MayaNAS Multiprotocol Setup with Active Directory

MayaNAS enables unified file access from Windows (SMB) and Linux (NFS) clients with consistent user identity via Active Directory. This guide covers server-side configuration for multiprotocol shares.

What is Multiprotocol Access?

Multiprotocol storage allows the same files to be accessed via different protocols—SMB for Windows clients and NFS for Linux clients—while maintaining consistent file ownership and permissions across both.

When a Windows user creates a file, it appears with the correct owner when viewed from Linux, and vice versa. This requires:

Unified identity source — Active Directory provides user/group information to both protocols
Consistent UID mapping — Windows SIDs map to Unix UIDs the same way on server and clients
Compatible share configuration — MayaNAS Multi-Protocol share profile

How Identity Mapping Works

Understanding identity mapping is key to successful multiprotocol setup:

Windows User: TEST\testuser
       ↓
   Windows SID: S-1-5-21-xxx-1103
       ↓
   Active Directory lookup
       ↓
   Unix UID: 1818001103 (algorithmic mapping from SID)
       ↓
MayaNAS stores file with UID 1818001103
       ↓
   Linux client resolves UID → testuser (via SSSD/AD)
       ↓
Linux User sees: testuser

Files created by testuser from Windows show testuser as owner on Linux, and vice versa—as long as both systems resolve the user to the same UID.

Server Setup: Join Active Directory

Step 1: Open Directory Services

Log in to MayaNAS web interface: https://<mayanas-ip>:10000
Navigate to Configure Server → Directory Services tab

Step 2: Discover and Join Domain

Click Discover
Enter your AD domain name (e.g., test.local)
Click Apply

DNS Requirement: MayaNAS must resolve the AD domain. If discovery fails with "No such realm found", add your domain controller as the first nameserver in /etc/resolv.conf.

If DNS is configured correctly, discovery shows domain details including realm name, server software, and required packages.

Click Cancel to return to main screen
Click Join
Enter credentials:
- Domain: test.local
- Username: Administrator
- Password: (AD admin password)
Click Apply

After successful join, Directory Services shows your domain, login formats, and NFS SPN status.

Navigate to NFS Shares
Click New
Configure the share:
- Share Label: multishare
- NFSv3 + NFSv4: Both checked
- Storage: Select pool, create new dataset
- Allowed Clients: * or your network CIDR
- Security: auth_sys (for simple multiprotocol)

Critical — Set Ownership for AD Users:
For multiprotocol access, set ownership during NFS share creation:

Owner: root
Group: domain users@test.local (your AD group)
Mode: 2775 (group writable + setgid)

Without this, AD users get "Permission denied" when creating files. The default root:root with 755 doesn't allow AD group members to write.

Click Finish
Select the share checkbox and click Bind to activate

Navigate to SMB Shares
Select the same dataset you created for NFS
Click New
Set Share Profile to Multi-Protocol (SMB+NFS)
Click Finish
Select the share and click Bind to activate

MayaNAS now serves the same data via both SMB and NFS with unified identity mapping.

Profile	ACL Type	NFS Compatible	Use Case
POSIX+setgid	POSIX	Yes	Linux-only environments
Windows Clients	ZFS/NFSv4 ACLs	No	Windows-only with full NTFS ACLs
Multi-Protocol	POSIX (mapped)	Yes	Mixed Windows + Linux access

Client Setup Guides

With the server configured, choose your client setup path based on your NFS security requirements:

Simple Multiprotocol

NFS Security: sec=sys

Standard NFS with UID-based identity. Linux client joins AD via SSSD to resolve the same UIDs as MayaNAS.

Best for: Trusted networks, most enterprise environments

Client Setup Guide →

Secure Multiprotocol

NFS Security: sec=krb5

Kerberos-authenticated NFS. Users prove identity via tickets from Active Directory KDC.

Best for: Zero-trust environments, compliance requirements

Client Setup Guide →

Server-Side Troubleshooting

Symptom	Cause	Fix
AD discover: "No such realm found"	DNS not resolving AD	Add DC IP as first nameserver in `/etc/resolv.conf`
AD join: "Preauthentication failed"	Wrong password or time skew	Verify password; sync time with `chronyc makestep`
AD users can't write to share	Share has `root:root` 755	Set group to AD group, mode to `2775`
SMB: "Access Denied"	User not in valid group	Verify user is member of `domain users`

Manual Permission Fix

If you created the share without setting ownership, fix it on the MayaNAS server:

# SSH to MayaNAS
ssh admin@mayanas-ip

# Fix ownership and permissions
chown root:"domain users@test.local" /nfs-pool/multishare
chmod 2775 /nfs-pool/multishare

# Verify
ls -la /nfs-pool/ | grep multishare
# Should show: drwxrwsr-x root domain users@test.local

Summary

MayaNAS multiprotocol setup requires:

Join Active Directory — DNS must resolve the domain
Create NFS share with AD group ownership — domain users@test.local with mode 2775
Create SMB share with Multi-Protocol profile — uses same dataset as NFS
Configure clients — see Path A or Path B guides above

MayaNAS Enterprise

High-performance NFS with built-in AD integration, multiprotocol support, and cloud tiering.

Contact Sales

Open Source

Deploy MayaNAS using our open-source Terraform modules on GCP, AWS, or Azure.

View on GitHub