强化 AD 的 NAS 存储桶访问失败
适用于
- ONTAP 9
- ONTAP S3
- Active Directory
- LDAP
问题
- 创建后，使用强化 AD 的凭据时无法访问 NAS 存储桶
- AD 的网络安全策略配置为在下次密码更改时不存储 LAN Manager 哈希值：
- SECD 错误在检索凭据时返回错误：
[Node1: secd: secd.nfsAuth.noCifsCred:error]: vserver (svm1) NFS authorization cannot retrieve CIFS credentials. Error: Get user credentials procedure failed[ 4] S3 user 's3user' mapped to UNIX user 'pcuser'[ 24] S3 user 's3user' mapped to Windows user 'DOMAIN\UserAD'[ 24] Using cached 'DOMAIN\UserAD' SID mapping.[ 27] Successfully connected to ip 10.0.0.1, port 88 using TCP[ 33] Could not get credentials via S4U2Self based on full Windows user name 'ExampleUserAD@domain.com'. Continuing to LDAP.[ 36] Successfully connected to ip 10.0.0.1, port 389 using TCP[ 42] Using a cached connection to ad.domainad.com[ 44] Could not get credentials via LDAP for Windows user 'test' based on SID[ 44] FAILURE: Could not get credentials for Windows user 'test' or SID- LDAP 属性结果在 TokenGroups 中缺失：
[kern_secd:info:10999] | [000.068.859] info : Using a cached connection to ad.domainad.com { in getBestConnection() at src/connection_manager/secd_connection_manager.cpp:985 }00000016.0ce347ff 0911b10d Tue Jul 07 2026 14:10:37 +01:00 [kern_secd:info:10999] | [000.071.283] debug: Searching LDAP for the "PrimaryGroupId" attribute(s) within base "<SID=0105000000000005150000001bcae4f0a62e1b010ae0cc4954a90000>" (scope: 0) using filter: (objectClass=*) { in searchLdap() at src/utils/secd_ldap_utils.cpp:324 }[kern_secd:info:10999] | [000.074.638] debug: Searching LDAP for the "tokenGroups" attribute(s) within base "<SID=0105000000000005150000001bcae4f0a62e1b010ae0cc4954a90000>" (scope: 0) using filter: (objectClass=*) { in searchLdap() at src/utils/secd_ldap_utils.cpp:324 }[000.075.861] ERR : RESULT_ERROR_SECD_LDAP_ATTRIBUTE_MISSING:7054 in getLdapValueLen() at src/utils/secd_ldap_utils.cpp:464[kern_secd:info:10999] | [000.075.869] ERR : LDAP returned 0 results for attribute tokenGroups- S3 用户已按预期映射并存在于 AD 中