Winbind : Strange groups behavior, AIX 5.3 with 3.0.26a

Jérôme Oufella jerome.oufella at savoirfairelinux.com
Wed Oct 24 13:43:43 GMT 2007


Hi,
We set up winbind on AIX 5.3.
The link is working fine except with a particular point : windows-based
users are unable to get their group membership info in some cases :

Here's an operation log :
# As a local user, id and id myusername report the same thing.
root at srv1:/# id
uid=0(root) gid=0(system)
groups=2(bin),3(sys),7(security),8(cron),10(audit),11(lp)
root at srv1:/# id root
uid=0(root) gid=0(system)
groups=2(bin),3(sys),7(security),8(cron),10(audit),11(lp)

# Now let's become a winbind user
root at srv1:/# su winuser1

# id just reports the user's native group.
winuser1 at srv1:/#id
uid=10013(winuser1) gid=10002(domain users)

# While id username reports the whole group list.
winuser1 at srv1:/$ id winuser1
uid=10013(winuser1) gid=10002(domain users)
groups=10283(inventaire),10277(systeme),10224(imax),10186(gpix),10162(txtel),10132(docfis),10119(txtele2),10118(constatsinf),10819(gsamba),10106(csystem),10101(abonnb),10094(gpic2),10090(imax2),10084(internal),10083(projipact),10077(gintbd),10063(gigpar),10050(inventaire2),10048(reg),10047(dgppbe),10046(cdgpar),10039(fusrsbd),10037(bdd2),1008(telecommunication),10016(infoju),10006(bd3),10001(BUILTIN\users)

# lsuser seems to miss the groups= attribute, while listing a
windows-based user :
root at srv1:/#lsuser root
root id=0 pgrp=system groups=system,bin,sys,security,cron,audit,lp
home=/ shell=/usr/bin/ksh
root at srv1:/etc/samba #lsuser winuser1
winuser1 id=10013 pgrp=domain users home=/home/PROD/winuser1
shell=/bin/sh gecos=winuser1 registry=WINBIND roles= id=10013 pgrp=dom
in users home=/home/PROD/winuser1 shell=/bin/sh pgid=10002
gecos=winuser1 shell=/bin/sh pgrp=domain users SID=S-1-5-something-91354

One of the results is we cannot use group-based permissions on the
filesystem (other than the native user's group).

Has anyone a clue about what's happening ?
Any help will be greatly appreciated.
Thanks in advance.

Jerome Oufella



More information about the samba-technical mailing list