Patent Application
20070011136
This application contains subject matter which is related to the subject matter of the following application, which is assigned to the same assignee as this application and is hereby incorporated herein by reference in its entirety:
“DYNAMIC MANAGEMENT OF NODE CLUSTERS TO ENABLE DATA SHARING,” Craft et al., U.S. Ser. No. 10/958,927, filed Oct. 5, 2004.
This invention relates, in general, to data sharing in a communications environment, and in particular, to facilitating access to data stored on shared storage media of the communications environment.
In a communications environment, such as a shared disk cluster file system, data and metadata are stored on shared storage media (e.g., shared disks) accessible by nodes of one or more clusters coupled to the shared disk cluster file system. A node in a cluster accesses data and metadata directly from the shared disks.
A problem arises, however, if the nodes accessing the file system belong to two or more clusters with separately defined user accounts and user identifiers. For example, using technologies, such as fibre channel to internet protocol (FC/IP) routers, it is possible to link the storage area networks (SANs) of clusters at two different locations, A and B, into a single logical SAN, so that nodes from both clusters can directly access file systems stored on disks at either location. In this configuration, a user “John Smith” may have an account in both clusters, but the login name and numerical user id may be different in the two clusters. For instance, in Cluster A, the login name is “John” and the numerical user ID is 409, while in Cluster B, the login name is “J Smith” with a user id of 517. When John Smith creates a file logged in as “John” in Cluster A, user id 409 is recorded as the file owner in the metadata (file inode) stored on shared disk. When John Smith then logs in to a node in Cluster B, the file system does not allow him access to the same file because user id 517 associated with J Smith under which John is logged in Cluster B does not match user id 409 recorded as the file owner on shared disk.
Based on the foregoing, a need exists for a capability that allows a user to access files with the same permissions and access rights in different clusters. For instance, a need exists for an enhancement to the shared disk file system that allows a user uniform access to its files with the same permissions, regardless from which cluster (under which account) the user is accessing the data. In particular, a need exists for a capability that provides an identifier that enables a user to access data from multiple clusters with the same permissions.
The shortcomings of the prior art are overcome and additional advantages are provided through the provision of a method of facilitating access to data stored on shared storage media. The method includes, for instance, creating an identifier for a user with a first account in a first administrative domain and a second account in a second administrative domain, the identifier corresponding to the second account in the second administrative domain; and using the identifier in the first administrative domain to access data managed by the second administrative domain, the data being stored on one or more shared storage media directly accessible by the first administrative domain and the second administrative domain.
System and computer program products corresponding to the above-summarized method are also described and claimed herein.
Additional features and advantages are realized through the techniques of the present invention. Other embodiments and aspects of the invention are described in detail herein and are considered a part of the claimed invention.
The subject matter which is regarded as the invention is particularly pointed out and distinctly claimed in the claims at the conclusion of the specification. The foregoing and other objects, features, and advantages of the invention are apparent from the following detailed description taken in conjunction with the accompanying drawings in which:
In accordance with an aspect of the present invention, access to data stored on shared storage media is facilitated. The shared storage media is directly accessible by nodes of a plurality of administrative domains (e.g., clusters). Data managed by one administrative domain is accessible by other administrative domains. A user may have accounts on a plurality of administrative domains and wish to access data from each of those domains. To enable consistent access and permission checking, an identifier is created, in accordance with an aspect of the present invention, that enables the user to access data with the same permission checking, regardless of the administrative domain from which the user is accessing the data.
An administrative domain is a grouping of one or more nodes that is maintained independently from other domains. Each domain is maintained separately allowing individual administrative policies to prevail within a particular domain. One example of an administrative domain is a cluster. Although examples are described herein with reference to clusters, one or more aspects of the present invention apply to other administrative domains.
One example of a configuration of an administrative domain is depicted in
Nodes 102 are also coupled to a storage area network (SAN) 106, which further couples the nodes to one or more storage media 108. The storage media includes, for instance, disks or other types of storage media. The storage media includes files having data to be accessed. A collection of files is referred to herein as a file system, and there may be one or more file systems in a given cluster. These file systems include the data to be shared by the nodes of the various clusters. In one example, the file systems are the General Parallel File Systems (GPFS), offered by International Business Machines Corporation. One or more aspects of GPFS are described in “GPFS: A Parallel File System,” IBM Publication No. SG24-5165-00 (May 07, 1998), which is hereby incorporated herein by reference in its entirety, and in various patents/publications, including, but not limited to, U.S. Pat. No. 6,708,175 entitled “Program Support For Disk Fencing In A Shared Disk Parallel File System Across Storage Area Network,” Curran et al., issued Mar. 16, 2004; U.S. Pat. No. 6,032,216 entitled “Parallel File System With Method Using Tokens For Locking Modes,” Schmuck et al., issued Feb. 29, 2000; U.S. Pat. No. 6,023,706 entitled “Parallel File System And Method For Multiple Node File Access,” Schmuck et al, issued Feb. 8, 2000; U.S. Pat. No. 6,021,508 entitled “Parallel File System And Method For Independent Metadata Loggin,” Schmuck et al., issued Feb. 1, 2000; U.S. Pat. No. 5,999,976 entitled “Parallel File System And Method With Byte Range API Locking,” Schmuck et al., issued Dec. 7, 1999; U.S. Pat. No. 5,987,477 entitled “Parallel File System And Method For Parallel Write Sharing,” Schmuck et al., issued Nov. 16, 1999; U.S. Pat. No. 5,974,424 entitled “Parallel File System And Method With A Metadata Node,” Schmuck et al., issued Oct. 26, 1999; U.S. Pat. No. 5,963,963 entitled “Parallel File System And Buffer Management Arbitration,” Schmuck et al., issued Oct. 5, 1999; U.S. Pat. No. 5,960,446 entitled “Parallel File System And Method With Allocation Map,” Schmuck et al., issued Sep. 28, 1999; U.S. Pat. No. 5,950,199 entitled “Parallel File System And Method For Granting Byte Range Tokens,” Schmuck et al., issued Sep. 7, 1999; U.S. Pat. No. 5,946,686 entitled “Parallel File System And Method With Quota Allocation,” Schmuck et al., issued Aug. 31, 1999; U.S. Pat. No. 5,940,838 entitled “Parallel File System And Method Anticipating Cache Usage Patterns,” Schmuck et al., issued Aug. 17, 1999; U.S. Pat. No. 5,893,086 entitled “Parallel File System And Method With Extensible Hashing,” Schmuck et al., issued Apr. 6, 1999; U.S. Patent Application Publication No. 20030221124 entitled “File Level Security For A Metadata Controller In A Storage Area Network,” Curran et al., published Nov. 27, 2003; U.S. Patent Application Publication No. 20030220974 entitled “Parallel Metadata Service In Storage Area Network Environment,” Curran et al., published Nov. 27, 2003; U.S. Patent Application Publication No. 20030018785 entitled “Distributed Locking Protocol With Asynchronous Token Prefetch And Relinquish,” Eshel et al., published Jan. 23, 2003; U.S. Patent Application Publication No. 20030018782 entitled “Scalable Memory Management Of Token State For Distributed Lock Managers,” Dixon et al., published Jan. 23, 2003; and U.S. Patent Application Publication No. 20020188590 entitled “Program Support For Disk Fencing In A Shared Disk Parallel File System Across Storage Area Network,” Curran et al., published Dec. 12, 2002, each of which is hereby incorporated herein by reference in its entirety.
Although the use of file systems is described herein, in other embodiments, the data to be shared need not be maintained as file systems. Instead, the data may merely be stored on the storage media or stored as a structure other than a file system.
A file system is managed by a file system manager node 110, which is one of the nodes of the cluster. The same file system manager can manage one or more of the file systems of the cluster or each file system may have its own file system manager or any combination thereof. Also, in a further embodiment, more than one file system manager may be selected to manage a particular file system.
An alternate cluster configuration is depicted in
The data flow between the server nodes and the communications nodes is the same as addressing the storage media directly, although the performance and/or syntax may be different. As examples, the data flow of
One cluster may be coupled to one or more other clusters, while still maintaining separate administrative and operational domains for each cluster. For instance, as depicted in
Each of the clusters is maintained separately allowing individual administrative policies to prevail within a particular cluster. This is in contrast to merging the clusters, and thus, the resources of the clusters, creating a single administrative and operational domain. The separate clusters facilitate management and provide greater flexibility.
Additional clusters may also be coupled to one another, as depicted in
Although in each of the clusters described above five nodes are depicted, this is only one example. Each cluster may include one or more nodes and each cluster may have a different number or the same number of nodes as another cluster.
A cluster may be at least one of a data owning cluster and a data using cluster. A data owning cluster is a collection of nodes, which are typically, but not necessarily, co-located with the storage used for at least one file system owned by the cluster. The data owning cluster controls access to the one or more file systems, performs management functions on the file system(s), controls the locking of the objects which comprise the file system(s) and/or is responsible for a number of other central functions. The data owning cluster is a collection of nodes that share data and have a common management scheme. As one example, the data owning cluster is built out of the nodes of a storage area network, which provides a mechanism for connecting multiple nodes to the same storage media and providing management software therefor.
As one example, a file system owned by the data owning cluster is implemented as a SAN file system, such as a General Parallel File System (GPFS), offered by International Business Machines Corporation, Armonk, N.Y. GPFS is described in, for instance, “GPFS: A Parallel File System,” IBM Publication No. SG24-5165-00 (May 7, 1998), which is hereby incorporated herein by reference in its entirety.
Applications can run on the data owning clusters. Further, the user id space of the owning cluster is the user id space that is native to the file system and stored within the file system.
A data using cluster is a set of one or more nodes which desires access to data managed by one or more data owning clusters. The data using cluster runs applications that use data available from one or more owning clusters. The data using cluster has configuration data available to it directly or through external directory services. This data includes, for instance, a list of file systems which might be available to the nodes of the cluster, a list of contact points within the owning cluster to contact for access to the file systems, and a set of credentials which allow access to the data. In particular, the data using cluster is configured with sufficient information to start the file system code and a way of determining the contact point for each file system that might be desired. The contact points may be defined using an external directory service or be included in a list within a local file system of each node. The data using cluster is also configured with security credentials which allow each node to identify itself to the data owning clusters.
A cluster can concurrently be a data owning cluster for a file system and a data using cluster for other file systems. Just as a data using cluster may access data from multiple data owning clusters, a data owning cluster may serve multiple data using clusters. The configuring of clusters is described in, for instance, a co-pending, commonly assigned U.S. patent application entitled “Dynamic Management Of Node Clusters To Enable Data Sharing”, Craft et al., U.S. Ser. No. 10/958,927, filed Oct. 5, 2004, which is hereby incorporated herein by reference in its entirety.
A user of a data using cluster may access data managed by a data owning cluster and stored on storage media directly accessible by both the owning cluster and the using cluster. One embodiment of the logic associated with this processing is described with reference to
Referring to
Returning to INQUIRY 502, if the application requesting access to data on shared storage media is being run in a cluster that is not managing the requested data, referenced herein as a data using cluster, then at least one identifier under which the application is running is mapped to at least one corresponding identifier of the cluster managing that data, referred to herein as the data owning cluster, STEP 506. The manner in which this is accomplished is described in further detail below. The mapped identifier(s) is (are) then recorded as the owner of the data or files created by the application, STEP 508, and is (are) used for permission checking in accessing the data, STEP 510.
The mapping of an identifier is further described with reference to
Products are offered that provide external mapping functions. These products include, for instance, the Enterprise Identity Mapping (EIM) Services offered by International Business Machines Corporation, and the Grid Security Intrastructure (GSI), which is a part of the Globus Toolkit. As an example, EIM comes bundled with certain versions of IBM® operating systems on various platforms, including, but not limited to, AIX 5.2, z/OS V1R4 and os400 release V5R2. Further, it is described in an IBM® white paper entitled “IBM e-Server Enterprise Mapping,” International Business Machines, 2002, available from IBM®, downloadable from http://publib.boulder.ibm.com/infocenter/eserver/vlrl/en_US/index.htm?info/eiminfo/rzalveserverprint.htm, and viewable online at http://publib.boulder.ibm.com/infocenter/eserver/vlrl/en_US/index.htm? info/eiminfo/rzalveservermstl.htm, which is hereby incorporated herein by reference in its entirety. GSI is available as part of the Globus Toolkit offered by Globus (http:// www.globus.org/toolkit/docs/), and is described, for instance, in a paper published in the Proceedings of the 5th ACM Conference on Computer and Communications Security, 1998, San Francisco, Calif., United States, Nov. 02-05, 1998 (also, see, http://portal.acm.org/citation.cfm?id=288090) entitled “A Security Architecture For Computational Grids,” by Ian Foster, Carl Kellelman, Gene Tsudik and Steven Tuecke (Pages 83-92 of the proceedings) (a pre-print version of the paper can be downloaded from http://www-unix.globus.org/ftppub/globus/papers/security.pdf), which is hereby incorporated herein by reference in its entirety.
The external user name is then sent to a node of the data owning cluster, STEP 604. An external mapping function on the node of the data owning cluster is then invoked to retrieve at least one identifier (e.g., user id and/or group id) of the user's account in the data owning cluster, STEP 606. The one or more retrieved identifiers corresponding to the user's account in the data owning cluster are then sent to the data using cluster for use in accessing data, STEP 608. Thus, in accordance with an aspect of the present invention, an identifier that corresponds to an account of one cluster is used by the user having an account in another cluster to access data on the shared storage media.
Advantageously, the mapping between identifiers and external names is accomplished by invoking an external mapping function that can be customized by the administrator. This allows one or more aspects of the invention to be integrated into existing user registration and remote execution infrastructures, such as the global security infrastructure or IBM's Enterprise Identity Mapping Services.
In addition to the above, it is possible to display file ownership or the content of access control lists by performing reverse mapping. One embodiment of the logic associated with reverse mapping is described with reference to
Similar to the mapping process, the reverse mapping is applicable to user identifiers, as well as to group identifiers. As described above, group identifiers may be mapped explicitly. With this technique, there are globally unique, external names, not only for users, but also for groups. The external mapping function maps between a local group identifier value and its external global name. In this case, each group identifier that appears in a processor's credentials is mapped individually in the same way as the processor's user identifier. For efficiency, the external mapping function should accept a list of user ids and group ids, so that a user's credentials can be converted in a single call. The message sent between a data using cluster and a data owning cluster for the purpose of user identifier mapping will then also include a list of user and group identifiers or names.
In addition to the above, group identifier may be implicitly mapped. For instance, if there is no infrastructure that defines global group names, group identifiers can be mapped implicitly as a side effect of the user identifier mapping. A user identifier is mapped by sending a message containing the user's external (or global) name to a node in the file system data owning cluster. For implicit group identifier mapping, the node sends a reply that also includes the group identifiers of all groups that the given user belongs to in the file system data owning cluster. The returned user identifier and group identifier list are then used in the user's credentials that are used for permission checking and file ownership decisions on the node of the data using cluster.
In accordance with a further aspect of the present invention, one or more mapped identifiers 800 (
Moreover, for more efficient mapping of large numbers of identifiers, a prefetching capability is provided to prefetch identifier mappings. One embodiment of the logic associated with prefetching is described with reference to
Several variations to the above prefetching are also possible, including, for example, the following:
As in the case of mappings cached in memory, pre-computed mapping tables may be invalidated or refreshed either periodically or via explicit command, as examples.
In a further aspect of the present invention, incomplete mappings and unknown users are handled. For example, the mapping of the credentials of a user of a data using cluster may fail because that user does not have an account in the file system's data owning cluster. In this case, options are provided to either refuse that user access to the file system or to grant restricted access by mapping the external name of that user to a special user identifier for an unknown user.
As a further example, the reverse mapping (mapping an identifier from the file system data owning cluster to the id space of a data using cluster) may fail because a user or group with an account in the file system data owning cluster, who owns a file or appears in an access control list, may not have an account in all other clusters that have access to that file system. The program running in such a data using cluster will then not be able to display the file ownership or access control list in the same way as the local file system. For this scenario, three options are provided for handling such incomplete reverse mapping:
Each of these options can be augmented by providing customized tools for displaying and changing file ownership and access control lists, which the user can invoke instead of standard system tools (e.g., ls, chown, getalc). The customized tools are able to display external user/group names or user/group names as defined in the file system data owning cluster, regardless of whether those users/groups have local accounts in the cluster where the tool was invoked.
Described in detail above is a capability for providing mapped identifiers to facilitate access to data stored on shared storage media directly accessible by a plurality of independent clusters or other administrative domains. One or more aspects of the present invention enable GRID access to SAN file systems across separately administered domains.
Advantageously, one or more aspects of the present invention enable a user to have uniform access to its data (e.g., files of a file system) with the same permissions, regardless under which account the user is logged in. One or more aspects of the present invention provide the ability to use identifier substitution within the context of a global, shared disk file system dealing with the consistency of file system ownership structures, file system access lists, quotas and other file system structures. Identifier translation is provided to allow disk sharing. Since the node running the application accesses data and metadata directly on disk, mapping and permission checking is performed at the application node, which is a different administrative domain than the one managing the data.
Moreover, advantageously, user identifiers stored on shared disk are the user identifiers of the owners' account in the file system's owning cluster, regardless of where the program was running when the file was created. Similarly, user identifier values stored in access control lists (ACLs) granting file access to other users are user identifiers of these users' accounts in the file system owning cluster. Since permission checking is performed based on a user's user identifier, as an example, in the file system owning cluster, rather than the cluster, where the user's program is running, a user will be able to access files consistently with the same permissions, no matter where the user's program is running.
The capabilities of one or more aspects of the present invention can be implemented in software, firmware, hardware or some combination thereof.
One or more aspects of the present invention can be included in an article of manufacture (e.g., one or more computer program products) having, for instance, computer usable media. The media has therein, for instance, computer readable program code means or logic (e.g., instructions, code, commands, etc.) to provide and facilitate the capabilities of the present invention. The article of manufacture can be included as a part of a computer system or sold separately.
Additionally, at least one program storage device readable by a machine embodying at least one program of instructions executable by the machine to perform the capabilities of the present invention can be provided.
The flow diagrams depicted herein are just examples. There may be many variations to these diagrams or the steps (or operations) described therein without departing from the spirit of the invention. For instance, the steps may be performed in a differing order, or steps may be added, deleted or modified. All of these variations are considered a part of the claimed invention.
Although preferred embodiments have been depicted and described in detail herein, it will be apparent to those skilled in the relevant art that various modifications, additions, substitutions and the like can be made without departing from the spirit of the invention and these are therefore considered to be within the scope of the invention as defined in the following claims.
