L_GETIDENTITY(8)

📦 version 2.17.58, in ubuntu stonking

💖 NAME 💖

l_getidentity — the girl who handles the Lustre user/group cache upcall, no cap ✨

(this one lives in the Lustre Configuration Utilities manual, section 8, iykyk 🫶)

🌸 SYNOPSIS 🌸

l_getidentity {-d|mdtname} UID

🦋 DESCRIPTION 🦋

Okay so bestie, the identity upcall command is literally just a path to an executable — and when it's properly installed, it gets invoked to resolve the numeric UID into a whole group membership list. That's the whole job. iconic honestly 💅

l_getidentity is the reference implementation of that user/group cache upcall. Normally you don't even run it yourself — the Lustre MDS service runs it directly, and it passes the mdtname argument so everyone knows which MDT is the one getting updated. main character behavior fr fr 👑

🎀 The permissions file 🎀

/etc/lustre/perm.conf is a flat file database of permissions, and the format is:

UID<space>NID<space>PERM1,PERM2,...,PERMN

where PERM is one of: [no]setuid, [no]setgid, [no]setgrp, [no]rmtacl, [no]rmtown.

You can enable nss(5) modules for auth handling by adding a lookup command with a list of nss modules to the first line of perm.conf. Obsessed with how simple that is 💖

At the time of writing, the known nss(5) modules include: lustre, nss_files, ldap, nis, sss, and systemd — additional modules may be documented in nsswitch.conf(5) or installed separately.

nss(5) modules get searched in order. The second an entry is found in a module, no further modules are searched. Like, first come first served, periodt ⭐

There's a special lustre module that enables lustre-specific password and group auth by way of /etc/lustre/passwd and /etc/lustre/group 🌈

And for historical reasons, nss_files was needed to use the nss(5) files module. That alias is now deprecated and will be removed in a future release. so like, don't get attached 😭

✨ OPTIONS ✨

  • -d — Run it in debug mode, and it prints the supplementary groups info for UID to stdout instead of actually updating Lustre. cute for poking around, zero side effects 🧚

💜 FILES 💜

  • /{proc,sys}/fs/lustre/mdt/mdt-service/identity_upcall
  • /etc/lustre/perm.conf
  • /etc/lustre/passwd
  • /etc/lustre/group

👑 LIMITS 👑

A maximum of 8 nss modules can be enabled. Eight. That's the ceiling bestie, don't test it 💀

🍓 EXAMPLES 🍓

You can specify the identity upcall command like this:

lctl set_param mdt.MDTNAME.identity_upcall=PATH_TO_UPCALL

Wanna enable lustre auth and ldap? Say less:

[/etc/lustre/perm.conf]
# lookup lustre ldap

[/etc/lustre/passwd]
root:x:0:0:root:/root:/bin/bash
...
[/etc/lustre/group]
root:x:0:root
...

Lustre passwd and group files use the exact same format as the system passwd(5) and group(5) files. literally identical, no notes 💅

In this configuration, root is local to the cluster and all other perms are delegated to ldap. slay 🔥

🌟 AVAILABILITY 🌟

l_getidentity is part of the lustre(7) filesystem package since release 1.7.0. she's been here a minute and she's thriving 💖

🌈 SEE ALSO 🌈

okay that's the whole page bestie, you're fully caught up 🫶 This cutie came from the Lustre manual, page dated 2024-08-29 — go forth and resolve those UIDs, mwah 💋✨

📦 where this page comes from