mmdsh -N CesNodes /usr/lpp/mmfs/bin/smbcontrol winbindd debug 3
mmdsh -N CesNodes /usr/lpp/mmfs/bin/smbcontrol winbindd debug 1
For DNS servers, the requirement would be that all configured DNS servers on the protocol nodes, return the additional information required to locate the AD Domain Controllers. If the AD DCs are also running the DNS server, then only the AD DCs should be configured as DNS servers on the protocol nodes. One thing to check: After the configuring the AD authentication through mmuserauth, this command should return the list of AD DCs (check on all protocol nodes):
dig -t SRV _kerberos._tcp.$(/usr/lpp/mmfs/bin/net conf getparm global realm)
Regards,
Christof Schmitt || IBM || Spectrum Scale Development || Tucson, AZ
[email protected] || +1-520-799-2469 (T/L: 321-2469)
[email protected] wrote: -----
To: gpfsug main discussion list <[email protected]>
From: Monty Poppe/Austin/IBM@IBMUS
Sent by: [email protected]
Date: 02/25/2016 10:02AM
Subject: Re: [gpfsug-discuss] Integration with Active Directory
All CES nodes should operate consistently across the cluster. Here are a few tips on debugging:
/usr/lpp/mmfs/bin/wbinfo-p to ensure winbind is running properly
/usr/lpp/mmfs/bin/wbinfo-P (capital P), to ensure winbind can communicate with AD server
ensure the first nameserver in /etc/resolv.conf points to your AD server (check all nodes)
mmuserauth service check --server-reachability for a more thorough validation that all nodes can communicate to the authentication server
If you need to look at samba logs (/var/adm/ras/log.smbd & log.wb-<domainname>) to see what's going on, change samba log levels issue: /usr/lpp/mmfs/bin/net conf setparm global 'log level' 3. Don't forget to set back to 0 or 1 when you are done!
If you're willing to go with a later release, AD authentication with LDAP ID mapping has been added as a feature in the 4.2 release. (https://www-01.ibm.com/support/knowledgecenter/STXKQY_4.2.0/com.ibm.spectrum.scale.v4r2.adm.doc/bl1adm_adwithldap.htm?lang=en)
Monty Poppe
Spectrum Scale Test
[email protected]
512-286-8047 T/L 363-8047
From: "Simon Thompson (Research Computing - IT Services)" <[email protected]>
To: gpfsug main discussion list <[email protected]>
Date: 02/25/2016 07:19 AM
Subject: Re: [gpfsug-discuss] Integration with Active Directory
Sent by: [email protected]
Hi Gethyn,
From what I recall, CTDB used underneath is used to share the secret and only the primary named machine is joined, but CTDB and CES should work this backend part out for you.
I do have a question though, do you want to have consistent UIDs across other systems? For example if you plan to use NFS to other *nix systems, then you probably want to think about LDAP mapping and using custom auth (we do this as out AD doesn't contain UIDs either).
Simon
From: <[email protected]> on behalf of "Longworth, Gethyn" <[email protected]>
Reply-To: "[email protected]" <[email protected]>
Date: Thursday, 25 February 2016 at 10:42
To: "[email protected]" <[email protected]>
Subject: [gpfsug-discuss] Integration with Active Directory
Hi all,
I’m new to both GPFS and to this mailing list, so I thought I’d introduce myself and one of the issues I am having.
I am a consultant to Rolls-Royce Aerospace currently working on a large facilities project, part of my remit is to deliver a data system. We selected GPFS (sorry Spectrum Scale…) for this three clusters, with two of the clusters using storage provided by Spectrum Accelerate, and the other by a pair of IBM SANs and a tape library back up.
My current issue is to do with integration into Active Directory. I’ve configured my three node test cluster with two protocol nodes and a quorum (version 4.2.0.1 on RHEL 7.1) as the master for an automated id mapping system (we can’t use RFC2307, as our IT department don’t understand what this is), but the problem I’m having is to do with domain joins. The documentation suggests that using the CES cluster hostname to register in the domain will allow all nodes in the cluster to share the identity mapping, but only one of my protocol nodes will authenticate – I can run “id” on that node with a domain account and it provides the correct answer – whereas the other will not and denies any knowledge of the domain or user. From a GPFS point of view, this results in a degraded CES, SMB, NFS and AUTH state. My small amount of AD knowledge says that this is expected – a single entry (e.g. the cluster name) can only have one SID.
So I guess that my question is, what have I missed? Is there something in AD that I need to configure to make this work? Does one of the nodes in the cluster end up as the master and the other a subordinate? How do I configure that within the confines of mmuserauth?
As I said I am a bit new to this, and am essentially learning on the fly, so any pointers that you can provide would be appreciated!
Cheers,
Gethyn Longworth
MEng CEng MIET |Consultant Systems Engineer | AEROSPACE
P Please consider the environment before printing this email
_______________________________________________
gpfsug-discuss mailing list
gpfsug-discuss at spectrumscale.org
http://gpfsug.org/mailman/listinfo/gpfsug-discuss
From: Monty Poppe/Austin/IBM@IBMUS
Sent by: [email protected]
Date: 02/25/2016 10:02AM
Subject: Re: [gpfsug-discuss] Integration with Active Directory
All CES nodes should operate consistently across the cluster. Here are a few tips on debugging:
/usr/lpp/mmfs/bin/wbinfo-p to ensure winbind is running properly
/usr/lpp/mmfs/bin/wbinfo-P (capital P), to ensure winbind can communicate with AD server
ensure the first nameserver in /etc/resolv.conf points to your AD server (check all nodes)
mmuserauth service check --server-reachability for a more thorough validation that all nodes can communicate to the authentication server
If you need to look at samba logs (/var/adm/ras/log.smbd & log.wb-<domainname>) to see what's going on, change samba log levels issue: /usr/lpp/mmfs/bin/net conf setparm global 'log level' 3. Don't forget to set back to 0 or 1 when you are done!
If you're willing to go with a later release, AD authentication with LDAP ID mapping has been added as a feature in the 4.2 release. (https://www-01.ibm.com/support/knowledgecenter/STXKQY_4.2.0/com.ibm.spectrum.scale.v4r2.adm.doc/bl1adm_adwithldap.htm?lang=en)
Monty Poppe
Spectrum Scale Test
[email protected]
512-286-8047 T/L 363-8047
From: "Simon Thompson (Research Computing - IT Services)" <[email protected]>
To: gpfsug main discussion list <[email protected]>
Date: 02/25/2016 07:19 AM
Subject: Re: [gpfsug-discuss] Integration with Active Directory
Sent by: [email protected]
Hi Gethyn,
From what I recall, CTDB used underneath is used to share the secret and only the primary named machine is joined, but CTDB and CES should work this backend part out for you.
I do have a question though, do you want to have consistent UIDs across other systems? For example if you plan to use NFS to other *nix systems, then you probably want to think about LDAP mapping and using custom auth (we do this as out AD doesn't contain UIDs either).
Simon
From: <[email protected]> on behalf of "Longworth, Gethyn" <[email protected]>
Reply-To: "[email protected]" <[email protected]>
Date: Thursday, 25 February 2016 at 10:42
To: "[email protected]" <[email protected]>
Subject: [gpfsug-discuss] Integration with Active Directory
Hi all,
I’m new to both GPFS and to this mailing list, so I thought I’d introduce myself and one of the issues I am having.
I am a consultant to Rolls-Royce Aerospace currently working on a large facilities project, part of my remit is to deliver a data system. We selected GPFS (sorry Spectrum Scale…) for this three clusters, with two of the clusters using storage provided by Spectrum Accelerate, and the other by a pair of IBM SANs and a tape library back up.
My current issue is to do with integration into Active Directory. I’ve configured my three node test cluster with two protocol nodes and a quorum (version 4.2.0.1 on RHEL 7.1) as the master for an automated id mapping system (we can’t use RFC2307, as our IT department don’t understand what this is), but the problem I’m having is to do with domain joins. The documentation suggests that using the CES cluster hostname to register in the domain will allow all nodes in the cluster to share the identity mapping, but only one of my protocol nodes will authenticate – I can run “id” on that node with a domain account and it provides the correct answer – whereas the other will not and denies any knowledge of the domain or user. From a GPFS point of view, this results in a degraded CES, SMB, NFS and AUTH state. My small amount of AD knowledge says that this is expected – a single entry (e.g. the cluster name) can only have one SID.
So I guess that my question is, what have I missed? Is there something in AD that I need to configure to make this work? Does one of the nodes in the cluster end up as the master and the other a subordinate? How do I configure that within the confines of mmuserauth?
As I said I am a bit new to this, and am essentially learning on the fly, so any pointers that you can provide would be appreciated!
Cheers,
Gethyn Longworth
MEng CEng MIET |Consultant Systems Engineer | AEROSPACE
P Please consider the environment before printing this email
_______________________________________________
gpfsug-discuss mailing list
gpfsug-discuss at spectrumscale.org
http://gpfsug.org/mailman/listinfo/gpfsug-discuss
_______________________________________________
gpfsug-discuss mailing list
gpfsug-discuss at spectrumscale.org
http://gpfsug.org/mailman/listinfo/gpfsug-discuss
gpfsug-discuss mailing list
gpfsug-discuss at spectrumscale.org
http://gpfsug.org/mailman/listinfo/gpfsug-discuss
_______________________________________________ gpfsug-discuss mailing list gpfsug-discuss at spectrumscale.org http://gpfsug.org/mailman/listinfo/gpfsug-discuss
