MIME-Version: 1.0
Date: Mon, 3 Feb 2014 16:13:11 -0500
Message-ID: <CAPCnwUeUEznrKvJ-upUV_VyaKKhZcKpZbLFeC08YMMQycWK-vg@mail.gmail.com>
Subject: Windows AD, Users with too many groups
From: Norman Elton <normelton@gmail.com>
To: "linux-nfs@vger.kernel.org" <linux-nfs@vger.kernel.org>
Content-Type: text/plain; charset=ISO-8859-1
Sender: linux-nfs-owner@vger.kernel.org

I've read stories about users having too many group memberships. We
seem to experience similar symptoms, though the usual tricks don't
seem to work.

In our case, there is a RHEL6 NFS server feeding multiple RHEL6 NFS
clients. This is all NFSv4 with Kerberos. Most users can login fine,
but domain admins get a "permission denied" when accessing their
NFS-mounted home directory. The most notable commonality is their high
number of group memberships.

I've tried inflating my group count to greater than 16, my account
continues to work fine.

We've tried adding "--manage-gids" to rpc.mountd, no luck. Although
it's unclear whether this really does anything in a kerberized
environment.

Any other suggestions? Other debugging tricks?

Thanks

Norman Elton