FW: [Samba] winbind upgrade - idmap corrupt ?

[Jeremy Allison]

On Tue, Apr 02, 2002 at 01:39:03PM +0100, Noel Kelly wrote:
> Just as a follow up to this - it looks like the winbind_idmap.tdb *was*
> corrupted by upgrading to the latest CVS... 
> 
> -----Original Message-----
> From: Noel Kelly 
> Sent: 30 March 2002 08:56
> To: 'samba at lists.samba.org'
> Subject: [Samba] winbind upgrade - idmap corrupt ?
> 
> 
> I have just upgraded one of our machines to the CVS from two days ago and
> had a problem with the winbindd_idmap not being accessible.
> 
> We have two main Samba servers (identical kernel/hardware/domain etc) and
> one I have been keeping up to date with the CVS whilst the other has a build
> from Feb 6th.  I decided this weekend I should bring the second one up to
> date as the winbind now in CVS seems very stable, albeit with a continuing
> small memory leak.  I transferred the source from one machine to the other
> and after reinstalling read (to my horror) in the logs:
> 
> [2002/03/30 08:05:38, 0] nsswitch/winbindd_idmap.c:convert_fn(263)
>   winbindd: convert_fn : conversion failed - idmap corrupt ?
> 
> I had a backup from the day before (everyone should have a cron job to gzip
> this file and store it away somewhere safe...) but it seems that the idmap
> was not actually corrupt (phew) but there is something in the new
> libnss_winbind.so library which does not like the 'older' idmap file ?
> 
> I tried deleting the idmap cache file in case that was keeping something
> nasty but to no avail.
> 
> What I find odd about this was that the one I keep up to date with the CVS
> did not have such a problem ?  Is there some leap between winbindd versions
> which I have inadvertently missed with my Feb 6th machine ?
> 
> For the moment I am back on the Feb 6th winbindd version.
> 
> Cheers,
> Noel
> 
> 
> [2002/03/30 08:05:36, 2] lib/interface.c:add_interface(81)
>   added interface ip=192.168.5.5 bcast=192.168.5.255 nmask=255.255.255.0
> [2002/03/30 08:05:36, 2] lib/interface.c:add_interface(81)
>   added interface ip=192.168.5.5 bcast=192.168.5.255 nmask=255.255.255.0
> [2002/03/30 08:05:36, 2] libsmb/namequery.c:name_query(420)
>   Got a positive name query response from 192.168.5.4 ( 192.168.5.4 )
> [2002/03/30 08:05:36, 2] libsmb/namequery.c:name_query(420)
>   Got a positive name query response from 192.168.5.4 ( 192.168.5.3 )
> [2002/03/30 08:05:37, 1] nsswitch/winbindd_util.c:init_domain_list(150)
>   Added domain UK (S-1-5-21-2025429265-764733703-725345543)
> [2002/03/30 08:05:37, 1] nsswitch/winbindd_util.c:init_domain_list(152)
>   getting trusted domain list
> [2002/03/30 08:05:37, 1] nsswitch/winbindd_util.c:init_domain_list(166)
>   Added domain NTBROMLEY (S-1-5-21-1016337243-1234517223-313593124)
> [2002/03/30 08:05:38, 0] nsswitch/winbindd_idmap.c:convert_fn(262)
>   winbindd: convert_fn : Unable to find domain NTMIXED
> [2002/03/30 08:05:38, 0] nsswitch/winbindd_idmap.c:convert_fn(263)
>   winbindd: convert_fn : conversion failed - idmap corrupt ?

Ok - this "Unable to find domain NTMIXED" message is the key
to the problem.

The conversion function goes through the old tdb and gets
records that must start with "DOMAIN_NAME/".

In this case it got a record starting with "NTMIXED/" and
looks for it in the domain list created by the function :

init_domain_list(), which is called from the winbindd main
function, just before the winbindd_idmap_init() function
which will do the convert.

Was NTMIXED a trusted domain that is now not trusted any
more ?

Can you use the tdbdump utility to print out all the
records in the idmap you're trying to update, or possibly
send me the idmap.tdb so I can investigate ?

Thanks,

	Jeremy.