Access Protocols and Client Integration
Domain overview
Access Protocols and Client Integration tests how clients reach data: SMB for Windows, NFS for Linux/UNIX, S3 and HDFS for object and analytics, plus authentication and permission mapping.
Protocol rules
- SMB supports SMB2 and SMB3; modern OneFS deployments should avoid SMB1. SMB shares use Windows ACLs and AD identities. Continuous Availability shares suit Hyper-V and SQL Server workloads that need transparent failover.
- NFSv3 and NFSv4 exports use UNIX permissions or NFSv4 ACLs; Kerberos security modes require time sync and service principals. Export host restrictions are part of the export definition, not the client mount command.
- S3 provides an object interface with buckets and access keys; HDFS exposes a namespace for Hadoop clients. These are not substitutes for POSIX permissions and should be planned with access zones.
- SmartConnect DNS gives clients a stable name. Mount the SmartConnect zone name, not an individual node address, or you lose load balancing and failover.
Permissions and identity
- OneFS maps identities across AD, LDAP, NIS, and local providers. In mixed SMB/NFS environments, decide whether the on-disk identity is UNIX or Windows and configure mapping consistently.
- Access zones separate authentication providers and share/export namespaces. A client in the wrong zone sees the wrong shares or no access.
Worked example
A Windows client cannot open \finance.powerscale.example.com\reports. DNS resolves the SmartConnect zone to a node IP. Check, in order: the client is in the correct access zone; the SMB share exists and is enabled; AD authentication succeeds; share and NTFS permissions allow the user; SMB1 is not required by the client. If NFS clients also access the same directory, verify that the UNIX and Windows identity mapping does not strip permissions.
Traps
- Mounting a node IP instead of the SmartConnect zone.
- Assuming NFS export restrictions apply to SMB or that SMB share permissions override NTFS ACLs.
- Forgetting Kerberos time synchronization.
- Enabling SMB1 globally to fix one legacy client.