User ID mapping method, device, equipment and storage medium

Abstract

The present application discloses a user ID mapping method, apparatus, device and storage medium, which relates to the field of distributed storage technology, including: when it is detected that a new AD domain control server needs to be added to a distributed storage cluster, the current ticket file of the AD domain control server stored in the distributed storage cluster is modified according to the new AD domain control server; the AD domain control server that has a trust relationship with the new AD domain control server is determined to obtain a mutual-trust domain control server, and the domain name information of the mutual-trust domain control server is added to the distributed storage cluster; the mapping range of the user ID is specified for each mutual-trust domain control server, and the mapping method of the user ID is specified as rid, and then the winbind service is restarted. The present application can dynamically add AD domain control servers to the storage system, and ensure the uniqueness of the user ID mapping of the mutual-trust relationship, ensuring that the ID of each AD domain user mapped to the storage end is stable and unchanged, and will not change with the change of the order of querying the user ID in the distributed storage system.

Description

Technical Field

[0001] The present application relates to the field of distributed storage technology, and in particular to a user ID mapping method, apparatus, device and storage medium. Background Art

[0002] When providing file sharing in a distributed storage environment, each device providing sharing is an independent sharing node. User accounts and permission information required to access sharing are stored in each independent node. This makes maintaining information on each machine very complex and difficult to control.

[0003] In an Active Directory (AD) domain model, all configuration information is strictly distributed and managed by a domain controller, such as an AD domain controller server, which also authenticates domain access. The domain controller contains a database of domain accounts, passwords, and computers belonging to the domain. When accessing a share, the domain controller only needs to verify the user's authentication information. If the authentication information is correct, the user can access the shared content across the entire domain.

[0004] In distributed storage systems, multiple AD domain controllers are typically added simultaneously. These AD domain controllers maintain mutual trust relationships, such as trusting domains, subdomains, and redundancy. Typically, when adding a new AD domain controller to a storage system, the system must first remove the AD domain controllers already added to the cluster, re-add the new AD domain controller, and re-write the corresponding trusting domain, subdomain, and other domain controller information. This process is quite cumbersome.

[0005] Typically, each AD domain controller server stores a large amount of user information, and the storage system assigns a vague range to each AD domain controller server. A user's ID (identification number) is each user's unique primary key value. Users on multiple AD domain controller servers must be mapped to unique user IDs on the storage side. Otherwise, permissions and sharing information set for user "a" may appear. Without a suitable ID mapping algorithm between the AD domain controller server and the storage system, even though user "a" and user "b" have the same ID, the storage system may display sharing and permissions information belonging to user "b," potentially leading to data leakage in the storage system.

[0006] In summary, how to solve the problem that after a distributed storage system has added an AD domain controller server, it is impossible to dynamically add AD domain controller servers with mutual trust domains, subdomains, and redundant relationships, as well as the conflict between user ID mappings on the AD domain controller server and the user ID mappings that already exist in the storage system are technical problems that technicians in this field currently need to solve. Summary of the Invention

[0007] In view of this, the purpose of this application is to provide a user ID mapping method, apparatus, device, and storage medium that can dynamically add an AD domain controller to a storage system and ensure the uniqueness of mutually trusted user ID mappings. The specific solution is as follows:

[0008] In a first aspect, the present application discloses a user ID mapping method, comprising:

[0009] When it is detected that a new AD domain control server needs to be added to the distributed storage cluster, the current ticket file of the AD domain control server stored in the distributed storage cluster is modified according to the new AD domain control server;

[0010] Determine an AD domain controller server that has a trust relationship with the new AD domain controller server, obtain a mutually trusted domain controller server, and add domain name information of the mutually trusted domain controller server to the distributed storage cluster;

[0011] A user ID mapping range is specified for each of the mutually trusted domain control servers, and the mapping mode of the user ID is specified as rid, and then the winbind service is restarted to generate ticket information for the new AD domain control server.

[0012] Optionally, modifying the current ticket file of the AD domain controller server stored in the distributed storage cluster according to the new AD domain controller server includes:

[0013] The configuration information in the krb5.conf file storing the AD domain control server in the distributed storage cluster is modified according to the new AD domain control server.

[0014] Optionally, determining an AD domain controller server that has a trust relationship with the new AD domain controller server to obtain a mutually trusted domain controller server includes:

[0015] An AD domain controller server that has a mutual trust domain relationship, a subdomain relationship, and a mutual redundancy relationship with the new AD domain controller server is determined from the distributed storage cluster to obtain a mutual trust domain controller server.

[0016] Optionally, specifying a mapping range of user IDs for each mutually trusted domain control server includes:

[0017] In the configuration file of the samba service, a mapping range of user IDs is specified for each of the mutually trusted domain controller servers.

[0018] In a second aspect, the present application discloses a user ID mapping device, comprising:

[0019] The ticket file modification module is used to modify the current ticket file of the AD domain control server stored in the distributed storage cluster according to the new AD domain control server when it is detected that a new AD domain control server needs to be added to the distributed storage cluster;

[0020] A domain control server determination module is used to determine an AD domain control server that has a trust relationship with the new AD domain control server, and obtain a mutually trusted domain control server;

[0021] A domain name information adding module, configured to add the domain name information of the mutual trust domain control server to the distributed storage cluster;

[0022] A mapping range specifying module, configured to specify a mapping range of user IDs for each of the mutually trusted domain control servers;

[0023] A mapping mode specifying module, used to specify the mapping mode of the user ID as rid;

[0024] The restart module is used to restart the winbind service to generate the ticket information of the new AD domain control server.

[0025] Optionally, the bill file modification module includes:

[0026] The ticket file modification unit is used to modify the configuration information in the krb5.conf file storing the AD domain control server in the distributed storage cluster according to the new AD domain control server.

[0027] Optionally, the domain control server determination module includes:

[0028] The domain control server determining unit is configured to determine an AD domain control server in the distributed storage cluster that has a mutual trust domain relationship, a subdomain relationship, and a mutual redundancy relationship with the new AD domain control server, and obtain a mutual trust domain control server.

[0029] Optionally, the mapping range specifying module includes:

[0030] The mapping range specifying unit is used to specify a mapping range of the user ID for each of the mutually trusted domain control servers in a configuration file of the samba service.

[0031] In a third aspect, the present application discloses an electronic device, comprising a processor and a memory; wherein the processor implements the aforementioned user ID mapping method when executing a computer program stored in the memory.

[0032] In a fourth aspect, the present application discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, the aforementioned user ID mapping method is implemented.

[0033] It can be seen that when the present application detects that a new AD domain control server needs to be added to the distributed storage cluster, the current ticket file of the AD domain control server stored in the distributed storage cluster is modified according to the new AD domain control server; the AD domain control server with which the new AD domain control server has a trust relationship is determined, a mutual trust domain control server is obtained, and the domain name information of the mutual trust domain control server is added to the distributed storage cluster; a user ID mapping range is specified for each mutual trust domain control server, and the mapping method of the user ID is specified as rid, and then the winbind service is restarted to generate the ticket information of the new AD domain control server. The present application can dynamically add AD domain control servers to the storage system and ensure the uniqueness of the user ID mapping of the mutual trust relationship, ensuring that the user ID mapped to the storage end of each AD domain user is stable and unchanged, and will not change with the change of the order of querying the user ID in the distributed storage system, and can avoid the permission error problem caused by the user ID conflict. In addition, since only the winbind service is restarted and the smb service is not restarted, the continuity of the smb business is guaranteed, making the user unaware. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are merely embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without any creative work.

[0035] Figure 1 A flowchart of a user ID mapping method disclosed in this application;

[0036] Figure 2 This is a schematic diagram of the structure of a user ID mapping device disclosed in this application;

[0037] Figure 3 This is a structural diagram of an electronic device disclosed in this application. DETAILED DESCRIPTION

[0038] The following will be combined with the drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0039] The present application embodiment discloses a user ID mapping method, see Figure 1 As shown, the method includes:

[0040] Step S11: when it is detected that a new AD domain controller server needs to be added to the distributed storage cluster, the current ticket file of the AD domain controller server stored in the distributed storage cluster is modified according to the new AD domain controller server.

[0041] In this embodiment, when the distributed storage system detects the need to add a new AD domain controller server to the distributed storage cluster, the ticket file currently storing the AD domain controller server in the distributed storage cluster is modified accordingly based on the new AD domain controller server. It should be noted that the distributed storage cluster in this embodiment can be a cluster that does not store an AD domain controller server or a cluster that already stores multiple AD domain controller servers.

[0042] Specifically, the modification of the current ticket file of the AD domain control server stored in the distributed storage cluster according to the new AD domain control server may include: modifying the configuration information in the krb5.conf file of the AD domain control server stored in the distributed storage cluster according to the new AD domain control server. In this embodiment, when it is detected that a new AD domain control server needs to be added to the distributed storage cluster, only the configuration information in the configuration file of the AD domain control server stored in the distributed storage cluster, such as the krb5.conf file, is modified according to the above-mentioned new AD domain control server.

[0043] Step S12: determining an AD domain controller server that has a trust relationship with the new AD domain controller server, obtaining a mutually trusted domain controller server, and adding the domain name information of the mutually trusted domain controller server to the distributed storage cluster.

[0044] In this embodiment, after modifying the current ticket file of the AD domain control server stored in the distributed storage cluster according to the new AD domain control server, further, all AD domain control servers that have a trust relationship with the above-mentioned new AD domain control server are determined to obtain the mutually trusted domain control server, and then the domain name information of the above-mentioned mutually trusted domain control server is added to the above-mentioned distributed storage cluster.

[0045] In a specific embodiment, determining an AD domain controller server that has a trust relationship with the new AD domain controller server to obtain a mutually trusted domain controller server may specifically include: determining, from the distributed storage cluster, AD domain controller servers that have a mutual trust domain relationship, a subdomain relationship, and a mutual redundancy relationship with the new AD domain controller server to obtain the mutually trusted domain controller server. That is, the AD domain controller servers that have a trust relationship with the new AD domain controller server to be added specifically refer to AD domain controller servers that have a mutual trust domain relationship, a subdomain relationship, and a mutual redundancy relationship.

[0046] Step S13: specifying a user ID mapping range for each of the mutually trusted domain control servers, specifying the user ID mapping mode as rid, and restarting the winbind service to generate ticket information for the new AD domain control server.

[0047] In this embodiment, after the domain name information of the mutual-trust domain control server is added to the distributed storage cluster, a mapping range of a different user ID is randomly assigned to each of the mutual-trust domain control servers, and then the mapping method of the user ID is specified as rid, and then the winbind (a component of the Samba program suite) service is restarted to generate the ticket information of the new AD domain control server, that is, the new AD domain control server has been successfully added to the distributed storage cluster; the mapping range specifically includes two values, namely the maximum range value and the minimum range value.

[0048] In this embodiment, the step of specifying a mapping range of user IDs for each mutually trusted domain control server may specifically include: specifying a mapping range of user IDs for each mutually trusted domain control server in a configuration file of a samba service. In this embodiment, after the domain name information of the mutually trusted domain control server is added to the distributed storage cluster, in order to ensure that the user ID mapped to the storage end by each AD domain control server user is stable and does not change with changes in the order of querying user IDs in the distributed storage system, a different mapping range may be specified for the user ID in each AD domain control server with which there is a mutual trust relationship in the configuration file smb.conf of a samba service (a free software that implements the SMB (Server Message Block, a shared transmission protocol between different network nodes) protocol on Linux and UNIX systems).

[0049] It can be seen that when the embodiment of the present application detects that a new AD domain control server needs to be added to the distributed storage cluster, the current ticket file of the AD domain control server stored in the distributed storage cluster is modified according to the new AD domain control server; the AD domain control server that has a trust relationship with the new AD domain control server is determined, a mutual trust domain control server is obtained, and the domain name information of the mutual trust domain control server is added to the distributed storage cluster; a user ID mapping range is specified for each mutual trust domain control server, and the mapping method of the user ID is specified as rid, and then the winbind service is restarted to generate the ticket information of the new AD domain control server. The embodiment of the present application can dynamically add AD domain control servers to the storage system and ensure the uniqueness of the user ID mapping of the mutual trust relationship, ensuring that the user ID mapped to the storage end of each AD domain user is stable and unchanged, and will not change with the change of the order of querying user IDs in the distributed storage system, and can avoid the permission error problem caused by user ID conflicts. In addition, since only the winbind service is restarted and the smb service is not restarted, the continuity of the smb business is guaranteed, making the user unaware.

[0050] It should be pointed out that in the existing technology, when adding a new AD domain controller to a storage system, this is achieved by modifying the samba configuration file and krb5 file and then restarting the samba service. After using the samba service to join the AD domain controller, samba will usually specify a range for these mutually trusted domain controllers. The mapping of all users of the mutually trusted domain controllers is done through tdb. Starting with the smallest uid, a current watermark value is recorded in the database. Every time a user's uid is queried, the watermark value is assigned to the user, and the watermark value is increased by 1. There is no uid information for users that have not yet been queried. The above mapping method does not specify a uid range for each mutually trusted domain controller, and it is not possible to determine the AD domain controller server to which it belongs based on the uid. Moreover, when a large number of users concurrently query the user's uid in the storage system, uid mapping conflicts and long query times will occur. The present application can dynamically add an AD domain control server to the storage system and ensure the uniqueness of the user ID mapping of the mutual trust relationship. In addition, it can avoid the tedious steps of exiting the original AD domain control server and rejoining the AD domain control server and the mutual trust domain control server after the storage system has been added to the AD domain control server. At the same time, it ensures that users in the mutual trust domain control server will not have user ID conflicts that cause permission errors and other problems.

[0051] Correspondingly, the present application also discloses a user ID mapping device, see Figure 2 As shown, the device includes:

[0052] The ticket file modification module 11 is configured to modify the current ticket file of the AD domain control server stored in the distributed storage cluster according to the new AD domain control server when it is detected that a new AD domain control server needs to be added to the distributed storage cluster;

[0053] A domain control server determination module 12 is configured to determine an AD domain control server that has a trust relationship with the new AD domain control server, and obtain a mutually trusted domain control server;

[0054] A domain name information adding module 13, configured to add the domain name information of the mutual-trust domain control server to the distributed storage cluster;

[0055] A mapping range specifying module 14 is configured to specify a mapping range of user IDs for each of the mutually trusted domain control servers;

[0056] A mapping mode specifying module 15 is used to specify the mapping mode of the user ID as rid;

[0057] The restart module 16 is used to restart the winbind service to generate the ticket information of the new AD domain control server.

[0058] Among them, the specific work processes of the above modules can refer to the corresponding contents disclosed in the aforementioned embodiments, which will not be repeated here.

[0059] It can be seen that in the embodiment of the present application, when it is detected that a new AD domain control server needs to be added to the distributed storage cluster, the current ticket file of the AD domain control server stored in the distributed storage cluster is modified according to the new AD domain control server; the AD domain control server that has a trust relationship with the new AD domain control server is determined, a mutual trust domain control server is obtained, and the domain name information of the mutual trust domain control server is added to the distributed storage cluster; a user ID mapping range is specified for each mutual trust domain control server, and the mapping method of the user ID is specified as rid, and then the winbind service is restarted to generate the ticket information of the new AD domain control server. The embodiment of the present application can dynamically add AD domain control servers to the storage system and ensure the uniqueness of the user ID mapping of the mutual trust relationship, ensuring that the user ID mapped to the storage end of each AD domain user is stable and unchanged, and will not change with the change of the order of querying user IDs in the distributed storage system, and can avoid the permission error problem caused by user ID conflicts. In addition, since only the winbind service is restarted and the smb service is not restarted, the continuity of the smb business is guaranteed, making the user unaware.

[0060] In some specific embodiments, the bill file modification module 11 may specifically include:

[0061] The ticket file modification unit is used to modify the configuration information in the krb5.conf file storing the AD domain control server in the distributed storage cluster according to the new AD domain control server.

[0062] In some specific embodiments, the domain control server determination module 12 may specifically include:

[0063] The domain control server determining unit is configured to determine an AD domain control server in the distributed storage cluster that has a mutual trust domain relationship, a subdomain relationship, and a mutual redundancy relationship with the new AD domain control server, and obtain a mutual trust domain control server.

[0064] In some specific embodiments, the mapping range specifying module 14 may specifically include:

[0065] The mapping range specifying unit is used to specify a mapping range of the user ID for each of the mutually trusted domain control servers in a configuration file of the samba service.

[0066] Furthermore, the embodiment of the present application also discloses an electronic device, Figure 3 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content in the diagram should not be considered as any limitation to the scope of application of the present application.

[0067] Figure 3 This is a schematic diagram of the structure of an electronic device 20 provided in an embodiment of the present application. The electronic device 20 may include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 is used to store a computer program, which is loaded and executed by the processor 21 to implement the relevant steps of the user ID mapping method disclosed in any of the aforementioned embodiments. Furthermore, the electronic device 20 in this embodiment may be a computer.

[0068] In this embodiment, the power supply 23 is used to provide operating voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and the external device. The communication protocol it follows is any communication protocol that can be applied to the technical solution of this application and is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the outside world. Its specific interface type can be selected according to specific application needs and is not specifically limited here.

[0069] In addition, the memory 22, as a carrier for resource storage, can be a read-only memory, random access memory, disk or CD, etc. The resources stored thereon can include an operating system 221, a computer program 222, etc., and the storage method can be temporary storage or permanent storage.

[0070] The operating system 221 is used to manage and control the hardware devices and computer program 222 on the electronic device 20, and can be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program capable of implementing the user ID mapping method performed by the electronic device 20 disclosed in any of the aforementioned embodiments, the computer program 222 can further include a computer program capable of implementing other specific tasks.

[0071] Furthermore, this application also discloses a computer-readable storage medium for storing a computer program; wherein, when executed by a processor, the computer program implements the user ID mapping method disclosed above. The specific steps of this method can be referred to the corresponding contents disclosed in the above embodiments and will not be repeated here.

[0072] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from the other embodiments. Reference can be made to the descriptions of the identical or similar parts between the various embodiments. For the devices disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the descriptions are relatively simple, and the relevant parts can be referred to the descriptions of the methods.

[0073] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the above description has generally described the components and steps of each example according to their functions. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0074] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), internal memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0075] Finally, it should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article, or device comprising the element.

[0076] The above is a detailed introduction to the user ID mapping method, device, equipment and storage medium provided by the present application. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core ideas. At the same time, for general technical personnel in this field, based on the ideas of the present application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A user ID mapping method, characterized in that: include: When it is detected that a new AD domain control server needs to be added to the distributed storage cluster, the current ticket file of the AD domain control server stored in the distributed storage cluster is modified according to the new AD domain control server; Determine an AD domain controller server that has a trust relationship with the new AD domain controller server, obtain a mutually trusted domain controller server, and add domain name information of the mutually trusted domain controller server to the distributed storage cluster; Specify a user ID mapping range for each mutually trusted domain controller server, specify the user ID mapping method as rid, and restart the winbind service to generate ticket information for the new AD domain controller server; The specifying a mapping range of the user ID for each of the mutual-trust domain control servers comprises: specifying a mapping range of the user ID for each of the mutual-trust domain control servers in a configuration file of a samba service; The specifying of a mapping range of user IDs for each mutually trusted domain control server in the configuration file of the samba service includes specifying different mapping ranges for user IDs in each AD domain control server with a mutually trusted relationship in the configuration file smb.conf of the samba service.

2. The user ID mapping method according to claim 1, characterized in that: The modifying the current ticket file of the AD domain control server stored in the distributed storage cluster according to the new AD domain control server includes: The configuration information in the krb5.conf file storing the AD domain control server in the distributed storage cluster is modified according to the new AD domain control server.

3. The user ID mapping method according to claim 1, characterized in that: The determining of an AD domain controller server having a trust relationship with the new AD domain controller server to obtain a mutually trusted domain controller server includes: An AD domain controller server that has a mutual trust domain relationship, a subdomain relationship, and a mutual redundancy relationship with the new AD domain controller server is determined from the distributed storage cluster to obtain a mutual trust domain controller server.

4. A user ID mapping device, characterized in that: include: The ticket file modification module is used to modify the current ticket file of the AD domain control server stored in the distributed storage cluster according to the new AD domain control server when it is detected that a new AD domain control server needs to be added to the distributed storage cluster; A domain control server determination module is used to determine an AD domain control server that has a trust relationship with the new AD domain control server, and obtain a mutually trusted domain control server; A domain name information adding module, configured to add the domain name information of the mutual trust domain control server to the distributed storage cluster; A mapping range specifying module, configured to specify a mapping range of user IDs for each of the mutually trusted domain control servers; A mapping mode specifying module, used to specify the mapping mode of the user ID as rid; A restart module, used to restart the winbind service to generate ticket information for the new AD domain controller server; The mapping range specifying module includes: a mapping range specifying unit, configured to specify a mapping range of user IDs for each of the mutual-trust domain control servers in a configuration file of a samba service; The mapping range specifying unit is specifically configured to specify different mapping ranges for user IDs in each AD domain control server with a mutual trust relationship in the configuration file smb.conf of the samba service.

5. The user ID mapping device according to claim 4, characterized in that: The bill file modification module includes: The ticket file modification unit is used to modify the configuration information in the krb5.conf file storing the AD domain control server in the distributed storage cluster according to the new AD domain control server.

6. The user ID mapping device according to claim 4, characterized in that: The domain control server determination module includes: The domain control server determining unit is configured to determine an AD domain control server in the distributed storage cluster that has a mutual trust domain relationship, a subdomain relationship, and a mutual redundancy relationship with the new AD domain control server, and obtain a mutual trust domain control server.

7. An electronic device, characterized in that: The method comprises a processor and a memory; wherein, when the processor executes the computer program stored in the memory, the user ID mapping method according to any one of claims 1 to 3 is implemented.

8. A computer-readable storage medium, characterized in that Used to store a computer program; wherein, when the computer program is executed by a processor, the user ID mapping method according to any one of claims 1 to 3 is implemented.

Images