With NFSv4, simply naming the domain isn't enough. You have to have one to one mapping of username@nfsv4iddomain to UID. The NFS client and NFS server both need to be able to come to the same conclusion about the name.
If you're using no name service server (like LDAP or NIS) and are relying only on local files, then there needs to be an entry for the user on the storage's passwd file and the client's passwd file. These entries must match EXACTLY.
The ID you see in ls -l means NFSv4 isn't even working at all. That resolves to nobody:
http://www.novell.com/support/kb/doc.php?id=7005060
Create an entry for your username in the passwd files on the client and server.
Example:
[root@centos64 /]# cat /etc/passwd | grep peter
peter:x:101:1::/:
[root@centos64 /]# passwd peter
Changing password for user peter.
New password:
BAD PASSWORD: it is based on a dictionary word
Retype new password:
passwd: all authentication tokens updated successfully.
[root@centos64 /]# mount 10.61.72.35:/vol/unix /tmp
[root@centos64 /]# mount | grep /tmp
10.61.72.35:/vol/unix on /tmp type nfs (rw,vers=4,addr=10.61.72.35,clientaddr=10.61.179.150)
[root@centos64 /]# cd /tmp
[root@centos64 tmp]# ls -la
total 12
drwxr-xr-x. 3 root root 4096 Aug 5 12:27 .
dr-xr-xr-x. 26 root root 4096 Aug 8 16:10 ..
drwxrwxrwx. 10 root root 4096 Aug 9 09:00 .snapshot
Note that when I login as "peter" and write a file, it lets me write but the UID is "nobody":
[root@centos64 tmp]# su peter
sh-4.1$ cd /tmp
sh-4.1$ touch file
sh-4.1$ ls -la | grep file
-rw-r--r--. 1 nobody daemon 0 Aug 9 2013 file
Thisis defined in idmapd.conf:
[root@centos64 /]# cat /etc/idmapd.conf
[General]
Domain = domain.win2k8.netapp.com
[Mapping]
Nobody-User = nobody
Nobody-Group = nobody
[Translation]
Method = nsswitch
The fact that the user can't map would also affect me applying NFSv4 ACLs:
[root@centos64 /]# nfs4_setfacl -a A::peter@domain.win2k8.netapp.com:rwatTnNcCy /mnt
Failed setxattr operation: Invalid argument
I have 2 options to fix this.
Option #1: Create an LDAP server to manage your UIDs and users (best option)
Option #2: Add the user to the client's passwd file and server/filer's passwd file (and the entry must be EXACTLY the same):
fas3170-rtp*> wrfile -a /etc/passwd peter::101:2:/:
fas3170-rtp*> rdfile /etc/passwd
root:_J9..LnoxwdFuzh81UF6:0:1::/:
pcuser::65534:65534::/:
nobody::65535:65535::/:
ftp::65533:65533:FTP Anonymous:/home/ftp:
peter:x:101:1:/:
[root@centos64 tmp]# cat /etc/passwd | grep peter
peter:x:101:1::/:
[root@centos64 /]# umount /tmp
[root@centos64 /]# mount 10.61.72.35:/vol/unix /tmp
[root@centos64 /]# cd /tmp
[root@centos64 tmp]# ls -la
total 12
drwxrwxrwx. 3 root nobody 4096 Aug 9 12:20 .
dr-xr-xr-x. 26 root root 4096 Aug 8 16:10 ..
-rw-r--r--. 1 peter daemon 0 Aug 9 12:20 file
drwxrwxrwx. 10 root nobody 4096 Aug 9 09:00 .snapshot
After this, I can apply ACLs, but only if I use the @domain:
[root@centos64 /]# nfs4_setfacl -a A::peter:rwatTnNcCy /tmp
Failed setxattr operation: Invalid argument
[root@centos64 /]# nfs4_setfacl -a A::peter@domain.win2k8.netapp.com:rwatTnNcCy /tmp
[root@centos64 /]# nfs4_getfacl /tmp
A::peter@domain.win2k8.netapp.com:rwatTnNcCy
A::peter@domain.win2k8.netapp.com:rw
A::OWNER@:rwaDxtTnNcCy
D::OWNER@:
A:g:GROUP@:rwaDxtTnNcCy
D:g:GROUP@:
A::EVERYONE@:rwaDxtTnNcCy
D::EVERYONE@:
Once you get NFSv4 working properly and usernames showing up in ls output, ACLs should start working.
