<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:x="urn:schemas-microsoft-com:office:excel" xmlns:dt="uuid:C2F41010-65B3-11d1-A29F-00AA00C14882" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"> <head> <meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> <meta name="Generator" content="Microsoft Word 15 (filtered medium)"> <style></style> </head> <body lang="DA" link="#0563C1" vlink="#954F72"> <div class="WordSection1"> VERSION: 4.4.0, API_VERSION: 2.213 on rhel7. <o:p></o:p> <o:p> </o:p> ipa server was recently upgraded to version 4.4 from version 4.2 and it seems that we are having problems with users created after the upgrade. Of course, it could be<o:p></o:p> something I forgot.<o:p></o:p> <o:p> </o:p> Our environment consist of an hds nfs server, a couple of ipa servers – rhel7 and a lot of clients - rhel6. The NFS server is not part of the idm domain, i.e. not joined, but of course has a keytab created on the ipa server. The NFS server provides common shares, mounted as krb5p on the clients.<o:p></o:p> <o:p> </o:p> All this workes fine and the mapping is correct for all existing users. That is, if I log into a client, get a Kerberos ticket for myself and create a file on<o:p></o:p> one of the shares, uid and gid are set to my uid and gid.<o:p></o:p> <o:p> </o:p> But if I create a new user on the ipa server and do the same, the gid on the newly created file is “nobody(99)” whereas the uid is correct.<o:p></o:p> I have tested with two different users – same result.<o:p></o:p> <o:p> </o:p> klist shows the default principal to be correct. <o:p></o:p> For user mqm uid=1414 gid=1414, rpc.gssd shows,that after finding the user credentials, for some reason there is a switch to machine credentials:<o:p></o:p> <o:p> </o:p> <o:p> </o:p> Dec 6 12:17:16 nfsclient rpc.gssd[1607]: handling gssd upcall (/var/lib/nfs/rpc_pipefs/nfs/clnt0)<o:p></o:p> Dec 6 12:17:16 nfsclient rpc.gssd[1607]: handle_gssd_upcall: 'mech=krb5 uid=1414 enctypes=18,17,16,23,3,1,2 '<o:p></o:p> Dec 6 12:17:16 nfsclient rpc.gssd[1607]: handling krb5 upcall (/var/lib/nfs/rpc_pipefs/nfs/clnt0)<o:p></o:p> Dec 6 12:17:16 nfsclient rpc.gssd[1607]: process_krb5_upcall: service is '<null>'<o:p></o:p> Dec 6 12:17:16 nfsclient rpc.gssd[1607]: getting credentials for client with uid 1414 for server jnsa-dnt2.domaine.com<o:p></o:p> Dec 6 12:17:16 nfsclient rpc.gssd[1607]: CC file '/tmp/krb5cc_1622800027_u0vmh1' being considered, with preferred realm 'DOMAINE.COM'<o:p></o:p> Dec 6 12:17:16 nfsclient rpc.gssd[1607]: CC file '/tmp/krb5cc_1622800027_u0vmh1' owned by 1622800027, not 1414<o:p></o:p> Dec 6 12:17:16 nfsclient rpc.gssd[1607]: CC file '/tmp/krb5cc_1414_bVlw8x' being considered, with preferred realm 'DOMAINE.COM'<o:p></o:p> Dec 6 12:17:16 nfsclient rpc.gssd[1607]: CC file '/tmp/krb5cc_1414_bVlw8x'(mqm@DOMAINE.COM) passed all checks and has mtime of 1481022999<o:p></o:p> Dec 6 12:17:16 nfsclient rpc.gssd[1607]: CC file '/tmp/krb5cc_machine_DOMAINE.COM' being considered, with preferred realm 'DOMAINE.COM'<o:p></o:p> Dec 6 12:17:16 nfsclient rpc.gssd[1607]: CC file '/tmp/krb5cc_machine_DOMAINE.COM' owned by 0, not 1414<o:p></o:p> Dec 6 12:17:16 nfsclient rpc.gssd[1607]: CC file '/tmp/krb5cc_0' being considered, with preferred realm 'DOMAINE.COM'<o:p></o:p> Dec 6 12:17:16 nfsclient rpc.gssd[1607]: CC file '/tmp/krb5cc_0' owned by 0, not 1414<o:p></o:p> Dec 6 12:17:16 nfsclient rpc.gssd[1607]: using FILE:/tmp/krb5cc_1414_bVlw8x as credentials cache for client with uid 1414 for server jnsa-dnt2.domaine.com<o:p></o:p> Dec 6 12:17:16 nfsclient rpc.gssd[1607]: using environment variable to select krb5 ccache FILE:/tmp/krb5cc_1414_bVlw8x<o:p></o:p> Dec 6 12:17:16 nfsclient rpc.gssd[1607]: creating context using fsuid 1414 (save_uid 0)<o:p></o:p> Dec 6 12:17:16 nfsclient rpc.gssd[1607]: creating tcp client for server jnsa-dnt2.domaine.com<o:p></o:p> Dec 6 12:17:16 nfsclient rpc.gssd[1607]: DEBUG: port already set to 2049<o:p></o:p> Dec 6 12:17:16 nfsclient rpc.gssd[1607]: creating context with server nfs@jnsa-dnt2.domaine.com<o:p></o:p> Dec 6 12:17:16 nfsclient rpc.gssd[1607]: DEBUG: serialize_krb5_ctx: lucid version!<o:p></o:p> Dec 6 12:17:16 nfsclient rpc.gssd[1607]: prepare_krb5_rfc4121_buffer: protocol 1<o:p></o:p> Dec 6 12:17:16 nfsclient rpc.gssd[1607]: prepare_krb5_rfc4121_buffer: serializing key with enctype 18 and size 32<o:p></o:p> Dec 6 12:17:16 nfsclient rpc.gssd[1607]: doing downcall lifetime_rec 86363<o:p></o:p> Dec 6 12:17:16 nfsclient rpc.gssd[1607]: handling gssd upcall (/var/lib/nfs/rpc_pipefs/nfs/clnt0)<o:p></o:p> Dec 6 12:17:16 nfsclient rpc.gssd[1607]: handle_gssd_upcall: 'mech=krb5 uid=0 service=* enctypes=18,17,16,23,3,1,2 '<o:p></o:p> Dec 6 12:17:16 nfsclient rpc.gssd[1607]: handling krb5 upcall (/var/lib/nfs/rpc_pipefs/nfs/clnt0)<o:p></o:p> Dec 6 12:17:16 nfsclient rpc.gssd[1607]: process_krb5_upcall: service is '*'<o:p></o:p> Dec 6 12:17:16 nfsclient rpc.gssd[1607]: Full hostname for 'jnsa-dnt2.domaine.com' is 'jnsa-dnt2.domaine.com'<o:p></o:p> Dec 6 12:17:16 nfsclient rpc.gssd[1607]: Full hostname for 'nfsclient.domaine.com' is 'nfsclient.domaine.com'<o:p></o:p> Dec 6 12:17:16 nfsclient rpc.gssd[1607]: No key table entry found for nfsclient$@DOMAINE.COM while getting keytab entry for 'nfsclient$@DOMAINE.COM'<o:p></o:p> Dec 6 12:17:16 nfsclient rpc.gssd[1607]: No key table entry found for nfsclient$@DOMAINE.COM while getting keytab entry for 'nfsclient$@DOMAINE.COM'<o:p></o:p> Dec 6 12:17:16 nfsclient rpc.gssd[1607]: No key table entry found for root/nfsclient.domaine.com@DOMAINE.COM while getting keytab entry for 'root/nfsclient.domaine.com@DOMAINE.COM'<o:p></o:p> Dec 6 12:17:16 nfsclient rpc.gssd[1607]: No key table entry found for nfs/nfsclient.domaine.com@DOMAINE.COM while getting keytab entry for 'nfs/nfsclient.domaine.com@DOMAINE.COM'<o:p></o:p> Dec 6 12:17:16 nfsclient rpc.gssd[1607]: Success getting keytab entry for 'host/nfsclient.domaine.com@DOMAINE.COM'<o:p></o:p> Dec 6 12:17:16 nfsclient rpc.gssd[1607]: INFO: Credentials in CC 'FILE:/tmp/krb5cc_machine_DOMAINE.COM' are good until 1481109339<o:p></o:p> Dec 6 12:17:16 nfsclient rpc.gssd[1607]: INFO: Credentials in CC 'FILE:/tmp/krb5cc_machine_DOMAINE.COM' are good until 1481109339<o:p></o:p> Dec 6 12:17:16 nfsclient rpc.gssd[1607]: using FILE:/tmp/krb5cc_machine_DOMAINE.COM as credentials cache for machine creds<o:p></o:p> Dec 6 12:17:16 nfsclient rpc.gssd[1607]: using environment variable to select krb5 ccache FILE:/tmp/krb5cc_machine_DOMAINE.COM<o:p></o:p> Dec 6 12:17:16 nfsclient rpc.gssd[1607]: creating context using fsuid 0 (save_uid 0)<o:p></o:p> Dec 6 12:17:16 nfsclient rpc.gssd[1607]: creating tcp client for server jnsa-dnt2.domaine.com<o:p></o:p> Dec 6 12:17:16 nfsclient rpc.gssd[1607]: DEBUG: port already set to 2049<o:p></o:p> Dec 6 12:17:16 nfsclient rpc.gssd[1607]: creating context with server nfs@jnsa-dnt2.domaine.com<o:p></o:p> Dec 6 12:17:16 nfsclient rpc.gssd[1607]: DEBUG: serialize_krb5_ctx: lucid version!<o:p></o:p> Dec 6 12:17:16 nfsclient rpc.gssd[1607]: prepare_krb5_rfc4121_buffer: protocol 1<o:p></o:p> Dec 6 12:17:16 nfsclient rpc.gssd[1607]: prepare_krb5_rfc4121_buffer: serializing key with enctype 18 and size 32<o:p></o:p> Dec 6 12:17:16 nfsclient rpc.gssd[1607]: doing downcall lifetime_rec 86303<o:p></o:p> <o:p> </o:p> Regards<o:p></o:p> Bjarne Blichfeldt.<o:p></o:p> <o:p> </o:p> </div> </body> </html>