[Samba] Group mapping giving incorrect GIDs
eroseme at emonster.rose.hp.com
Wed Nov 9 16:14:27 GMT 2005
a.nielsen at research.uq.edu.au wrote:
>I think I've narrowed down my problem to the fact that the group mapping is
>not giving me the same GID for all 'equivalent' groups, as seen here:
>$ net groupmap list
>DOMAIN\Group1 (S-1-5-21-620321403-24207062-1845911597-172256) -> unixgrp1
>$ getent group unixgrp1
>$ getent group DOMAIN\\Group1
>This means that the GID of unixgrp1 is 203, however the GID of DOMAIN\Group1
>is completely different! Given the group mapping, I was expecting that both
>groups would be returned with a GID of 203, so that according to the Linux
>box both those groups are the same.
>As it stands now, when DOMAIN\User1 connects, it's using a GID of 10001
>which has no access to the filesystem. It should be connecting as GID 203,
>which has the correct filesystem permissions.
>Is what I'm trying to do even possible?
Just so you do not feel abandoned - I have gotten the same results when
trying a similar operation. In my case, I was trying to use a mapped
group on "valid users = @mapped". That does not work at all. I also
could not make it work with ACLs. A co-worked did some additional
testing and could get mapped groups to work on ugo permissions, but only
with "security = user", not "security = ads".
If my co-worker and I can characterize the behavior more accurately,
I'll write up what we find for posterity.
More information about the samba