Dell Unity - Multi Protocol CIFS Access denied: The Username could not be found
Summary: Impact - Multi protocol setup in unity may get Access Denied and User name cannot be found despite proper LDAP setup (User Correctable)
Symptoms
A user has setup an LDAP Multi Protocol SMB NAS Server however every attempt to mount is getting ACCESS DENIED:
The Username cannot be found.
Facts:
- LDAP is set up with an Active Directory domain controller.
- Problem is occurring on initial UNC access even with domain administrator account, so not even share access (ACLs permission irrelevant)
- Access from various locations including domain controller showing same issue:
C:\Users\administrator>net use \\unity_sp_a System error 2221 has occurred. The user name could not be found.
- Customer would like to use a generic account as workaround for all unix mapping in the interim.
Cause
There is no actual valid UNIX mapping on the active directory, so Identity management for unix is NOT installed.
svc_cifssupport NAS1 -secmap -list NAS1 : done SECMAP GROUP MAPPING TABLE GID Origin Date of creation Name SID 4294967294 unknown Tue Oct 25 22:00:14 2016 domain\user1 S-1-5-15-xxxxxxx-xxxxxx-xxxxxx-483 4294967294 unknown Thu Oct 13 20:20:55 2016 domain\svc_emc S-1-5-15-xxxxxxx-xxxxxx-xxxxxx-173b8 4294967294 unknown Wed Oct 26 17:38:55 2016 domain\administrator S-1-5-15-xxxxxxx-xxxxxx-xxxxxx-1f4
Resolution
On the initial Unity release, local users or any internal mapping is Unsupported.
There is no option to use NTXMAP as well, as that to itself does not provide UID mapping, only matching.
(so if nis/ldap /local files mapping does not exist, NTXMAP cannot work)
The Unity administrator must install Active Directory Identity Management for UNIX and perform UID setup on users.
The only other alternative is not use MultiProtocol NAS server setup (which would disallow same file system MP access).
The following Screenshot is an example of setting up UID for administrator account in the AD schema:
Once UID is set up for LDAP, authentication would proceed properly.
Additional Information
Local Users was unsupported during initial release but is supported in release 4.1.x. Upgrade to the most current release.
In the case that local users support is initiated, the Unity administrator must consider the following:
- Using a single unix mapping for all users is going to render quotas unusable. (UID based)
- Using the local passwd file for multiple users creates a management overhead as both AD and Local Users require regular updates.
- Using local passwd file must adhere to unix file standards.
- Using NTXMAP or instead mapping to a single default unix account is possible in Unisphere as well, but is not recommended for the above 1-2 reasons.