L\_GSSIAM\_UPCALL(8) Lustre Configuration Utilities L\_GSSIAM\_UPCALL(8)

# [NAME](#NAME)

l\_gssiam\_upcall - Handle Lustre GSSIAM security flavor upcalls

# [SYNOPSIS](#SYNOPSIS)

`l_gssiam_upcall` \[**-d**|**--debug**] \[**-p**|**--principal** *PRINCIPAL*] \[**-l**|**--loginuid** *LOGINUID*] *KEY*

# [DESCRIPTION](#DESCRIPTION)

**l\_gssiam\_upcall** is the reference implementation of the GSSIAM (Identity Access Management) security flavor user cache upcall. When a client performs a mount or connects to a server using the **gssiam** security flavor, the kernel requires a valid GSSIAM token for the user. It invokes **l\_gssiam\_upcall** to retrieve the enterprise GSSIAM token from the local environment and pass it back to the kernel via the **gssiam\_downcall** sysfs interface.

# [CONFIGURATION](#CONFIGURATION)

The behavior of the upcall and downcall mechanism is configured via sysfs/lctl tunables on the client.

## [Client Tunables](#Client_Tunables)

[**sptlrpc.gssiam.gssiam\_upcall**](#sptlrpc.gssiam.gssiam_upcall)

Specifies the path to the executable invoked to fetch a GSSIAM token. The default is **/usr/sbin/l\_gssiam\_upcall** but this can be changed using:

**lctl set\_param sptlrpc.gssiam.gssiam\_upcall=/path/to/upcall**

[**sptlrpc.gssiam.gssiam\_downcall**](#sptlrpc.gssiam.gssiam_downcall)

A write-only sysfs file used by the upcall to return the token to the kernel. Data written to this file must conform to the **gssiam\_downcall\_data** binary structure.

[**sptlrpc.gssiam.gssiam\_flush**](#sptlrpc.gssiam.gssiam_flush)

Writing a *KEY* to this file flushes the cached GSSIAM token for that specific user. Writing -1 clears all cached tokens for the GSSIAM security flavor.

# [OPTIONS](#OPTIONS)

[**-d**, **--debug**](#d)

Run in debug mode. This will print the generated token and principal to stdout instead of executing the downcall to the kernel sysfs interface.

[**-p**, **--principal** *PRINCIPAL*](#p)

(Optional) The principal name to use for the token lookup.

[**-l**, **--loginuid** *LOGINUID*](#l)

(Optional) The login UID of the process that mounted the filesystem.

[*KEY*](#KEY)

The key of the user requesting the token, is used to identify the mount session, which requests the token. It must be the last parameter.

# [EXAMPLES](#EXAMPLES)

Configure the client upcall path:

```
mgs# lctl set_param -P 
sptlrpc.gssiam.gssiam_upcall=/usr/local/bin/my_gssiam_upcall
```

Flush all cached GSSIAM tokens on the client:

```
client# lctl set_param sptlrpc.gssiam.gssiam_flush=-1
```

# [AVAILABILITY](#AVAILABILITY)

The **l\_gssiam\_upcall** command is part of the [**lustre**(7)](/man/enterprise-packages/lustre/lustre.7) filesystem package since release 2.17.57.

# [SEE ALSO](#SEE_ALSO)

[**lustre**(7)](/man/enterprise-packages/lustre/lustre.7), [**l\_getidentity**(8)](/man/enterprise-packages/lustre/l_getidentity.8), [**l\_gssiam\_auth**(8)](/man/enterprise-packages/lustre/l_gssiam_auth.8), [**lctl**(8)](/man/enterprise-packages/lustre/lctl.8), [**lctl-set\_param**(8)](/man/enterprise-packages/lustre/lctl-set_param.8)

2026-08-16 Lustre

---

Document: l_gssiam_upcall(8) from lustre 2.17.59-r1 (Chainguard OS)
Source: https://github.com/lustre/lustre-release