PowerScale: How to SSH With Duplicate Usernames

Summary: It is possible for the same username to exist across multiple authority providers, either local to OneFS or external. This can result in an inability to log in for the given user. A second root user on another provider can make it appear that root access to the cluster is unavailable. ...

This article applies to This article does not apply to This article is not tied to any specific product. Not all product versions are identified in this article.
Check out other resources

Instructions

SSH to the cluster using the domain name: 
#ssh <user>@<domain>@<ip>

i.e. - #ssh root@UNIX_USERS@<ip>

A duplicate root user appears in the output of isi auth users list:

# isi auth users list

Name        
-------------
Guest       
root        
root        
admin       
compadmin   
remotesupport
ftp         
insightiq   
www         
_lldpd      
nobody      
git_daemon  
-------------
Total: 12

These are different users sharing the same name that exists on different domains.

Issue the following command string to see that these are different users:

# for i in $(isi auth status | grep active | awk '{print $1}'); do echo $i; isi auth users view root --provider=$i | egrep "Name|Domain|UID|UPN";echo ; done

lsa-local-provider:System

                    Name: root
              DNS Domain: -
                  Domain: CLUSTER2
        Sam Account Name: root
                     UID: 2000
           Generated UID: No
           Generated UPN: Yes
                        Name: Isilon Users
                     UPN: root@CLUSTER2


lsa-file-provider:System

                    Name: root
              DNS Domain: -
                  Domain: UNIX_USERS
        Sam Account Name: root
                     UID: 0
           Generated UID: No
           Generated UPN: Yes
                        Name: wheel
                     UPN: root@UNIX_USERS

The valid User Principal Name (UPN) used for access is shown above.

Additional Information

Do not use a username that matches one in the lsa-file-provider:System provider. Removing these helps prevent potential issues with access or services.

Workaround for access:

  1. Use the UPN during SSH:
#ssh <user>@<domain>@<ip>

i.e. - #ssh root@UNIX_USERS@<ip>
  1. Change the provider order in the zone so that the preferred user's provider appears first. This is, by default, set to lsa-file-provider:System first, where the true root lives in lsa-file-provider:System. By putting the file-provider first, it looks at the true root for login details.    
# isi zone zones view System

                       Name: System
                       Path: /ifs
                   Groupnet: groupnet0
              Map Untrusted: -
             Auth Providers: lsa-local-provider:System, lsa-file-provider:System
               NetBIOS Name: -
         User Mapping Rules: -
       Home Directory Umask: 0077
         Skeleton Directory: /usr/share/skel
         Cache Entry Expiry: 4H
Negative Cache Entry Expiry: 1m
                    Zone ID: 1
  
powerscale1-1# isi zone zones modify System --auth-providers=lsa-file-provider:System,lsa-local-provider:System

Affected Products

PowerScale OneFS

Products

PowerScale OneFS
Article Properties
Article Number: 000156516
Article Type: How To
Last Modified: 01 تموز 2026
Version:  5
Find answers to your questions from other Dell users
Support Services
Check if your device is covered by Support Services.