Windows – Single Sign On and NFS permissions on Windows

nfspermissionssingle-sign-onwindows

Like many, I've been trying to move away from Microsoft Active Directory + CIFS file sharing into a custom LDAP solution + NFSv4. All the workstations here run Windows 7, and I have set up the following so far:

  • pGina is installed in every workstation and Logging into my custom OpenLDAP server works fine. The latest beta version of pGina even allows the user to change their password!
  • After activating NFS for Windows 7, I am able to successfuly mount an NFS share, although the server treats me like nobody/nogroup instead of giving me what is rightfully mine!

Now, the last item has been a big source of headaches for the last two days, because up-to-date, thorough information is hard to find. Here is the info that I gathered:

  • idmapd.conf is only used if you use the krb5 – or similar – authentication method to mount the NFS share. This means that you need to set up Kerberos, not a trivial task.
  • Windows needs an Identity Mapping Service to map local accounts to Unix accounts. There is some very good info on this here, but I've failed to find anyone that managed to do this on the internet. I've found an user with a problem, but without solution (and I fear it might happen to me).
  • It seems like there is (still?) a bug on Ubuntu 12.04's distribution of nfs-utils when configuring idmapd to retrieve mappings from a LDAP server (umich_ldap translation method). This is really important because it allows for centralized account management, one of the whole points of doing all this.

Now, before I delve into Kerberos and Windows Identity Mapping and apply Ubuntu patches and find even more problems, my questions are:
Has anyone gone down this road and managed to accomplish this successfuly? Should I head another direction? Where can I find some decent, thorough material on all this?

Thank you.

Best Answer

I would recommend using FreeIPA and it's Kerberos cross-realm trust with Active Directory. How this works:

  1. Install FreeIPA server as the Linux machines domain controller
  2. Create cross-realm trust between FreeIPA and AD (trust-add command) - related testing instructions
  3. Configure a Kerberos protected NFS share on the FreeIPA server or on another machine which is a FreeIPA client
  4. Mount that share either in Windows or Linux machines
  5. Profit!

I was playing with that recently and I was able to mount a Kerberos protected NFS share to Windows Server 2012 (after I installed the Unix extension), with Kerberos and single sign on.