UNSOLVED
MG
mlott-gie.com
30 Posts
1
3031
December 16th, 2014 06:00
VNX5200 Unified CIFS with Active Directory and unix attributes
Our current file server is a Linux machine running Samba. I will need to import as much as 24TB of data onto the VNX from that server. Since the current file permissions are based on posix uidnumber/gidnumber, etc., I believe that I will need to maintain the relationships for file ownership and group permissions on import.
As such, I have disabled the user mapper on what is currently a test VDM and CIFS server on our VNX. I have attempted various iterations of configuring the ldap.conf file on the data movers by using "server_file server_2 -put /tmp/ldap.conf /.etc/ldap.conf" as well as "cp /tmp/ldap.conf /nas/site/ldap.conf.server_2". Once that ldap.conf is in place we also copy a simple nsswitch.conf with:
passwd: files ldap
group: files ldap
hosts: dns ldap files
Finally, we run:
server_ldap server_2 -set -p -servers X.X.X.X -binddn BINDDN -domain domain.pri -sslenabled n
...and enter the bindpw for the binddn. server_ldap server_2 -info -verbose now shows all of our configured DNs for users, groups, and computers. However, "server_ldap server_2 -lookup -user USERNAME" does not work. When we try to connect to the CIFS server via \\SERVERNAME or via Computer Management, only the local administrator account works. All other users get an error "The user name could not be found."
This error was displayed with or without the ldap configuration, which was done only when operating without that also did not work.
AD contains standard posix attributes for uidNumber, gidNumber, gecos, unixHomeDirectory, and loginShell. The primary group id of our test user points to Domain Users, which has a gidNumber as well. Several other standard groups as well as Domain Admins have their attributes as well. I have attempted to configure the ldap.conf to make this work.
Configuring ldap through the GUI does allow administrative users to login to Unisphere. That's nice, but not my ultimate goal.
I am either overthinking this or am trying to make it do something it won't. I suppose that if I could find a way to make the translation work on import I might not need these attributes in AD at all going forward.
Any clues? I probably need some consulting help either way.
mlott-gie.com
30 Posts
662
0
Posted December 16th, 2014 11:00
This is all Active Directory. I can lookup uid, which is actually uidnumber, and get information about the user account.
Our AD is not currently using any additional object classes or services. But, we have a tool to manage the existing posix attributes for user and group accounts. I found some good information also at this site:
EMC VNX Integration Quest Vintela Authentication Services - Level NERDLevel NERD
I added all of the nss_map_attributeS shown here and got the uid lookup to work:
# Attributes
nss_map_attribute userPassword unixUserPassword
nss_map_attribute homeDirectory unixHomeDirectory
nss_map_attribute uid sAMAccountNamenss_map_attribute uniqueMember member
nss_map_attribute givenname givenName
nss_map_attribute ou description
nss_map_attribute shadowLastChange pwdLastSet
nss_map_attribute uidNumber uidNumber
nss_map_attribute gidNumber gidNumber
nss_map_attribute gecos gecos
nss_map_attribute loginShell loginShellI have already made one try with tech support almost 2 weeks ago but they told me everything is setup correctly. I hadn't even started configuring ldap.conf at that point and was getting zero access with usermapper disabled and no NIS, etc.
Rainer_EMC
6 Operator
•
8645 Posts
801
0
Posted December 16th, 2014 14:00
Hmmh – I don’t think we do any filtering on server_ldap – it just queries to the LDAP server
You might want to verify with a generic LDAP lookup tool / browser
mlott-gie.com
30 Posts
801
0
Posted December 16th, 2014 15:00
It's not so much filtering as it is not being able to search by name. I can search uidnumber and get the user information. After that looking up the same user by username is possible. Must be something missing in my ldap.conf.
Rainer_EMC
6 Operator
•
8645 Posts
801
0
Posted December 16th, 2014 16:00
If this is reproducable I would suggest to open a service request
mlott-gie.com
30 Posts
801
0
Posted December 16th, 2014 18:00
Will do. Thanks.
mlott-gie.com
30 Posts
801
0
Posted December 17th, 2014 05:00
I'm not sure which passwd file you're talking about. As far as I know this information is in Active Directory only, except for whatever local cache may exist. I current have the uid field nss_map_attribute field pointing to sAMAccountName, which is just the username. Also, I have changed the cifs_resolver value to 1 already.
[nasadmin@vnx1 ~]$ server_param server_2 -facility cifs -list | grep resolver
resolver cifs 0 1 1
Note that ldapsearch with bind works just fine connecting to the DC from the control station at least. Also, group lookups work either way, by name or number, using server_ldap.
mlott-gie.com
30 Posts
583
0
Posted December 18th, 2014 14:00
We will be working with a local 3rd party specialist on this since it is not technically broken per EMC. I will try to remember to reply back if and when we get this resolved.
mlott-gie.com
30 Posts
801
0
Posted December 16th, 2014 08:00
We have since been able to do lookups based on the -uid field:
server_ldap server_2 -lookup -uid 12345
However, until we do that manually for each user, it seems that is it unable to do the mapping for username to uidnumber.