NFSv4 Kerberos mount to NTFS volume fails with an access denied error from a client

Last updated
Save as PDF
Share
1. Share
2. Tweet
3. Share

Views:: 137

Visibility:: Public

Votes:: 0

Category:: ontap-9

Specialty:: nas

Last Updated:

Applies to

ONTAP 9
Kerberos
NFSv4
NTFS volume

Issue

NFSv4 clients get access denied when mounting NTFS volume with Kerberos
EMS shows event secd.nfsAuth.noCifsCred that S4U2Self fails to get the mapped Windows user credential

1/15/2024 14:27:37  cluster1-01      ERROR         secd.nfsAuth.noCifsCred: vserver (svm1) NFS authorization cannot retrieve CIFS credentials. Error: Get user credentials procedure failed

[ 0 ms] Determined UNIX id 65534 is UNIX user 'pcuser'

[ 12] UNIX user 'pcuser' mapped to Windows user 'ntap\nfsnobody'

[ 12] Using cached 'ntap\nfsnobody' SID mapping.

[ 15] Successfully connected to ip 10.10.10.110, port 88 using TCP

**[    17] FAILURE: Could not get credentials via S4U2Self based on full Windows user name 'nfsnobody@NTAP.LOCAL'. Access denied.

  [    17] Could not get credentials for Windows user 'nfsnobody' or SID 'S-1-5-21-3506719826-1324006886-3270342602-1112'

The packet trace shows that the NFS client gets NFS4ERR_ACCESS in the ACCESS call during the mount.

krb-unix name mapping displays the machine account and host SPN maps to pcuser

clus9x::> vserver name-mapping show -vserver svm1 -direction krb-unix

Vserver: svm1 Direction: krb-unix Position Hostname IP Address/Mask -------- ---------------- ---------------- 1 - - Pattern: (.+)\$@NTAP.LOCAL Replacement: pcuser 2 - - Pattern: host/(.+)@NTAP.LOCAL Replacement: pcuser 3 - - Pattern: (.+)@NTAP.LOCAL Replacement: \1 3 entries were displayed.

unix-win name mapping has no explicit rules