[Samba] Winbind question

[Ryan Ashley]

I forgot to tell you, if you are pulling from the TDB range, your ID 
numbers will NOT be the same across member servers. That is what I have 
been working on for a month now. I have two member servers and they keep 
pulling from the TDB range, causing a user to have an ID of 70001 on one 
member server but 70004 on the other. Both servers claim they cannot 
probe the idmap ad module.

On 08/11/2014 10:21 AM, Bruno MACADRÉ wrote:
> Hi,
>
> I successfully set up an AD DC, and now, I want to join a file server 
> as member in this domain.
>
> I followed this tutorial : 
> https://wiki.samba.org/index.php/Setup_a_Samba_AD_Member_Server
>
> All works fine, my server join my AD without problem, samba starts 
> fine and winbind too. But when I look at my domain users, the uid/gid 
> returned by winbind are in the TDB range instead of the AD range.....
>
> This is my smb.conf :
> [global]
>
>    netbios name = filzen
>    workgroup = SAMDOM
>    security = ADS
>    realm = SAMDOM.FR
>    encrypt passwords = yes
>
>    log level = 10
>
>    template homedir = /home/%U
>    template shell = /bin/bash
>
>    winbind use default domain = yes
>    winbind enum users  = yes
>    winbind enum groups = yes
>
>    idmap config SAMDOM:backend = ad
>    idmap config SAMDOM:range = 20001-70000
>    idmap config SAMDOM:default = yes
>    idmap config *:backend = tdb
>    idmap config *:range = 70001-80000
>
> If I type :
> # wbinfo -i administrator
>
> I get :
> administrator:*:70001:70001::/home/administrator:/bin/bash
>
> If I create a user (foo) and trying to obtain his informations :
> # wbinfo -i foo
>
> I get:
> foo:*:70002:70001::/home/foo:/bin/bash
>
> Why winbind doen't use AD range instead of TBD range ? And even if I 
> must use TDB range is there a certainty that this uid/gid are the same 
> over all members ?
>
> Another clue : If I use SAMDOM:backend = rid the users receive a 
> uid/gid in SAMDOM range and not in TDB range (maybe a bug in ad 
> backend ?)
>
> Thanks for any answers
> Regards,
> Bruno.
>