Minor Description
The usual way to support more than 2 supplementary groups is to resort to the server side's identity upcall. This identity upcall retrieves all user's credentials, including all supplementary groups, and stores them in cache.
In some cases, resolving supplementary groups on MDS side in the context of the identity upcall is not possible. For instance, with ActiveDirectory (AD), only the user itself can get access to the list of their supplementary groups, and only after having authenticated to AD. Given that this list of supplementary groups can have thousands of entries, it is not possible to pack it along with usual requests such as open, stat, etc.
As an alternative to the server side's identity upcall, we want to propose a retry mechanism for intent locking. The client can provide at most 2 supplementary groups in the request sent to the MDS, but sometimes it does not know which ones are useful for credentials calculation on server side. For instance in case of lookup, the client does not have the child inode yet when it sends the intent lock request. Hopefully, the server can hint at the useful groups, by putting in the request reply the target inode's GID, and also its ACL. So, in case the server replies -EACCES, we can check the user's credentials against those, and try again the intent lock request if we find a matching supplementary group.
These supplementary groups provided by the clients are going to be put in a dedicated identity cache on server side, called INTERNAL. This INTERNAL upcall implements a particular behavior which does not involve an actual upcall, but instead the cache is filled with supplementary groups read from the client request, cumulatively at each request.
The use of the INTERNAL upcall, and the fact that the group verification depends on the client, should be limited to a restricted number of clients. So we want to make the INTERNAL upcall selectable on a per-nodemap basis, avoiding the need to set it globally.
Attachments
Issue Links
Activity
"Oleg Drokin <green@whamcloud.com>" merged in patch https://review.whamcloud.com/c/fs/lustre-release/+/55475/
Subject: LU-17961 sec: add server_upcall rbac role
Project: fs/lustre-release
Branch: master
Current Patch Set:
Commit: 3b04d6ac1dee426cbdf507ba8d3c7e0ec593f114
"Oleg Drokin <green@whamcloud.com>" merged in patch https://review.whamcloud.com/c/fs/lustre-release/+/55474/
Subject: LU-17961 sec: support supplementary groups from client
Project: fs/lustre-release
Branch: master
Current Patch Set:
Commit: e826e8bb77bffce346f570ea5348fa0762c792d6
| Link | New: This issue is related to EX-10515 [ EX-10515 ] |
| Link | New: This issue is related to EX-4333 [ EX-4333 ] |
| Link | New: This issue is related to EX-9392 [ EX-9392 ] |
"Sebastien Buisson <sbuisson@ddn.com>" uploaded a new patch: https://review.whamcloud.com/c/fs/lustre-release/+/55475
Subject: LU-17961 sec: add server_upcall rbac role
Project: fs/lustre-release
Branch: master
Current Patch Set: 1
Commit: 0f6d4f55ab537a477eb35430b485662275d132d3
"Sebastien Buisson <sbuisson@ddn.com>" uploaded a new patch: https://review.whamcloud.com/c/fs/lustre-release/+/55474
Subject: LU-17961 sec: support supplementary groups from client
Project: fs/lustre-release
Branch: master
Current Patch Set: 1
Commit: f4dfb13f23af42b18b3e3ff8f4552d1e9c6d0e60
"Sohei Koyama <skoyama@ddn.com>" uploaded a new patch: https://review.whamcloud.com/c/fs/lustre-release/+/57931
Subject: LU-17961 obdclass: fix compile error on Ubuntu24.04
Project: fs/lustre-release
Branch: master
Current Patch Set: 1
Commit: dab73c4dc71db95d7d9c6d4abb1d8594acf29c71