What is Active Directory Lookup (PN)?
Active Directory Lookup (PN) is a mechanism that allows NFS clients and servers running on Windows or Unix systems to query Microsoft Active Directory (AD) to resolve user and group identity information. Specifically, it retrieves
- User Identifiers (UIDs)
- Group Identifiers (GIDs)
Why is this important?
NFS (Network File System) traditionally uses numeric UIDs and GIDs to manage permissions and ownership of files. In mixed environments where Windows Active Directory is the central directory service, user accounts are represented differently (with Security Identifiers – SIDs).
Without Active Directory Lookup, mapping between Windows accounts (SIDs) and UNIX identities (UIDs/GIDs) can be challenging and inconsistent.
How Active Directory Lookup (PN) works:-
- Integration with AD: The Client for NFS or Server for NFS queries AD using LDAP or other AD protocols.
- User/Group Mapping: The feature queries the AD schema where UNIX attributes are stored (like
uidNumber,gidNumber,unixHomeDirectory,loginShell). - UID/GID Retrieval: Retrieves UID and GID attributes assigned to the user or group in AD.
- Use in NFS: The retrieved UIDs and GIDs are then used by the NFS client or server to enforce file permissions and ownership.
Key benefits:-
- Centralized Identity Management: No need to manually sync UID/GID across machines.
- Consistent Permissions: Users have the same file access rights across Windows and Unix systems.
- Simplifies Mixed Environments: Easier to manage hybrid Windows-Unix environments.
Prerequisites and Setup:-
- The Active Directory must have the Identity Management for UNIX (also called Services for UNIX or UNIX attributes) schema extensions enabled to store UNIX attributes.
- Users and groups in AD must have UNIX attributes assigned (
uidNumber,gidNumber, etc.). - NFS clients/servers must be configured to use AD Lookup instead of local files.
- Proper permissions and network access between NFS clients/servers and AD are required.
Example use cases:
- An organization with Windows AD as the primary directory wants to use NFS file shares on Linux servers.
- Users log in from Windows and Unix systems, and their permissions on shared files need to match consistently.
- UID/GID mapping happens automatically via Active Directory Lookup, removing manual syncing or mapping tables.