[LU-16901] Provide l_getidentity_nss identity provider

• Status: Resolved
• Project: Lustre
• Fix Version/s: Lustre 2.16.0
• Type: Bug
• Priority: Minor
• Reporter: Shaun Tancheff
• Assignee: Shaun Tancheff
• Resolution: Fixed
• Severity: 3

Description

l_getidenity to fetch user's supplementary groups info from NIS, LDAP and/or any other services that NSS modules exist for. Add lustre-only user/group configuration in plain files, keeping Lustre users and groups separate from Linux users/groups on Lustre server's machines for security reason

Issue Links

• duplicates: LU-15267 l_getidentity_nss utility
• is related to: LU-17301 Client mount hangs for several minutes

Comments

[Gerrit Updater]

"Shaun Tancheff <[e-mail]>" uploaded a new patch: https://review.whamcloud.com/c/fs/lustre-release/+/51329
Subject: LU-16901 utils: l_getidentity_nss
Project: fs/lustre-release
Branch: master
Current Patch Set: 1
Commit: bf6a4565c11ae2d570e04f3d982e0bd1f4903d71

[Andreas Dilger]

I think this was previously submitted under patch https://review.whamcloud.com/45634

My question there was:

Maybe I'm missing something, but doesn't the existing l_getidentity.c already handle lookups based on /etc/nsswitch.conf by calling the Glibc getpwuid/getgrouplist to do lookups in LDAP, NIS, SSS?

And the response from Alexander Zarochentsev was:

the idea is to have configuration independent from the system on in /etc/nsswitch.conf. at least I was told it is useful for server security.

but it didn't provide enough explanation about what security issues this addresses

It should be possible to query the LDAP without allowing the users to login to the MDS and needing a separate upcall?

[Gerrit Updater]

"Oleg Drokin <[e-mail]>" merged in patch https://review.whamcloud.com/c/fs/lustre-release/+/51329/
Subject: LU-16901 utils: l_getidentity with nss module support
Project: fs/lustre-release
Branch: master
Current Patch Set:
Commit: 5f9f92454ef2a46075c850546ad4ac1621038dcf

[Peter Jones]

Landed for 2.16