Skip to main content
NetApp Knowledge Base

NFSv4 Kerberos mount to NTFS volume fails with an access denied error from a client

Views:
39
Visibility:
Public
Votes:
0
Category:
ontap-9
Specialty:
nas
Last Updated:

Applies to

  • ONTAP 9
  • Kerberos
  • NFSv4
  • NTFS volume

Issue

  • NFSv4 clients get access denied when mounting NTFS volume with Kerberos
  • EMS shows event secd.nfsAuth.noCifsCred that S4U2Self fails to get the mapped Windows user credential
1/15/2024 14:27:37  cluster1-01      ERROR         secd.nfsAuth.noCifsCred: vserver (svm1) NFS authorization cannot retrieve CIFS credentials. Error: Get user credentials procedure failed
  [  0 ms] Determined UNIX id 65534 is UNIX user 'pcuser'
  [    12] UNIX user 'pcuser' mapped to Windows user 'ntap\nfsnobody'
  [    12] Using cached 'ntap\nfsnobody' SID mapping.
  [    15] Successfully connected to ip 10.10.10.110, port 88 using TCP
**[    17] FAILURE: Could not get credentials via S4U2Self based on full Windows user name 'nfsnobody@NTAP.LOCAL'. Access denied.
  [    17] Could not get credentials for Windows user 'nfsnobody' or SID 'S-1-5-21-3506719826-1324006886-3270342602-1112'
 
  • The packet trace shows that the NFS client gets NFS4ERR_ACCESS in the ACCESS call during the mount. 
  • krb-unix name mapping displays the machine account and host SPN maps to pcuser

clus9x::> vserver name-mapping show -vserver svm1 -direction krb-unix 

Vserver:   svm1
Direction: krb-unix
Position Hostname         IP Address/Mask
-------- ---------------- ----------------
1       -                 -                   Pattern: (.+)\$@NTAP.LOCAL
                                          Replacement: pcuser
2       -                 -                   Pattern: host/(.+)@NTAP.LOCAL
                                          Replacement: pcuser
3       -                 -                   Pattern: (.+)@NTAP.LOCAL
                                          Replacement: \1
3 entries were displayed.

  • unix-win name mapping has no explicit rules

Sign in to view the entire content of this KB article.

New to NetApp?

Learn more about our award-winning Support

NetApp provides no representations or warranties regarding the accuracy or reliability or serviceability of any information or recommendations provided in this publication or with respect to any results that may be obtained by the use of the information or observance of any recommendations provided herein. The information in this document is distributed AS IS and the use of this information or the implementation of any recommendations or techniques herein is a customer's responsibility and depends on the customer's ability to evaluate and integrate them into the customer's operational environment. This document and the information contained herein may be used solely in connection with the NetApp products discussed in this document.