Request for enhancement

In order for a Linux client to mount an NFS share with Kerberos security from a Windows server, Windows needs to be able to resolve a SID for IPA\host/CLIENT (among possible other things).

Issue

Mount currently fails with the following error on the Windows server:

Server for NFS was unable to obtain security information for the GSS user account IPA\host\CLIENT

Steps to Reproduce

1. IPA and AD domain in two-way trust
2. Create a kerberos NFS 4.1 share on windows server
3. Attempt to mount on Linux: mount -t nfs -v -o sec=krb5,vers=4.1 SERVER:share /mnt

Actual behavior

mount.nfs: mount(2): Permission denied
mount.nfs: access denied by server while mounting 

Expected behavior

Successful mount

Version/Release/Distribution

$ rpm -q freeipa-server freeipa-client ipa-server ipa-client 389-ds-base pki-ca krb5-server
On client:

ipa-client-4.9.13-18.module_el8.10.0+4019+7dddc14b.x86_64

On server:

ipa-server-4.12.2-14.el9_6.1.x86_64
ipa-client-4.12.2-14.el9_6.1.x86_64
389-ds-base-2.6.1-10.el9_6.x86_64
package pki-ca is not installed
krb5-server-1.21.1-8.el9_6.x86_64

Additional info:

Discussion:
https://lists.fedorahosted.org/archives/list/gss-proxy@lists.fedorahosted.org/thread/2UFXKX4DAMIYCSWLIHOUX3GVPTN5LWUL/
https://lists.fedorahosted.org/archives/list/gss-proxy@lists.fedorahosted.org/thread/7SICREL3ML5VBKMHQLLC3X5Q3YEISCHI/