[LU-16630] Improve Kerberos cross-realm trust remapping

• Type: Bug
• Resolution: Fixed
• Priority: Minor
• Fix Version/s: Lustre 2.16.0
• Affects Version/s: Lustre 2.16.0
• Labels: kerberos sec
• Severity: 3
• Assignee: Sebastien Buisson
• Reporter: Sebastien Buisson

Description

Currently lsvcgssd does have the notion of a "remote user", however its remapping configuration requires listing all users and their UID in a text file (/etc/lustre/idmap.conf)

It should be possible to call gss_localname() (which in turn would be fed to getpwnam) to resolve usernames. gss_localname goes through the auth_to_local translation rules in krb5.conf and thus can easily be configured by administrators.

Comments

[Peter Jones]

Landed for 2.16

[Gerrit Updater]

"Oleg Drokin <[e-mail]>" merged in patch https://review.whamcloud.com/c/fs/lustre-release/+/50259/
Subject: LU-16630 sec: improve Kerberos cross-realm trust remapping
Project: fs/lustre-release
Branch: master
Current Patch Set:
Commit: 3214d4d860e36b6aa07addad9e600fd754fc9149

[Gerrit Updater]

"Sebastien Buisson <[e-mail]>" uploaded a new patch: https://review.whamcloud.com/c/fs/lustre-release/+/50259
Subject: LU-16630 sec: improve Kerberos cross-realm trust remapping
Project: fs/lustre-release
Branch: master
Current Patch Set: 1
Commit: c5a054a42b237dd17366dd580b6113493c4a4b1b