[Samba] Using LDAP and Unix Group Group Mappings

[Randall Svancara]

On Wed, 2007-07-18 at 11:48 -0400, Adam Tauno Williams wrote:
> > I could not find anything in the discussion groups or documentation
> > about using LDAP and Unix group mappings.  
> > The documentation states that in order to map unix groups to samba
> > groups, you need to use the net group add command.  However, I have an
> > ldap backend and all my groups, that I care about are in LDAP.
> 
> It makes no difference;  groups from LDAP presented via NSS are "unix
> groups" 
> 
> > So I have a group called mainwdev. 
> > dn: cn=test,ou=Group,dc=somewhere,dc=com
> > objectClass: posixGroup
> > objectClass: sambaGroupMapping
> > sambaSID: S-1-5-21-582185903-2148186938-2210701745-801
> > sambaGroupType: 2
> > objectClass: top
> > cn: test
> > gidNumber: 801
> > memberUid: user1
> > memberUid: user2
> > memberUid: user3
> > memberUid: user4
> > memberUid: user5
> > memberUid: user6
> > Now, if I run "net groupmap list", I can see the group mapping as
> > follows.
> > test (S-1-5-21-582185903-2148186938-2210701745-801) -> test
> > But when I attempt to log onto a share that only allows anyone that
> > belongs to the group test (say user1), i get permission denied errors.
> 
> Are you running nscd?  Did you restart/stop it and do your test?  Always
> test with nscd disabled.  Does "id user1" show him/her in group "test"?

I have had these groups configured for a long time.  So they should be
cached by nscd already.  Never the less, I ran getent with the following
output.

#getent group test
 test::801:user1,user2,user3,user4,user5,user6

user1 clearly is being recognized by ldap, otherwise it would not show
up in getent.  

> 
> > Do I still have to run "net group map" command to establish a
> > relationship between unix and samba groups?
> 
> Looks like you already did.

Actually, I did not run the net group add command.  

In SID, you will notice that the group id (GID) 801 appended to the end
of the SID.  Is Samba smart enough to automatically recognize the
relationship between the Unix groups and Samba groups via ldap.

Here is the stanza from the smb.conf I am trying to access:

[Data]
  comment               = "Data files"
  path                  = /path/somewhere
  browseable            = yes
  read only             = no
  guest ok              = no
  force create mode     = 0660
  force directory mode  = 0770
  force group           = test 
  valid users           = @test

Will this even work?




> 
> -- 
> Adam Tauno Williams, Network & Systems Administrator
> Consultant - http://www.whitemiceconsulting.com
> Developer - http://www.opengroupware.org
>