l_gssiam_upcall(8)

L_GSSIAM_UPCALL(8)

Lustre Configuration Utilities

L_GSSIAM_UPCALL(8)

NAME

l_gssiam_upcall - Handle Lustre GSSIAM security flavor upcalls

SYNOPSIS

l_gssiam_upcall [-d|--debug] [-p|--principal PRINCIPAL] [-l|--loginuid LOGINUID] KEY

l_gssiam_upcall is the reference implementation of the GSSIAM (Identity Access Management) security flavor user cache upcall. When a client performs a mount or connects to a server using the gssiam security flavor, the kernel requires a valid GSSIAM token for the user. It invokes l_gssiam_upcall to retrieve the enterprise GSSIAM token from the local environment and pass it back to the kernel via the gssiam_downcall sysfs interface.

CONFIGURATION

The behavior of the upcall and downcall mechanism is configured via sysfs/lctl tunables on the client.

Client Tunables

sptlrpc.gssiam.gssiam_upcall: Specifies the path to the executable invoked to fetch a GSSIAM token. The default is /usr/sbin/l_gssiam_upcall but this can be changed using:

lctl set_param sptlrpc.gssiam.gssiam_upcall=/path/to/upcall

sptlrpc.gssiam.gssiam_downcall: A write-only sysfs file used by the upcall to return the token to the kernel. Data written to this file must conform to the gssiam_downcall_data binary structure.
sptlrpc.gssiam.gssiam_flush: Writing a KEY to this file flushes the cached GSSIAM token for that specific user. Writing -1 clears all cached tokens for the GSSIAM security flavor.

OPTIONS

-d, --debug: Run in debug mode. This will print the generated token and principal to stdout instead of executing the downcall to the kernel sysfs interface.
-p, --principal PRINCIPAL: (Optional) The principal name to use for the token lookup.
-l, --loginuid LOGINUID: (Optional) The login UID of the process that mounted the filesystem.
KEY: The key of the user requesting the token, is used to identify the mount session, which requests the token. It must be the last parameter.

EXAMPLES

Configure the client upcall path:

mgs# lctl set_param -P 
sptlrpc.gssiam.gssiam_upcall=/usr/local/bin/my_gssiam_upcall

Flush all cached GSSIAM tokens on the client:

client# lctl set_param sptlrpc.gssiam.gssiam_flush=-1

AVAILABILITY

The l_gssiam_upcall command is part of the lustre(7) filesystem package since release 2.17.57.