selftest: re-enable nss_winbind via nss_wrapper in the test-envs.

[Michael Adam]

On 2015-02-20 at 10:02 +1300, Andrew Bartlett wrote:
> On Wed, 2015-02-18 at 23:37 +0100, Michael Adam wrote:
> >
> > So if we were to test just one of the scenarios, I'd make a
> > strong vote for the nss_winbind one.
> 
> We should test both.  We need to understand why they are different, and
> we should not change the tests until we understand the tests.

Since the procedure now yields slightly different results,
I don't see how to test both without changing the test.

> The difference may well be due to the different smb.conf files in use,
> rather than anything more dramatic, when :local was added.  Can you
> check?

There is no difference in smb.conf: This test was only ever run
against the plugin_s4_dc:local env (56fd072fd).
The only difference is the use of nss_winbindd via nsswrapper
through the setting of a few env vars (14cbc791ee703).

> > I will probably not have the resources to deeply investigate in
> > the very near future. As I said I hoped that someone with more
> > stakes in the AD/DC and the test itself would assist... :-)
> 
> I wish I also had the time and resources.  I'm actually in the happy
> position of being up to my eyeballs in upstream AD DC development!  If
> you or anyone else wants to help, do let me know! :-)

Hey, this _is_ AD DC development! ;)

> > I think it is more important to test with nss_winbindd than
> > without.
> 
> An interesting quirk here is that while it may be reset at runtime, the
> most important time for this routine to be called on sysvol ACLs is
> during provision, when nss_winbind isn't likely installed, and certainly
> isn't operable. 

Ok, that is an important piece of info, thanks!

Michael
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 198 bytes
Desc: not available
URL: <http://lists.samba.org/pipermail/samba-technical/attachments/20150219/706fc1f4/attachment.pgp>