Question at the bottom.

Background

My server setup is shown below, where I have an LDAP host which have a group called group1 that contains user1, user2.

The NAS is FreeBSD 8.3 with ZFS with one zpool and a volume.

serv1 gets /etc/passwd and /etc/group from the LDAP host.

serv2 gets /etc/passwd from the LDAP host and /etc/group is local and read only. Hence it doesn't not know anything about which groups the LDAP have.

Both servers connect to the NAS with NFS 3.

What I would like to achieve

I would like to be able to create/modify groups in LDAP to allow/deny users read/write access to NFS 3 shared directories on the NAS.

Example: group1 should have read/write to /zfs/vol1/project1 and nothing more.

Question

The problem is that serv2 doesn't have a LDAP controlled /etc/group file.

So the only way I can think of to solve this is to use ZFS permissions with inheritance, but I can't figure out how and what the permissions I shall set.

Does someone know if this can be solved at all, and if so, any suggestions?

              +----------------------+
              |         LDAP         |
              | group1: user1, user2 |
              +----------------------+
                |         |        |
                |ldap     |ldap    |ldap
                |         v        |
                |   +-----------+  |
                |   |    NAS    |  |
                |   | /zfs/vol1 |  |
                |   +-----------+  |
                |     ^       ^    |
                |     |nfs3   |nfs3|
                v     |       |    v
+-----------------------+   +----------------------------+
|         serv1         |   |         serv2              |
| /etc/passwd from LDAP |   | /etc/passwd from LDAP      |
| /etc/group from LDAP  |   | /etc/group local/read only |
+-----------------------+   +----------------------------+