documents > User's Manual > Multi-tenancy feature

Authentication configuration

English | Japanese

This document describes the multi-tenancy feature of Gfarm.

The multi-tenancy feature is a function that virtually divides a single Gfarm file system into multiple tenants and provides them to users.

When using multi-tenant functionality, In the Gfarm authentication process, a user name user1+tenantA is treated as a user1 who belongs to tenantA. In other words, a “+” followed by a tenant name is treated as a user belonging to that tenant. After the authentication is completed, the file system access by this user will be handled as if /.tenants/tenantA were the root directory.

Also, from the perspective of a user in the tenant, his or her user name will appear as if it were user1.

Similarly, group group1 which belongs to tenantA has the group name group1+tenantA internally.

Example:

$ gfwhomai
user1
$ gfls -ld /tmp
drwxrwxrwt 2 user1     group1            0 Mar 22 20:41 /tmp

Creating a tenant

To create tenantA and register user1 with administrative privileges in tenantA, do the following as a user with gfarmadm privileges in the default tenant (see below).

$ gfuser -c user1+tenantA 'user1 in tenantA' /home/user1 ""
$ gfgroup -c gfarmadm+tenantA user1+tenantA
$ gfgroup -c gfarmroot+tenantA
$ gfsudo gfmkdir -p /.tenants/tenantA
$ gfsudo gfchmod 000 /.tenants
$ gfsudo gfchmod 755 /.tenants
$ gfsudo gfchown user1+tenantA:gfarmadm+tenantA /.tenants/tenantA

default tenant

A tenant that exists from the beginning and is accessed with a user name that is not appended with “+tenant name” is called the default tenant.

Users with the gfarmadm group privileges in the default tenant can access to all users and groups in all tenants. Users with the gfarmroot group privilege in the default tenant can access to the all filesystems in all tenants.

Gfarm File System <gfarmfs at gmail.com>