Secondary Groups with ldapsam WAS: Re: [Samba] net groupmap / domain admins problem

Hansjörg Maurer hansjoerg.maurer at itsd.de
Fri Jan 9 11:19:04 GMT 2004


Hi

if have done furthes testing on this issue.

Unix name resoltion seems to work (all groups are in ldap)
[sporer at server sporer]$ getent group | grep management
managementgroup:x:1001:management,root,haehnle,sporer,sporers
[sporer at server sporer]$ getent group | grep sensodrivgroup
[sporer at server sporer]$ getent group | grep sensodrive
sensodrivegroup:x:1000:sporer,haehnle,sporers,unterholzner,geist,bertleff,hauschild,sensodrive,root
[sporer at server sporer]$ id -a management
uid=1008(management) gid=1001(managementgroup) Gruppen=1001(managementgroup)
[sporer at server sporer]$ id -a sporer
uid=1000(sporer) gid=1000(sensodrivegroup) 
Gruppen=1000(sensodrivegroup),1001(managementgroup),1002(test1)

If I add
   valid users = +managementgroup,+sensodrivegroup
to a share
user management and user sporer can connect (primary groups are 
management and sporer)
if I remove +sensodrivegroup
user sporer can't connect and vice versa.

A level 10 debug shows in the case sporer connects  (fails)

 sys_getgrouplist: user [sporer]
[2004/01/09 12:05:18, 10] lib/system_smbd.c:sys_getgrouplist(122)
  sys_getgrouplist(): disabled winbindd for group lookup [user == sporer]
[2004/01/09 12:05:18, 5] auth/auth_util.c:debug_unix_user_token(505)
  UNIX token of user 1000
  Primary group is 1000 and contains 1 supplementary groups
  Group[  0]: 1000
[2004/01/09 12:05:18, 3] smbd/sec_ctx.c:push_sec_ctx(256)
  push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1
[2004/01/09 12:05:18, 3] smbd/uid.c:push_conn_ctx(287)
  push_conn_ctx(0) : conn_ctx_stack_ndx = 0
[2004/01/09 12:05:18, 3] smbd/sec_ctx.c:set_sec_ctx(288)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
[2004/01/09 12:05:18, 5] auth/auth_util.c:debug_nt_user_token(486)
  NT user token: (NULL)
[2004/01/09 12:05:18, 5] auth/auth_util.c:debug_unix_user_token(505)
  UNIX token of user 0
  Primary group is 0 and contains 0 supplementary groups
[2004/01/09 12:05:18, 2] passdb/pdb_ldap.c:ldapsam_search_one_group(1636)
  ldapsam_search_one_group: searching 
for:[(&(objectClass=sambaGroupMapping)(gidNumber=1000))]
[2004/01/09 12:05:18, 2] passdb/pdb_ldap.c:init_group_from_ldap(1680)
  init_group_from_ldap: Entry found for group: 1000
[2004/01/09 12:05:18, 3] smbd/sec_ctx.c:pop_sec_ctx(386)
  pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0
[2004/01/09 12:05:18, 10] passdb/passdb.c:local_gid_to_sid(1228)
  local_gid_to_sid:  gid (1000) -> SID 
S-1-5-21-3723159834-3326906825-3408399175-3001.
[2004/01/09 12:05:18, 10] passdb/lookup_sid.c:gid_to_sid(374)
  gid_to_sid: local 1000 -> S-1-5-21-3723159834-3326906825-3408399175-3001
[2004/01/09 12:05:18, 10] auth/auth_util.c:debug_nt_user_token(491)
  NT user token of user S-1-5-21-3723159834-3326906825-3408399175-3000
  contains 5 SIDs
  SID[  0]: S-1-5-21-3723159834-3326906825-3408399175-3000
  SID[  1]: S-1-5-21-3723159834-3326906825-3408399175-3001
  SID[  2]: S-1-1-0
  SID[  3]: S-1-5-2
...


In the case management connects (successfully)

2004/01/09 12:08:36, 10] lib/system_smbd.c:sys_getgrouplist(113)
  sys_getgrouplist: user [management]
[2004/01/09 12:08:36, 10] lib/system_smbd.c:sys_getgrouplist(122)
  sys_getgrouplist(): disabled winbindd for group lookup [user == 
management]
[2004/01/09 12:08:36, 5] auth/auth_util.c:debug_unix_user_token(505)
  UNIX token of user 1008
  Primary group is 1001 and contains 1 supplementary groups
  Group[  0]: 1001
[2004/01/09 12:08:36, 3] smbd/sec_ctx.c:push_sec_ctx(256)
  push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1
[2004/01/09 12:08:36, 3] smbd/uid.c:push_conn_ctx(287)
  push_conn_ctx(0) : conn_ctx_stack_ndx = 0
[2004/01/09 12:08:36, 3] smbd/sec_ctx.c:set_sec_ctx(288)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
[2004/01/09 12:08:36, 5] auth/auth_util.c:debug_nt_user_token(486)
  NT user token: (NULL)
[2004/01/09 12:08:36, 5] auth/auth_util.c:debug_unix_user_token(505)
  UNIX token of user 0
  Primary group is 0 and contains 0 supplementary groups
[2004/01/09 12:08:36, 2] passdb/pdb_ldap.c:ldapsam_search_one_group(1636)
  ldapsam_search_one_group: searching 
for:[(&(objectClass=sambaGroupMapping)(gidNumber=1001))]
[2004/01/09 12:08:36, 2] passdb/pdb_ldap.c:init_group_from_ldap(1680)
  init_group_from_ldap: Entry found for group: 1001
[2004/01/09 12:08:36, 3] smbd/sec_ctx.c:pop_sec_ctx(386)
  pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0
[2004/01/09 12:08:36, 10] passdb/passdb.c:local_gid_to_sid(1228)
  local_gid_to_sid:  gid (1001) -> SID 
S-1-5-21-3723159834-3326906825-3408399175-3003.
[2004/01/09 12:08:36, 10] passdb/lookup_sid.c:gid_to_sid(374)
  gid_to_sid: local 1001 -> S-1-5-21-3723159834-3326906825-3408399175-3003
[2004/01/09 12:08:36, 10] auth/auth_util.c:debug_nt_user_token(491)
  NT user token of user S-1-5-21-3723159834-3326906825-3408399175-3016
  contains 5 SIDs
  SID[  0]: S-1-5-21-3723159834-3326906825-3408399175-3016
  SID[  1]: S-1-5-21-3723159834-3326906825-3408399175-3003
  SID[  2]: S-1-1-0
...

 user_in_list: checking user management in list
[2004/01/09 12:08:36, 10] lib/username.c:user_in_list(525)
  user_in_list: checking user |management| against |+managementgroup|
[2004/01/09 12:08:36, 5] lib/username.c:Get_Pwnam(288)
  Finding user management
[2004/01/09 12:08:36, 5] lib/username.c:Get_Pwnam_internals(223)
  Trying _Get_Pwnam(), username as lowercase is management
[2004/01/09 12:08:36, 5] lib/username.c:Get_Pwnam_internals(251)
  Get_Pwnam_internals did find user [management]!
[2004/01/09 12:08:36, 10] lib/username.c:user_in_list(521)
  user_in_list: checking user management in list
[2004/01/09 12:08:36, 10] lib/username.c:user_in_list(525)
  user_in_list: checking user |management| against |+Domain Admins|
[2004/01/09 12:08:36, 3] smbd/service.c:make_connection_snum(543)


-the parsing of +managementgroup works
-both groups are valid groups
-the secondary groupmembership seems not to be recognized by samba...


I am using RH 9 with
glibc-2.3.2-27.9.7
nss_ldap-207-3
openldap-2.1.22

The problem is the same with RH7.3 and openldap 2.0

I read something about a broken getgrouplist with this glibc
Because RH fixed that bug,
I tried to compile with
 #ifdef HAVE_GETGROUPLIST 1
but with the same result..

Does anybody have some additional ideas?

Greetings

Hansjörg


[root at server root]# net groupmap list
Domain Admins (S-1-5-21-3723159834-3326906825-3408399175-512) -> Domain 
Admins
Domain Users (S-1-5-21-3723159834-3326906825-3408399175-513) -> Domain Users
Domain Guests (S-1-5-21-3723159834-3326906825-3408399175-514) -> Domain 
Guests
Administrators (S-1-5-21-3723159834-3326906825-3408399175-544) -> 
Administrators
Users (S-1-5-21-3723159834-3326906825-3408399175-545) -> Users
Guests (S-1-5-21-3723159834-3326906825-3408399175-546) -> Guests
Power Users (S-1-5-21-3723159834-3326906825-3408399175-547) -> Power Users
Account Operators (S-1-5-21-3723159834-3326906825-3408399175-548) -> 
Account Operators
Server Operators (S-1-5-21-3723159834-3326906825-3408399175-549) -> 
Server Operators
Print Operators (S-1-5-21-3723159834-3326906825-3408399175-550) -> Print 
Operators
Backup Operators (S-1-5-21-3723159834-3326906825-3408399175-551) -> 
Backup Operators
Replicators (S-1-5-21-3723159834-3326906825-3408399175-552) -> Replicators
Domain Computers (S-1-5-21-3723159834-3326906825-3408399175-553) -> 
Domain Computers
sensodrivegroup (S-1-5-21-3723159834-3326906825-3408399175-3001) -> 
sensodrivegroup
Managementgroup (S-1-5-21-3723159834-3326906825-3408399175-3003) -> 
managementgroup
test1 (S-1-5-21-3723159834-3326906825-3408399175-3005) -> test1
[root at server root]# net getlocalsid
SID for domain LINA is: S-1-5-21-3723159834-3326906825-3408399175




John H Terpstra wrote:

>Hansjoerg,
>
>Instead of:
>	valid users = @Groupe
>
>Please try:
>	valid users = +Groupe
>
>Thanks.
>
>- John T.
>
>
>On Thu, 8 Jan 2004, Hansjoerg Maurer wrote:
>
>  
>
>





More information about the samba mailing list