Secure NFS relies on the Kerberos authentication protocol, which is an integrated feature of the NFSv4 protocol suite. Therefore, enabling NFSv4 is a fundamental requirement. For the NAS server to enforce file-level permissions, it must map the authenticated Kerberos principal (the user) to a local UNIX identity (UID/GID). A UNIX Directory Service, such as LDAP or NIS, provides the necessary centralized and consistent user and group information for the NAS server to perform this mapping. Without this service, the server cannot resolve the user's identity to apply the correct access controls.

1. Dell PowerFlex File Services Configuration and Management Guide: In the section "Kerberos for NFS

" the documentation states

"Kerberos provides authentication for NFSv4 clients that access the NAS server... The NAS server must be configured to use a directory service such as LDAP or NIS to retrieve user information." This directly confirms the requirement for both NFSv4 and a UNIX Directory Service. (Reference specific to Dell PowerFlex platform).

2. Dell PowerStore Security Configuration Guide: On page 48

under the "Secure NFS" section

it specifies

"PowerStore supports Secure NFS using Kerberos authentication with NFSv4... For name resolution [of user/group identities]

PowerStore supports Network Information Service (NIS) and Lightweight Directory Access Protocol (LDAP)." This corroborates that NFSv4 and a directory service (LDAP/NIS) are essential components.

3. University of Michigan

Center for Information Technology Integration (CITI) - NFSv4 Kerberos Technical Brief: This academic document explains the architecture

stating

"NFSv4 uses the RPCSECGSS security flavor to carry Kerberos V5 tokens... The server must be able to map the client's Kerberos principal name to a local user account (UID)." This highlights the dual requirements of the NFSv4 protocol and a mechanism for identity mapping

which is provided by a UNIX Directory Service. (Document: nfs-kerberos-brief.pdf).