samba-tool posix user/group improvements
repenny241155 at gmail.com
Wed Oct 9 14:23:00 MDT 2013
On 09/10/13 20:29, Andrew Bartlett wrote:
> On Wed, 2013-10-09 at 11:35 +0100, Rowland Penny wrote:
>> HI, I will say this once again, anything Samba does to the AD database
>> should match what Windows does.
>> Windows does NOT add either the 'posixAccount' or 'posixGroup'
>> attributes so Stephanes patch should not add this line:
>> + ldbmessage2["objectClass"] =
>> ldb.MessageElement('posixGroup', ldb.FLAG_MOD_ADD, 'objectClass')
>> it should be removing this line:
>> ldbmessage2["objectClass"] =
>> ldb.MessageElement('posixAccount', ldb.FLAG_MOD_ADD, 'objectClass')
> This is a distinct issue from the rest of the patch, because this patch
> follows the pattern already established. Adding these values improves
> compatibility with LDAP clients, because many do (correctly) filter on
> this objectclass.
Just because it an established way of doing things, does not make it
right. As for ldap clients filtering on the posix objectclasses, would
they do this against a windows server and more to the point would it work ?
> The reason this is set on posixAccount is that, as I read the schema,
> otherwise you simply can't set for example gecos or loginShell on the
> account. Have you tested your proposed modification and shown that
> everything sill works?
Dont know about the gecos attribute, but here is a user created through
ADUC, using msSFU30MaxUidNumber:
# Test User, Users, example.com
dn: CN=Test User,CN=Users,DC=example,DC=com
cn: Test User
displayName: Test User
name: Test User
userPrincipalName: testuser1 at example.com
distinguishedName: CN=Test User,CN=Users,DC=example,DC=com
Oh look, the loginShell attribute is there, but there is definitely no
> Samba certainly shouldn't require the posixAccount or posixGroup
> attributes to get uid and gid values, and we fixed that up in the
> idmap_ldb:use rfc2307 code a while back, but adding these seems
> beneficial for a number of use cases.
The posix objectClasses do not need to be added at all, try looking at
the 'user' objectClass, it has an auxiliaryClass!
> Andrew Bartlett
More information about the samba-technical