[Samba] Samba3.0 domain GID/UID/SID transformations

[Andrew Bartlett]

On Tue, 2003-06-17 at 09:45, Nick Stephens wrote:
> Greetings!
> 
> I have grabbed the latest samba3 cvs source, and successfully compiled it, 
> got it talking to my NT server, joined the domain, etc.. life is good.  
> But, now I have a question kinda related to functionality, i believe...
> 
> A quick synopsis of my goal is as follows:
> 
> i currently have a sendmail linux box that also does my pop3 for users.. 
> given that they only use pop, mail passwords arent changed as religiously 
> as the NT domain passwords.. my goal was to synch the unix and nt 
> passwords, thus eliminating the need to change them via the cmd line, and 
> keeping it all ctrl-alt-del easy for them.
> 
> I seem to have pop working ok with a freshly written PAM module, my logs 
> all seem to be saying that everything is fine, but heres my question.. 
> 
> For me to get the email for user 'domainname+user', the 
> /var/spool/mail/user file has to have the same UID/GID/SID on NT and 
> unix.. is there a quick way to convert this?  I'm assuming that I will 
> have to let the NT PDC be the master as far as what the UID/SID 
> transformation is.. but the only tool i have seen so far to convert it 
> requires me to do the following:
> 
> wbinfo -n user |xargs wbinfo -S
> 
> while this isn't TOO terribly tedious on my small network, I have a 
> feeling that larger companies will have a problem with that, and that 
> perhaps I am missing some tool that would be great convenience to me.. 
> 
> am i offbase here, or do i just need to do that wbinfo on each user, and 
> hand edit my /etc/passwd to change the uid/gid's, and then re-chown 
> everyones homedir and mailspool?  i kinda hope not :)

There are a few solutions to your problem - one that many sites will be
coming across as they attempt migrations.

Firstly, if you just want to deal with the passwords, and don't mind
keeping the users database as it was, you just use pam_winbind, but not
nss_winbind.  If you then set 'winbind use default domain = yes', and
the NT usernames are the same as your unix ones, then it should all
'just work'.  ie, only the passwords are redirected.

If you want to go future, and ditch the unix username database, you can
alter the 'idmap' that Samba controls (mapping the NT sids to uids) so
that they match the existing unix accounts to the NT accounts.  I think
'net idmap' should let you do this, but it's only just in CVS, and I've
not played with it.  

Andrew Bartlett

-- 
Andrew Bartlett                                 abartlet at pcug.org.au
Manager, Authentication Subsystems, Samba Team  abartlet at samba.org
Student Network Administrator, Hawker College   abartlet at hawkerc.net
http://samba.org     http://build.samba.org     http://hawkerc.net
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
Url : http://lists.samba.org/archive/samba/attachments/20030617/1f924f4b/attachment.bin