 Mar 30 16:36 ..

isilon-1# ls -led /ifs/data/nfs4/b/brian-v4

drwxr-xr-x    2 12345678  wheel  0 Apr 19 09:30 /ifs/data/nfs4/b/brian-v4

OWNER: user:12345678

GROUP: group:wheel

SYNTHETIC ACL

0: user:12345678 allow dir_gen_read,dir_gen_write,dir_gen_execute,std_write_dac,delete_child

1: group:wheel allow dir_gen_read,dir_gen_execute

2: everyone allow dir_gen_read,dir_gen_execute

isilon-1# isi nfs export view 3 --zone nfs4

                     ID: 3

                   Zone: NFS4

                  Paths: /ifs/data/nfs4/b/brian-v4

            Description: -

                Clients: server1

           Root Clients: -

      Read Only Clients: -

     Read Write Clients: -

               All Dirs: Yes

             Block Size: 8.0k

           Can Set Time: Yes

       Case Insensitive: No

        Case Preserving: Yes

       Chown Restricted: No

    Commit Asynchronous: No

Directory Transfer Size: 128.0k

               Encoding: DEFAULT

               Link Max: 32767

         Map Lookup UID: No

              Map Retry: Yes

               Map Root

                    Enabled: True

                       User: nobody

              Primary Group: -

           Secondary Groups: -

           Map Non Root

                    Enabled: False

                       User: nobody

              Primary Group: -

           Secondary Groups: -

            Map Failure

                    Enabled: False

                       User: nobody

              Primary Group: -

           Secondary Groups: -

               Map Full: Yes

          Max File Size: 8192.00000P

          Name Max Size: 255

            No Truncate: No

              Read Only: No

            Readdirplus: Yes

   Readdirplus Prefetch: 10

  Return 32Bit File Ids: No

Read Transfer Max Size: 1.00M

Read Transfer Multiple: 512

     Read Transfer Size: 128.0k

          Security Type: krb5, krb5i, krb5p

   Setattr Asynchronous: No

               Snapshot: -

               Symlinks: Yes

             Time Delta: 1.0 ns

  Write Datasync Action: datasync

   Write Datasync Reply: datasync

  Write Filesync Action: filesync

   Write Filesync Reply: filesync

  Write Unstable Action: unstable

   Write Unstable Reply: unstable

Write Transfer Max Size: 1.00M

Write Transfer Multiple: 512

    Write Transfer Size: 512.0k

isilon-1# isi auth mapping token --user=brian --zone=nfs4

                   User

                       Name: brian

                        UID: 12345678

                        SID: S-1-22-1-12345678

                    On Disk: 12345678

                    ZID: 10

                   Zone: NFS4

             Privileges: -

          Primary Group

                       Name: -

                        GID: -

                        SID: S-1-22-2-10

                    On Disk: S-1-22-2-10

Supplemental Identities

                       Name: Authenticated Users

                        UID: -

                        GID: -

                        SID: S-1-5-11

User brian UID = 12345678 on the client linux server.   That UID is set as owner on client mountpoint with rwx.   The isilon export path owner is set to the proper UID as well and when I do an isi auth mapping token the user brian comes back with the proper UID.

What am I missing?