Sun Storage 5210 NAS Appliance
 
Sun Storage 5220 NAS Appliance
 
Sun Storage 5310 NAS Appliance
 
Sun Storage 5320 NAS Gateway/Cluster System
 
Sun Storage 5320 NAS Appliance
 
Sun Storage 5310 NAS Gateway System
 

GCS>Sun Microsystems>Storage - Disk>Network Attached Storage
 

Symptoms:

• UNIX users cannot access Windows data
• Windows users cannot access Windows data
• User (or group) mapping is not working
• UNIX root user cannot change security on Windows-created files

Purpose/Scope:

This document defines a step-by-step procedure for configuring, and troubleshooting problems with, CIFS to NFS user credential mapping. Credential mapping allows files to be shared between CIFS and NFS clients using existing user and group identities

1.  <Document: 1017673.1> Verify that mapping policies are understood and correctly configured. There are several ways to map CIFS (Windows) users and groups to NFS users and groups, and they all require some preparation.
2.  <Document: 1008486.1> If desired, create all user and group credential maps in advance. If creating user and group mappings on the fly is insufficient or not working for a particular environment, a utility is provided to pull users and groups from a domain controller to create StorageTek[TM] 5000 Series compatible map files that can be edited with the desired NFS mappings and copied to the NAS.
3.  <Document: 1013072.1> Determine whether Windows primary groups are in use and come up with a group mapping plan. Frequently, Windows environments do not make use of the primary group setting. The linked document explains how to deal with the various possibilites.
4.  <Document: 1017576.1> Ensure that the affected user is not logged in with an administrative account. Credential mapping of the UNIX root user and members of the CIFS "Domain Admins" group are handled as special cases.
5.  <Document: 1013073.1> Understand how UIDs/GIDs are handled in workgroup mode. Credential mapping does not apply to NAS servers configured in Workgroup (non-Domain) mode, as no credentials are used. However, CIFS users are assigned UID/GID, so it is still possible to share files between platforms.
6.  <Document: 1011360.1> If necessary, change the configuration to allow UNIX users to modify security on CIFS(Windows)-created files. By default, UNIX users cannot change ownership or security on files created or last modified by domain-mode CIFS clients.
7.  <Document: 1011364.1> Troubleshoot individual file and diirectory access issues with cals utility. This command line utility shows CIFS permissions, NFS permissions and extended attributes for files and directories. For issues with CIFS access to NFS-created objects, it may be useful in some cases to <Document: 1005474.1> view the CIFS access token to determine the NFS and CIFS credentials of the user attempting to access the object.
8.  <Document: 1005474.1> Collect the NAS extractor and diagnostic to prepare for a support case or escalation. The diagnostic collection should be done as soon as possible after the attempt to join the domain.
9.  <Document: 1004130.1> Collect a network trace. Follow the instructions to set up a trace, set the filter to capture only traffic between the client attempting access, the NAS and Domain Controller(s). Start the trace, repeat the attempt to access the object, then stop the trace.
10. At this point, if you not been able to resolve the issue with the troubleshooting steps above, further troubleshooting is required. Contact Sun Support and be prepared to provide the data collected in the above steps.

This solution has no attachment