Re: krb5 mount with large group membership

[Richard Smits <R.Smits@tudelft.nl>]

Hi,

Good tip. Thank you.

note : If I check the "Do not require Kerberos preauthentication" in the 
AD on my testaccount, it works...

So now i have to look what else this breaks.

Greetings .. Richard

On 07/14/2011 01:14 PM, Assarsson, Emil wrote:
> Hi,
>
> Your ticket is probably oversized for the NFS server.
> Try set NO_AUTH_DATA_REQUIRED (google msn) on the object holding the servers SPN.
>
> --
> Emil Assarsson
>
>> -----Original Message-----
>> From: linux-nfs-owner@vger.kernel.org [mailto:linux-nfs-owner@vger.kernel.org]
>> On Behalf Of Richard Smits
>> Sent: torsdag den 14 juli 2011 11:30
>> To: linux-nfs@vger.kernel.org
>> Subject: krb5 mount with large group membership
>>
>> Hello list,
>>
>> I am running into a problem. Perhaps someone understands what is
>> happening here. I will explain.
>>
>> I have a Redhat 5.4 client that is accessing a nfs export on a NFS
>> server. (Redhat 6.1)
>>
>> Our KDC is a Windows AD.
>>
>> The client is using samba-winbind. If a user is a member of 23 groups or
>> lower, I can access the export. If a user is a member of more groups,
>> the mount fails with a "Permission denied"
>>
>> mount /data
>> -bash-3.2$ cd /data
>> -bash: cd: /data: Permission denied
>>
>> Thew odd thing is if I try a mount to our Netapp filer with also a krb5
>> export, there is no problem.
>>
>> This has to do something with the ticket size in combination with
>> memberships to a large number of groups.
>>
>> So what must i do to get this Redhat server working with this setup ? It
>> seems that Netapp did something to get this working ?
>>
>> Does this sound familiar to anyone, or should i provide more information ?
>>
>> Versions server side :
>> nfs-utils-1.2.3-7
>> krb5-workstation-1.9-9
>>
>> Greetings ... Richard Smits
>> --
>> To unsubscribe from this list: send the line "unsubscribe linux-nfs" in
>> the body of a message to majordomo@vger.kernel.org
>> More majordomo info at  http://vger.kernel.org/majordomo-info.html