I have a similar issue, but in my case the invalid mapping does not go
away. I'm running Jessie with nscld to authenticate against samba4 AD
and have a NAS configured as member server. To Linux clients it serves
NFS4 sec=krb5p. Actually I have 2 machines, which I think are configured
identically concerning nslcd, kerberos, and NFS.
On one machine (fresh Jessie install) everything works perfectly.
On the other machine (upgrade from wheezy) everything worked perfectly
on wheezy and indeed I noticed the issue only after several days, when I
first did ls -la on one of the imported drives. It looks extremely strange:
drwxrwxrwx 48 nobody 4294967294 4096 Sep 16 21:09 .
drwxr-xr-x 9 root root 4096 Nov 23 2014 ..
drwxr-xr-x 38 nobody 4294967294 4096 Okt 23 07:16 adm
drwxr-xr-x 4 nobody ad_users 4096 Okt 14 2013 admin
-rw-r-xr-- 1 nobody ad_users 1219 Okt 10 2001 adsl_suse71
[...]
The same directory on the other system:
drwxrwxrwx 48 mgr lars 4096 Sep 16 21:09 .
drwxr-xr-x 9 root root 4096 Nov 23 2014 ..
drwxr-xr-x 38 mgr lars 4096 Okt 23 07:16 adm
drwxr-xr-x 4 mgr ad_users 4096 Okt 14 2013 admin
-rw-r-xr-- 1 mgr ad_users 1219 Okt 10 2001 adsl_suse71
[...]
which is the same, as I see it on the NAS.
However, I can read everything, but if I create new files they're
created as guest:users on the NAS, which maps to nobody:users on the
machine, where everything is alright.
I have a similar situation as described in this bug report during
start-up. Due to trouble with k5start, nslcd is not available, when NFS
is started on boot. I use to start nslcd manually from a root prompt.
As said, it does not go away. Changing the expiration does not change a
thing. The group number 4294967294 seems to pop out of thin air. It's
not the number of the 'lars' group on any system involved. Checking
syslog (Verbosity=9) it turns out that idmapd doesn't ever look up the
names. This is a log following a nfs-common restart, several 'ls' and a
'touch':
Nov 8 21:02:09 midgard rpc.idmapd[11283]: libnfsidmap: using domain:
ad.microsult.de
Nov 8 21:02:09 midgard rpc.idmapd[11283]: libnfsidmap: Realms list:
'AD.MICROSULT.DE'
Nov 8 21:02:09 midgard rpc.idmapd[11283]: libnfsidmap: loaded plugin
/lib/x86_64-linux-gnu/libnfsidmap/nsswitch.so for method nsswitch
Nov 8 21:02:09 midgard rpc.idmapd[11284]: Expiration time is 10 seconds.
Nov 8 21:02:09 midgard rpc.idmapd[11284]: Opened
/proc/net/rpc/nfs4.nametoid/channel
Nov 8 21:02:09 midgard rpc.idmapd[11284]: Opened
/proc/net/rpc/nfs4.idtoname/channel
Nov 8 21:02:09 midgard rpc.idmapd[11284]: New client: 13
Nov 8 21:02:09 midgard rpc.idmapd[11284]: New client: 14
Nov 8 21:02:09 midgard rpc.idmapd[11284]: Opened
/run/rpc_pipefs/nfs/clnt14/idmap
Nov 8 21:02:09 midgard rpc.idmapd[11284]: New client: 15
Nov 8 21:02:09 midgard nfs-common[11269]: Starting NFS common
utilities: statd idmapdrpc.idmapd: libnfsidmap: using domain:
ad.microsult.de
Nov 8 21:02:09 midgard nfs-common[11269]: rpc.idmapd: libnfsidmap:
Realms list: 'AD.MICROSULT.DE'
Nov 8 21:02:09 midgard nfs-common[11269]: rpc.idmapd: libnfsidmap:
loaded plugin /lib/x86_64-linux-gnu/libnfsidmap/nsswitch.so for method
nsswitch
Nov 8 21:15:29 midgard nfsidmap[11442]: key: 0x154df42a type: uid
value: [email protected] timeout 600
Nov 8 21:15:29 midgard nfsidmap[11442]: nfs4_name_to_uid: calling
nsswitch->name_to_uid
Nov 8 21:15:29 midgard nfsidmap[11442]: nss_getpwnam: name
'[email protected]' domain 'ad.microsult.de': resulting localname
'guest'
Nov 8 21:15:29 midgard nfsidmap[11442]: nss_getpwnam: name 'guest' not
found in domain 'ad.microsult.de'
Nov 8 21:15:29 midgard nfsidmap[11442]: nfs4_name_to_uid:
nsswitch->name_to_uid returned -2
Nov 8 21:15:29 midgard nfsidmap[11442]: nfs4_name_to_uid: final return
value is -2
Nov 8 21:15:29 midgard nfsidmap[11442]: nfs4_name_to_uid: calling
nsswitch->name_to_uid
Nov 8 21:15:29 midgard nfsidmap[11442]: nss_getpwnam: name
'[email protected]' domain 'ad.microsult.de': resulting localname
'nobody'
Nov 8 21:15:29 midgard nfsidmap[11442]: nfs4_name_to_uid:
nsswitch->name_to_uid returned 0
Nov 8 21:15:29 midgard nfsidmap[11442]: nfs4_name_to_uid: final return
value is 0
So it obviously tries to resolve guest (during touch or the following
ls), but it never looked up any other name in 13 minutes with any expiry
time of 10 seconds. So it seems to be similarly related to chaching of
negative results.
Please let me know, if I can help with additional input.
