mount based on AD policy

Posit Professional & Hosted Products Posit Connect
1

Is there a functionality in RServer pro that enables mounts only for AD authorize users (logged in)?

So whenever one is logged in with AD credentials they only visible mount/shares should be the same as in Windows.

Would be to have something like a AD group mapper.

2

You can use PAM sessions together with pam_mount to mount these shares, c.f. https://support.rstudio.com/hc/en-us/articles/360044190234-How-to-mount-a-Windows-SMB-CIFS-share-via-PAM.

3

Great article on the mounts which I already used. This didn't solved the problem.
The mounts were created based on the domain group. Logins with AD credentials creates all the same gid on RHEL's so everyone has access to the mounts.

Also added the sssd.conf with the following.
auto_private_groups
Which makes the id == to gid in Linux.

The issue is more that there is no mapping between AD groups and Linux gid/group.

4

I don't understand the issue. Normally AD groups should be translated into Linux groups by sssd. Is that not the case for you?

If you have Linux groups based on AD groups you could (at least) use one of these approaches:

  • Mount the network drives globally using a technical user and adjust the access rights using Linux grous.
  • Use group-specific per-user mounts together with pam_mount.