[Samba] net rpc group addmem returns NT_STATUS_ACCESS_DENIED

[Duncan Brannen]

Hi All,
          I'm trying to add a user to a group using

/usr/local/samba/bin/net rpc group addmem room11 dunk -Uroot%password

The user is added to the group as far as I can tell but the command 
returns NT_STATUS_ACCESS_DENIED

This is on Solaris 10 (Sparc) and Samba 3.2.1, OS and Samba are both 
configured to lookup users and groups in LDAP.

/usr/local/samba/bin/net rpc group members room11 -Uroot%password
CROOMTEST\dunk

Trying to remove the user from the group returns 
NT_STATUS_MEMBER_NOT_IN_GROUP and the user
is not removed from the group in LDAP (running smbldap-groupmod manually 
removes the user from LDAP)

In smb.conf, I have
add user to group script = /usr/local/sbin/smbldap-groupmod -m "%u" "%g"
delete user from group script = /usr/local/sbin/smbldap-groupmod -x "%u" 
"%g"

With log level set to 10 I see the following for the add that may or may 
not be relevant.

Should the access check granted and required values be equal?

[2008/08/25 12:59:48,  4] rpc_server/srv_pipe.c:api_rpcTNP(2297)
  api_rpcTNP: samr op 0x16 - api_rpcTNP: rpc command: SAMR_ADDGROUPMEMBER
[2008/08/25 12:59:48,  6] rpc_server/srv_pipe.c:api_rpcTNP(2323)
  api_rpc_cmds[22].fn == 200be4
      samr_AddGroupMember: struct samr_AddGroupMember
          in: struct samr_AddGroupMember
              group_handle             : *
                  group_handle: struct policy_handle
                      handle_type              : 0x00000000 (0)
                      uuid                     : 
05000000-0000-0000-b248-b49e90510000
              rid                      : 0x00000bb8 (3000)
              flags                    : 0x00000005 (5)
[2008/08/25 12:59:48,  4] 
rpc_server/srv_lsa_hnd.c:find_policy_by_hnd_internal(168)
  Found policy hnd[0] [000] 00 00 00 00 05 00 00 00  00 00 00 00 B2 48 
B4 9E  ........ .....H..
  [010] 90 51 00 00                                       .Q..
[2008/08/25 12:59:48,  5] 
rpc_server/srv_samr_nt.c:access_check_samr_function(227)
  _samr_AddGroupMember: access check ((granted: 00000f001f;  required: 
0000000004)
[2008/08/25 12:59:48, 10] 
rpc_server/srv_samr_nt.c:_samr_AddGroupMember(4651)
  sid is S-1-5-21-440367617-1876916578-3462541782-3003
[2008/08/25 12:59:48, 10] groupdb/mapping.c:get_domain_group_from_sid(132)
  get_domain_group_from_sid

...

[2008/08/25 12:59:50,  3] groupdb/mapping.c:smb_add_user_group(352)
  smb_add_user_group: Running the command 
`/usr/local/sbin/smbldap-groupmod -m "dunk" "room11"' gave 0
[2008/08/25 12:59:50, 10] lib/system_smbd.c:sys_getgrouplist(122)
  sys_getgrouplist: user [dunk]
[2008/08/25 12:59:50,  3] smbd/sec_ctx.c:push_sec_ctx(224)
  push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1
...
[2008/08/25 12:59:50, 10] passdb/lookup_sid.c:legacy_gid_to_sid(1170)
  LEGACY: gid 512 -> sid S-1-5-21-440367617-1876916578-3462541782-512
      samr_AddGroupMember: struct samr_AddGroupMember
          out: struct samr_AddGroupMember
              result                   : NT_STATUS_ACCESS_DENIED

For delmem I again get the same access check granted value
  _samr_DeleteGroupMember: access check ((granted: 00000f001f;  
required: 0000000008)
then
  Get_Pwnam_internals did find user [dunk]!
[2008/08/25 14:41:10,  3] smbd/sec_ctx.c:pop_sec_ctx(432)
  pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0
[2008/08/25 14:41:10, 10] passdb/lookup_sid.c:legacy_sid_to_uid(1213)
  LEGACY: sid S-1-5-21-440367617-1876916578-3462541782-3000 -> uid 1000
      samr_DeleteGroupMember: struct samr_DeleteGroupMember
          out: struct samr_DeleteGroupMember
              result                   : NT_STATUS_MEMBER_NOT_IN_GROUP


Any thoughts or pointers as to where I should be looking?

Thanks,
          Duncan



-- 
The University of St Andrews is a charity registered in Scotland : No SC013532