unable to grant print operator privileges + workaround

[David Mansfield]

Hi All,

I was trying to follow the wiki 
https://wiki.samba.org/index.php/Samba_as_a_print_server#Granting_print_operator_privileges 
and the command there didn't (doesn't?) work.  My system is set up with 
security = ads, but neither -Uadministrator nor -U'DOMAIN\administrator' 
worked. (NT_STATUS_LOGON_FAILURE).

The workaround which I eventually found, and which I suggest be 
documented in said wiki page, was to set a local password for "root" 
user with smbpasswd -a root, then temporarily switch to "security = 
user", restart samba,  grant the privs., then switch back to "security = 
ads".

I'm not sure why the password is not accepted.  When I use my own creds. 
(instead of -Uadministrator, I use -Ume) it accepts the credentials but 
the error message changes to NT_STATUS_ACCESS_DENIED.

At least the archives will have this solution and hopefully it'll be 
easier to find for the next guy/gal.

Additional information:

System is centos 7, samba installed from distro packages (4.1.1-37).  
Kerberos is set up and working (smbclient -k works). UNIX authentication 
and nss is via sssd which is set up and working.

My DC are all samba 4.1.12 compiled from source.



-- 
Thanks,
David Mansfield
Cobite, INC.