Lustre 1.6 Operations Manual

11.2.2.7 Authenticating Normal Users
On client nodes, non-root users must use kinit to access Lustre (just like other
Kerberized applications). kinit is used to obtain and cache Kerberos ticket-granting
tickets. Two requirements to authenticating users:
■
■
Before kinit is run, the user must be registered as a principal with the Kerberos
server (the Key Distribution Center or KDC). In KDC, the username is noted as
username@REALM.
The client and MDT nodes should have the same user database.
To destroy the established security contexts before logging out, run lfs flushctx:
# lfs flushctx [-k]
Here -k also means destroy the on-disk Kerberos credential cache. It is equivalent to
kdestroy. Otherwise, it only destroys established contexts in the Lustre kernel.
11-16 Lustre 1.6 Operations Manual • September 2008