How do I correctly map UIDs on NFS servers across multiple domains?

Question

I have my own private cluster with CentOS 6 NFS servers and I am trying to make the NFS server available to my own cluster as well as a "shared cluster". The NFS server works completely fine within my own private cluster because both the NFS server and the NFS clients there authenticate to my private LDAP server and idmapd.conf all contain my domain. However, the trouble I run into when exporting NFS to the shared cluster is that everyone's ownership turns into nobody:nobody. All the shared cluster clients authenticate to the shared cluster's LDAP server and they have a different domain than I do.

How can I properly map UIDs so that we can avoid the nobody:nobody issue when exporting our NFS to a different domain?

Answer 1

1) If you need your own domain and LDAP server then you could coordinate with the admins in their domain to synchronize the UIDs and GIDs so that they are the same on both. This isn't too hard if the users on the other domain don't need to access anything in your domain other than the NFS shares and if the users in your domain don't need to access anything in theirs but if they do then you'll have to alter the ownership for anyone directories and files where the UIDs and GIDs don't match.

2) If you don't need your own domain then you could move or recreate the users and groups in your domain on the domain on their LDAP server and authenticate against theirs. This would prevent you from having to mess with it in the future but there'd still be the problem of having the change ownership for the existing files and directories.

Neither one is easy but that's what you're looking it.