I asked one of our idmap experts and his reply was

Manage acls from windows security tab. No need to add acls from zfs.

Ok, it's a little bit disapointing. I mean in that case why not just make an iscsi target to a windows server and make a dfs on the windows server?

Have you an idea if you will improve this part on the next release of nexenta?

thanks by advance

I think Linda was saying to manage the permissions from the windows server (or any other windows machine) initially.

Yeah i can understand that but i mean if i have to manage the quota from the nexenta box and the permissions from the windows server.

It's most simple to just make a scsi target to a windows server ,make a DFS and manage everything directly in the windows server.

That's why i ask if they manage to improve the integration between the cifs server (propably samba) and active directory for managing all things from the nexenta box

Why do you need to know the SID? you can just use username@domain, you could anyway in opensolaris / solaris using CIFS (its not SAMBA). I haven used CIFS with nexentastor.

In opensolaris /solaris (express) there were 2 versions of chmod and ls, probably removed the old one now, the one for the new ACLs (for CIFS) was in /usr/bin/chmod You would do something like the following:

/usr/bin/chmod -R A=everyone@:rwxpdDaARWcCos:fileinherit/dirinherit:allow /storage/ or chmod -R A=user:username@domain:rwxpdDaARWcCos:fileinherit/dirinherit:allow /storage/

Thats from what I remember anyway, its been a while since i have used it with AD (was testing a few years back with it).

For more info in mappings which probably will be usable with nexentastor look at: http://docs.oracle.com/cd/E19082-01/820-2429/820-2429.pdf

Also isnt the idmap dump only for users that have connected via CIFS share which are then assigned an ephemeral id for legacy permissions?

that command line should be

/usr/bin/chmod -R A=everyone@:rwxpdDaARWcCos:file_inherit/dir_inherit:allow /storage/

hope it shows it correctly now :)