L_GETIDENTITY(8)

NAME
l_getidentity - Handle Lustre user/group cache upcall

SYNOPSIS
l_getidentity {-d|mdtname} UID

DESCRIPTION
The identity upcall command specifies the path to an executable that, when properly installed, is invoked to resolve the numeric UID to a group membership list.

l_getidentity is the reference implementation of the user/group cache upcall. This command is normally run directly by the Lustre MDS service and specifies the mdtname argument for the MDT that should be updated.

  The permissions file
/etc/lustre/perm.conf supports a flat file database of permissions in the format:
    UID<space>NID<space>PERM1,PERM2,...,PERMN
where PERM is one of: [no]setuid [no]setgid [no]setgrp [no]rmtacl [no]rmtown

nss(5) modules can be enabled for auth handling by adding a lookup command with a list of nss modules to the first line of perm.conf

At the time of writing, known nss(5) modules include: lustre, nss_files, ldap, nis, sss, andsystemd additional modules may be documented in nsswitch.conf(5) or installed separately.

nss(5) modules are searched in order. Once an entry is found in the module no further modules are searched.

A special lustre module is used to enable lustre specific password and group auth by way of /etc/lustre/passwd and /etc/lustre/group

For historical reasons nss_files was needed to use the nss(5) files module. This alias is now deprecated and will be removed in a future release.

OPTIONS

-d  Run in debug mode and print supplementary groups information for UID to stdout instead of updating Lustre.

FILES
    /{proc,sys}/fs/lustre/mdt/mdt-service/identity_upcall
    /etc/lustre/perm.conf
    /etc/lustre/passwd
    /etc/lustre/group

LIMITS
A maximum of 8 nss modules can be enabled.

EXAMPLES
The identity upcall command can be specified via:
        lctl set_param mdt.MDTNAME.identity_upcall=PATH_TO_UPCALL

Enable lustre auth and ldap:
        [/etc/lustre/perm.conf]
        # lookup lustre ldap

        [/etc/lustre/passwd]
        root:x:0:0:root:/root:/bin/bash
        ...
        [/etc/lustre/group]
        root:x:0:root
        ...
Lustre passwd and group files use the same format as the system passwd(5) and group(5) files.

In this configuration root is local to the cluster and all other perms are delegated to ldap.

AVAILABILITY
l_getidentity is part of the lustre(7) filesystem package since release 1.7.0

SEE ALSO
group(5), nss(5), passwd(5)

Lustre Programming Interfaces section of Lustre Operations Manual.