Unable to setgid on Solaris 11

[TimJMcCuen]

Hello,

I have a Unix admin who is able mount and create a directory on NFSv4 share I provide from my NetApp running ONTAP 9.8p11.    Her host is running Solaris 11 ( I know they need to migrate off Solaris)   She creates a directory from the NetApp volume.  The problem occurs when she tries to change the ownership of the directory she creates the change in ownership to another user doesn't work.     Setgid is not recognized.

We had the same issue on RHEL but I changed the NFSV4 id mapping domain and the Linux changed the ipmapd.conf on their server and rebooted and this issue went away.

Any thoughts on how we can resolve this issue on the Solaris 11 hosts?  

Much appreciated.

[parisi]

Did they try to change the ID domain on the Solaris box, too?

If they are using NFSv4 and the users aren't matching up properly, then ownership changes will fail. 

Have they tried NFSv3 on the Solaris box?

[TimJMcCuen]

Thanks for the response.   We can not use NFSv3.     The did change the domain id on the Solaris serveri in the nfsidmap config file.

The Solaris servers are running Solaris 11.3 which they know they will need to get off of due to lack of support but these servers are still in production.

[TimJMcCuen]

I am wondering if setting "allow-suid  true" in the export policy will fix this issue.  I made the change to the SVM export policy.   Waiting for the Solaris admins to test.   I will post the result

[TimJMcCuen]

I added "allow-suid true" to the export policy and still running into issues.    On Solaris 11.3 when adding set GID bit the Active Directory group can't be found when trying to write to the NetApp Share.   Any thoughts?  Thanks.

[parisi]

I don't. I'd try to reproduce the issue but I don't have access to any Solaris 11 hosts.

Have you opened a support case for this?

[Mjizzini]

Is the vserver ID Domain set on the Vserver?

*> vserver nfs show -fields v4-id-domain

NFSv4 objects still show 'nobody' when user ID domain is configured correctly

[TimJMcCuen]

Yes I set the id domain on the Vserver