ADベースのLDAPサーバで設定問題が原因で一部のUNIXユーザを解決できない

最後の更新
PDFとして保存

Views:: 15

Visibility:: Public

Votes:: 0

Category:: ontap-9

Specialty:: nas<a>2010006807</a>

Last Updated:

環境

ONTAP 9
AD-LDAP
NFS

問題

マルチフロトコルアクセスノシヨウ（NFSクライアントカラNTFSホリユウムヘノアクセス）
ldapがns-switchでpasswdソースとして設定されている場合：

::>vserver services name-service ns-switch show -vserver svm1

Source

Vserver Database Order

--------------- ------------ ---------

svm1 hosts files,

dns

svm1 group ldap,

files

svm1 passwd ldap,

files

svm1 netgroup files

svm1 namemap files

5 entries were displayed.

一部のユーザについてはネームマッピングが機能しません。他のユーザについてはネームマッピングが正常に機能しています。

::*> diag secd authentication show-creds -node node1 -vserver svm1 -unix-user-name user1

Vserver: svm1 (internal ID: 5)

Error: Acquire UNIX credentials procedure failed

[ 17 ms] Entry for user-name: user1 not found in the current

source: FILES. Ignoring and trying next available source

[ 67] Using a cached connection to AD-LDAP-server.domain.com

**[ 1626] FAILURE: User 'user1' not found in UNIX authorization

** source LDAP.

[ 1626] Failed to get user info for name 'user1'

[ 1626] Entry for user-name: user1 not found in the current

source: LDAP. Entry for user-name: user1 not found in

any of the available sources

[ 1649] Unable to retrieve UID for UNIX user user1

Error: command failed: Failed to resolve user name to a UNIX ID. Reason: "SecD Error: object not found".

UNIXユーザがLDAPで見つかりません：

::*>vserver services name-service getxxbyyy getpwbyname -vserver svm1 -username user1 -use-cache false -show-source true

Error: command failed: Failed to resolve user1. Reason: Entry not found for "username: user1".

ネームマッピングが正しいと表示される：

::*> diag secd name-mapping show -node node1 -vserver svm1 -direction unix-win -name user1 'user1' maps to 'domain\user1'

SecDのログで、LDAPサーバがクエリに応答せず、ONTAPタイムアウトが3秒後に発生することを確認しました。

0000001e.001f4944 00ae3758 Thu Apr 18 2024 10:20:12 +00:00 [kern_secd:info:10675] | [000.113.514] debug: Connected to new LDAP (NIS & Name Mapping) service on AD-LDAP-server.domain.com { in makeConnectionAttempt() at src/connection_manager/secd_connection_manager.cpp:1035 } 0000001e.001f4945 00ae3758 Thu Apr 18 2024 10:20:12 +00:00 [kern_secd:info:10675] | [000.114.245] debug: Searching LDAP for the "uid, uidNumber, gidNumber, unixUserPassword, name, unixHomeDirectory, loginShell" attribute(s) within base "DC=domain,DC=com" (scope: 2) using filter: (&(objectClass=User)(uid=user1)) { in searchLdap() at src/utils/secd_ldap_utils.cpp:323 } 0000001e.001f4946 00ae3758 Thu Apr 18 2024 10:20:12 +00:00 [kern_secd:info:10675] | [003.138.486] info : LDAP search for the "uid, uidNumber, gidNumber, unixUserPassword, name, unixHomeDirectory, loginShell" attribute(s) within base "DC=domain,DC=com" (scope: 2) using filter "(&(objectClass=User)(uid=user1))" failed with error: Timed out { in searchLdap() at src/utils/secd_ldap_utils.cpp:405 } 0000001e.001f4947 00ae3758 Thu Apr 18 2024 10:20:12 +00:00 [kern_secd:info:10675] | [003.138.516] ERR : RESULT_ERROR_LDAPSERVER_TIMEOUT:7646 in searchLdap() at src/utils/secd_ldap_utils.cpp:411 0000001e.001f4948 00ae3758 Thu Apr 18 2024 10:20:12 +00:00 [kern_secd:info:10675] | [003.138.537] ERR : searchLdap: LDAP Error: (-5): 'Timed out':