<div dir="ltr">grumble grumble.<div><br></div><div>Do you know a bug ID or something similar i can search on? FWIW, FreeIPA server is CentOS 6.5, but the client is Ubuntu 14. Hopefully that makes a fix easier. :/</div><div>
<br></div><div>d:s</div></div><div class="gmail_extra"><br clear="all"><div><div dir="ltr">===================================<br><div style="margin-left:40px"><b style="font-family:arial,helvetica,sans-serif">Daniel Shown,</b><br style="font-family:arial,helvetica,sans-serif">
Linux Systems Administrator<br style="font-family:arial,helvetica,sans-serif"><span style="font-family:arial,helvetica,sans-serif">Advanced Technology Group</span><br style="font-family:arial,helvetica,sans-serif"><a style="font-family:arial,helvetica,sans-serif" href="http://www.slu.edu/its" target="_blank">Information Technology Services</a><br style="font-family:arial,helvetica,sans-serif">
<span style="font-family:arial,helvetica,sans-serif">at </span><a style="font-family:arial,helvetica,sans-serif" href="http://www.slu.edu/" target="_blank">Saint Louis University</a><span style="font-family:arial,helvetica,sans-serif">.</span><br style="font-family:arial,helvetica,sans-serif">
<br style="font-family:arial,helvetica,sans-serif"><a style="font-family:arial,helvetica,sans-serif">314-977-2583</a><br></div>===================================<br><br><div style="margin-left:40px">"The aim of education <br>
is the knowledge, <br>not of facts, <br>but of values." <br>— William S. Burroughs<br><br>"I’m supposed to be </div><div style="margin-left:40px">a scientific person </div><div style="margin-left:40px">but I use intuition </div>
<div style="margin-left:40px">more than logic </div><div style="margin-left:40px">in making basic </div><div style="margin-left:40px">decisions."</div><div style="margin-left:40px">— Seymour R. Cray</div><div style="margin-left:40px">
<br></div><img style="background-color:rgb(51,51,153)" src="https://sites.google.com/a/slu.edu/slu-its-101/_/rsrc/1303829218862/config/customLogo.gif?revision=2" height="21" width="420"><br></div></div>
<br><br><div class="gmail_quote">On Mon, Aug 11, 2014 at 1:51 PM, Alexander Bokovoy <span dir="ltr"><<a href="mailto:abokovoy@redhat.com" target="_blank">abokovoy@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="">On Mon, 11 Aug 2014, Daniel Shown wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
I’m trying to get a client to respect an NFS4 ACL for a directory. I’ve got<br>
users in FreeIPA that match a subset of users in AD. The NFS server is a<br>
FreeBSD box that I’ve got config’ed to use FreeIPA as an LDAP service in<br>
nsswitch for providing uids. I use setfacl there with just the uid. The<br>
FreeIPA client with the NFS mount (not kerberized) is an Ubuntu 14.04 bound<br>
to a FreeIPA 3.0 server (running on CentOS 6.5). I’ve got the FreeIPA 3.0<br>
server configured with a trust with an AD domain. My krb5.conf has<br>
dns_lookup_kdc<br>
= true and auth_to_local = RULE:[1:$1@<br>
$0](^.*@AD.DOMAIN$)s/@AD.<u></u>DOMAIN/@ad.domain/ and my sssd.conf has the<br>
standard subdomains_provider = ipa and services = ..., pac along with<br>
a full_name_format<br>
= %1$s to strip the realm name off when displaying the username. From what<br>
I understand about NFS ACLs, they should respect the uid reported, which<br>
matches, and ignore uidnumbers (which don’t match). From the FreeIPA client<br>
I can authenticate as an AD user, but I still don’t have access to the NFS<br>
directory with ACLs that should allow me to read. When I do an getfacl on<br>
the NFS server I get just the uid, but when I do nfs4_getfacl on the<br>
FreeIPA/NFS client I get uid@ipa.realm (and no access to the directory).<br>
<br>
Am I missing something?<br>
</blockquote></div>
There is a bug in NFS ID mapping code that prevents this use case from<br>
working. It should be fixed in recent libnsfidmap releases but I'm not<br>
sure it is already available in CentOS 6.5.<span class="HOEnZb"><font color="#888888"><br>
-- <br>
/ Alexander Bokovoy<br>
</font></span></blockquote></div><br></div>