Re: [zfs-discuss] Solaris 10 samba in AD mode broken when user in > 32 AD groups

2009-10-14 Thread Jens Elkner
On Tue, Oct 13, 2009 at 10:59:37PM -0600, Drew Balfour wrote: ... > For Opensolaris, Solaris CIFS != samba. Solaris now has a native in kernel > CIFS server which has nothing to do with samba. Apart from having it's > commands start with "smb", which can be confusing. > > http://www.opensolaris.

Re: [zfs-discuss] Solaris 10 samba in AD mode broken when user in > 32 AD groups

2009-10-13 Thread Drew Balfour
Jens Elkner wrote: On Tue, Oct 13, 2009 at 09:20:23AM -0700, Paul B. Henson wrote: We're currently using the Sun bundled Samba to provide CIFS access to our ZFS user/group directories. ... Evidently the samba engineering group is in Prague. I don't know if it is a language problem, or where th

Re: [zfs-discuss] Solaris 10 samba in AD mode broken when user in > 32 AD groups

2009-10-13 Thread James Lever
On 14/10/2009, at 2:27 AM, casper@sun.com wrote: So why not the built-in CIFS support in OpenSolaris? Probably has a similar issue, but still. In my case, it’s at least two reasons: * Crossing mountpoints requires separate shares - Samba can share an entire hierarchy regardless of ZF

Re: [zfs-discuss] Solaris 10 samba in AD mode broken when user in > 32 AD groups

2009-10-13 Thread Jens Elkner
On Tue, Oct 13, 2009 at 09:20:23AM -0700, Paul B. Henson wrote: > > We're currently using the Sun bundled Samba to provide CIFS access to our > ZFS user/group directories. ... > Evidently the samba engineering group is in Prague. I don't know if it is a > language problem, or where the confusion i

Re: [zfs-discuss] Solaris 10 samba in AD mode broken when user in > 32 AD groups

2009-10-13 Thread Paul B. Henson
On Tue, 13 Oct 2009, Drew Balfour wrote: > Ah. No. If you're using idmap and are mapping to an AD server, the > windows SIDs (which are both users and groups) are stored in a cred > struct (in cr_ksid) which allows more than 32 groups, up to 64k iirc. Ah, yes, I neglected to consider that given t

Re: [zfs-discuss] Solaris 10 samba in AD mode broken when user in > 32 AD groups

2009-10-13 Thread Paul B. Henson
On Tue, 13 Oct 2009 casper@sun.com wrote: > That's not entirely true; the issue is similar having more than 16 groups > as it breaks AUTH_SYS over-the-wire "authentication" but we already have > that now. [...] > For now, we're aiming for 1024 groups but also make sure that the > userland will

Re: [zfs-discuss] Solaris 10 samba in AD mode broken when user in > 32 AD groups

2009-10-13 Thread Drew Balfour
Paul B. Henson wrote: So why not the built-in CIFS support in OpenSolaris? Probably has a similar issue, but still. I wouldn't think it has this same issue; presumably it won't support more than the kernel limit of 32 groups, but I can't imagine that in the case when a user is in more than 32

Re: [zfs-discuss] Solaris 10 samba in AD mode broken when user in > 32 AD groups

2009-10-13 Thread Casper . Dik
>Regarding Solaris 10, my understanding was that the current 32 group limit >could only be changed by modifying internal kernel structures that would >break backwards compatibility, which wouldn't happen because Solaris >guarantees backwards binary compatibility. I could most definitely be >mista

Re: [zfs-discuss] Solaris 10 samba in AD mode broken when user in > 32 AD groups

2009-10-13 Thread Paul B. Henson
On Tue, 13 Oct 2009 casper@sun.com wrote: > So why not the built-in CIFS support in OpenSolaris? Probably has a > similar issue, but still. I wouldn't think it has this same issue; presumably it won't support more than the kernel limit of 32 groups, but I can't imagine that in the case when

Re: [zfs-discuss] Solaris 10 samba in AD mode broken when user in > 32 AD groups

2009-10-13 Thread Casper . Dik
> >We're currently using the Sun bundled Samba to provide CIFS access to our >ZFS user/group directories. So why not the built-in CIFS support in OpenSolaris? Probably has a similar issue, but still. >I found a bug in active directory integration mode, where if a user is in >more than 32 activ

[zfs-discuss] Solaris 10 samba in AD mode broken when user in > 32 AD groups

2009-10-13 Thread Paul B. Henson
We're currently using the Sun bundled Samba to provide CIFS access to our ZFS user/group directories. I found a bug in active directory integration mode, where if a user is in more than 32 active directory groups, samba calls setgroups with a group list of greater than 32, which fails, resulting