[Samba] Samba winbind secondary group problem
asim_is at comcast.net
asim_is at comcast.net
Wed Jan 21 01:40:15 GMT 2004
I am having some serious problems getting winbind to recognize secondary group memberships. I have a samba server version samba-3.0.0-14.3E running on RHES v.3.
This is running on a 2x Xeon 2.4 Ghz IBM Server with 2G Ram. nscd is not running.
See below for smb.conf.
cat /proc/version: Linux version 2.4.21-9.ELsmp (bhcompile at stripples.devel.redhat.com) (gcc version 3.2.3 20030502 (Red Hat Linux 3.2.3-26)) #1 SMP Thu Jan 8 17:08:56 EST 2004
I have joined the domain with: net rpc join -U administrator -r PDC
I successfully joined the domain. passdb backend = smbpasswd. wbinfo -u shows all the domain users and wbinfo -g shows all the domain groups. ls -l shows the correct domain user/group ownerships. Users can access shares owned by them or their PRIMARY domain group. But when they try to access a share owned by a secondary group that they belong to, it is access denied. The only way I can get a secondary group to resolve is by putting a local unix group in /etc/group and giving it the same GID as the corresponding domain group, then adding the users to the local unix group.
I have a RedHat 9 box with the same configuration that works the way it's supposed to - ie - honoring secondary group memberships from the domain(of course it is samba version samba-2.2.7a-8.9.0).
This is a very critical situation for us. Any help/suggestions would be greatly appreciated.
Below is a snip from the samba log file(shows 3 supplementary groups even though this user belongs to about 20 groups).
[2004/01/20 19:17:44, 5] auth/auth_util.c:debug_unix_user_token(505)
UNIX token of user 10504
Primary group is 10013 and contains 3 supplementary groups
Group[ 0]: 10013
Group[ 1]: 10013
Group[ 2]: 10029
passdb backend = smbpasswd
winbind separator = +
winbind use default domain = yes
template shell = /bin/false
template homedir = /netarray/shares/home/%U
idmap uid = 10000-20000
idmap gid = 10000-20000
#end winbind configuration----->
security = domain
password server = PDC BDC
password level = 8
username level = 8
available = yes
browseable = yes
path = /netarray/shares/Shared
public = no
writable = yes
valid users = @"Domain Users" @"Domain Admins" @"Global ITS" @d_users @d_admins @g_its
invalid users = internet1 internet2 hrtest
More information about the samba