Discussion:
Domain based DFS namespace works?
(too old to reply)
Suresh Jayaraman
2009-02-09 18:59:40 UTC
Permalink
Hi all,

It's not clear to me whether complete domain based DFS namespace support
is available or not with linux cifs implementation. For e.g.

Suppose there are two Win2k3 servers (dfs1, dfs2) and a seperate win2k3
PDC as AD (ad.domain). Both dfs1 and dfs2 are part of ad. dfs1 has a
namespace 'ns 'and referral link 'ref' present in dfs2.

If I try to mount the DFS namespace using AD domain, is it expected to work?
mount -t cifs //ad.domain/ns /mnt -o user=Administrator
(note that I'm trying to mount the referral directly)

In one of our setup it doesn't seem to be working. But I'm not sure
whether it's a configuration issue or not.

Thanks,
--
Suresh Jayaraman
Igor Mammedov
2009-02-09 19:47:26 UTC
Permalink
Post by Suresh Jayaraman
Hi all,
It's not clear to me whether complete domain based DFS namespace support
is available or not with linux cifs implementation. For e.g.
Suppose there are two Win2k3 servers (dfs1, dfs2) and a seperate win2k3
PDC as AD (ad.domain). Both dfs1 and dfs2 are part of ad. dfs1 has a
namespace 'ns 'and referral link 'ref' present in dfs2.
If I try to mount the DFS namespace using AD domain, is it expected to work?
mount -t cifs //ad.domain/ns /mnt -o user=Administrator
(note that I'm trying to mount the referral directly)
I guess It should be something like this:

//ad.domain/ns is so called DFS root.
Domain based DFS root is hosted on a primary domain controller and replicated
to backup domain controller.
So 'ad.domain' should be resolved to one of domain controllers and a domain
controller should host share 'ns'.
In case when ad.domain resolved to a backup domain controller, it may respond
on tree connect with PATH_UNCOVERED error and client should ask it for referrals.
Post by Suresh Jayaraman
In one of our setup it doesn't seem to be working. But I'm not sure
whether it's a configuration issue or not.
Thanks,
--
Best regards,

-------------------------
Igor Mammedov,
niallain "at" gmail.com
Jeff Layton
2009-02-09 20:43:52 UTC
Permalink
On Mon, 09 Feb 2009 18:29:33 +0530
Post by Suresh Jayaraman
Hi all,
It's not clear to me whether complete domain based DFS namespace support
is available or not with linux cifs implementation. For e.g.
Suppose there are two Win2k3 servers (dfs1, dfs2) and a seperate win2k3
PDC as AD (ad.domain). Both dfs1 and dfs2 are part of ad. dfs1 has a
namespace 'ns 'and referral link 'ref' present in dfs2.
If I try to mount the DFS namespace using AD domain, is it expected to work?
mount -t cifs //ad.domain/ns /mnt -o user=Administrator
(note that I'm trying to mount the referral directly)
In one of our setup it doesn't seem to be working. But I'm not sure
whether it's a configuration issue or not.
Thanks,
I doubt that will work unless ad.domain happens to resolve to an
address somehow. The mount.cifs program doesn't have support for
recognizing an AD domain in the host portion of the UNC.

Also, mounting DFS referrals directly has some problems at the
moment. Igor posted a patch to prevent oopses from that, but I think
we probably need to consider a more complete solution.
--
Jeff Layton <***@redhat.com>
Suresh Jayaraman
2009-02-09 22:45:12 UTC
Permalink
Post by Jeff Layton
On Mon, 09 Feb 2009 18:29:33 +0530
Post by Suresh Jayaraman
Hi all,
It's not clear to me whether complete domain based DFS namespace support
is available or not with linux cifs implementation. For e.g.
Suppose there are two Win2k3 servers (dfs1, dfs2) and a seperate win2k3
PDC as AD (ad.domain). Both dfs1 and dfs2 are part of ad. dfs1 has a
namespace 'ns 'and referral link 'ref' present in dfs2.
If I try to mount the DFS namespace using AD domain, is it expected to work?
mount -t cifs //ad.domain/ns /mnt -o user=Administrator
(note that I'm trying to mount the referral directly)
In one of our setup it doesn't seem to be working. But I'm not sure
whether it's a configuration issue or not.
I doubt that will work unless ad.domain happens to resolve to an
address somehow. The mount.cifs program doesn't have support for
recognizing an AD domain in the host portion of the UNC.
I think this is not happening now. The client should contact AD server
to know about the DFS root (since in domain based DFS namespace, the AD
is aware of the DFS namespaces). Yeah, obviously the mount.cifs should
recognize that it's a AD domain first.
Post by Jeff Layton
Also, mounting DFS referrals directly has some problems at the
moment. Igor posted a patch to prevent oopses from that, but I think
we probably need to consider a more complete solution.
Yes, I think this is not supported as of now.

Thanks,
--
Suresh Jayaraman
Igor Mammedov
2009-02-10 15:57:47 UTC
Permalink
Post by Suresh Jayaraman
Post by Jeff Layton
On Mon, 09 Feb 2009 18:29:33 +0530
Post by Suresh Jayaraman
Hi all,
It's not clear to me whether complete domain based DFS namespace support
is available or not with linux cifs implementation. For e.g.
Suppose there are two Win2k3 servers (dfs1, dfs2) and a seperate win2k3
PDC as AD (ad.domain). Both dfs1 and dfs2 are part of ad. dfs1 has a
namespace 'ns 'and referral link 'ref' present in dfs2.
If I try to mount the DFS namespace using AD domain, is it expected to work?
mount -t cifs //ad.domain/ns /mnt -o user=Administrator
(note that I'm trying to mount the referral directly)
In one of our setup it doesn't seem to be working. But I'm not sure
whether it's a configuration issue or not.
I doubt that will work unless ad.domain happens to resolve to an
address somehow. The mount.cifs program doesn't have support for
recognizing an AD domain in the host portion of the UNC.
I think this is not happening now. The client should contact AD server
to know about the DFS root (since in domain based DFS namespace, the AD
is aware of the DFS namespaces). Yeah, obviously the mount.cifs should
recognize that it's a AD domain first.
I our AD setup AD domain name resolves to a bunch of IP addresses of domain
controllers. So I guess it is a matter of a proper configuration of AD domain
and DNS.
Here is description of DNS usage by AD:
http://technet.microsoft.com/en-us/library/cc759550.aspx

Adding deps to mount.cifs on ldap libs may not be a good idea, instead of
we can try to add SRV records support in mount.cifs. This way mount.cifs
could ask for a domain controller by sending a query for SRV record
_ldap._tcp.AdDnsDomainName.
--
Best regards,

-------------------------
Igor Mammedov,
niallain "at" gmail.com
Suresh Jayaraman
2009-02-11 14:54:56 UTC
Permalink
Post by Igor Mammedov
Post by Suresh Jayaraman
Post by Jeff Layton
On Mon, 09 Feb 2009 18:29:33 +0530
Let me try to summarize the discussions so far to understand clearly
about the missing pieces:

* With the current code, it is not possible to mount domain based
namespaces (DFS root) using AD domain name (using netbios name may not
also be feasible? I haven't tried, though). This is due to mount.cifs
being unable to recognize, resolve AD domain name to an address.

* In case the AD domain name resolved to an address of backup domain
controller, the cifs client should ask for referral.

* If AD domain name is resolved to multiple IP's then there could be a
configuration issue.

Missing pieces and proposed approach (from Igor)

* To resolve AD domain name => add SRV record support to mount.cifs
* To make cifs client ask for referral => tree walk approach
http://lists.samba.org/archive/linux-cifs-client/2009-February/004033.html
* Support for mounting directly DFS referrals is not there. I think I
have not seen a proposed approach for this, yet.

Also, If we want Domain based DFS namespace, is there a manual invention
or specific configuration required on Windows Server side to ensure
replication (by either FRS or DFS Replication) is being done on the
domain controllers other than the one which hosts the share? or it's
being taken care on the server side when you create domain based
namespace itself?
Post by Igor Mammedov
Post by Suresh Jayaraman
Post by Jeff Layton
Post by Suresh Jayaraman
It's not clear to me whether complete domain based DFS namespace support
is available or not with linux cifs implementation. For e.g.
I doubt that will work unless ad.domain happens to resolve to an
address somehow. The mount.cifs program doesn't have support for
recognizing an AD domain in the host portion of the UNC.
I think this is not happening now. The client should contact AD server
to know about the DFS root (since in domain based DFS namespace, the AD
is aware of the DFS namespaces). Yeah, obviously the mount.cifs should
recognize that it's a AD domain first.
I our AD setup AD domain name resolves to a bunch of IP addresses of domain
controllers. So I guess it is a matter of a proper configuration of AD domain
and DNS.
http://technet.microsoft.com/en-us/library/cc759550.aspx
Adding deps to mount.cifs on ldap libs may not be a good idea, instead of
we can try to add SRV records support in mount.cifs. This way mount.cifs
could ask for a domain controller by sending a query for SRV record
_ldap._tcp.AdDnsDomainName.
Thanks,
--
Suresh Jayaraman
Shirish Pargaonkar
2009-02-09 22:29:10 UTC
Permalink
Post by Suresh Jayaraman
Hi all,
It's not clear to me whether complete domain based DFS namespace support
is available or not with linux cifs implementation. For e.g.
Suppose there are two Win2k3 servers (dfs1, dfs2) and a seperate win2k3
PDC as AD (ad.domain). Both dfs1 and dfs2 are part of ad. dfs1 has a
namespace 'ns 'and referral link 'ref' present in dfs2.
If I try to mount the DFS namespace using AD domain, is it expected to work?
mount -t cifs //ad.domain/ns /mnt -o user=Administrator
(note that I'm trying to mount the referral directly)
In one of our setup it doesn't seem to be working. But I'm not sure
whether it's a configuration issue or not.
Thanks,
--
Suresh Jayaraman
_______________________________________________
linux-cifs-client mailing list
https://lists.samba.org/mailman/listinfo/linux-cifs-client
I may be doing something incorrect, but with the cifs built with
latest git tree sources from Steve French's git tree,
when I access the dfs link (ll /mnt/dfsroot/dfslink), my system hangs.
I did apply Igor's patch and the same thing happens.
With the cifs from 2.6.27 I do have any problems, the same link
acccess works (i.e. lists the files on the dfslink'ed share
on the Samba server).

Regards,

Shirish
Suresh Jayaraman
2009-02-09 22:37:31 UTC
Permalink
Post by Suresh Jayaraman
Hi all,
It's not clear to me whether complete domain based DFS namespace support
is available or not with linux cifs implementation. For e.g.
Suppose there are two Win2k3 servers (dfs1, dfs2) and a seperate win2k3
PDC as AD (ad.domain). Both dfs1 and dfs2 are part of ad. dfs1 has a
namespace 'ns 'and referral link 'ref' present in dfs2.
If I try to mount the DFS namespace using AD domain, is it expected to work?
mount -t cifs //ad.domain/ns /mnt -o user=Administrator
(note that I'm trying to mount the referral directly)
Oops.. typo, it should have been "not trying to mount referral directly"
ad.domain/ns (DFS root) i.e. using the AD domain name instead of hostname.
Post by Suresh Jayaraman
In one of our setup it doesn't seem to be working. But I'm not sure
whether it's a configuration issue or not.
Thanks,
--
Suresh Jayaraman
Loading...