[Samba] Re: winbind - not ready for prime time

Douglas VanLeuven roamdad at sonic.net
Mon Feb 18 02:03:16 GMT 2008

Christian McHugh wrote:
> Guido Lorenzutti wrote:
>> Jeremy Allison wrote:
>>> If you have a specific issue, ask it. If you have a specific
>>> bug, report it. You did none of those things.
>> Im not a developer, Im a sysadmin and I been using samba for a lot of
>> years know.
>> When I read the post, I wasn't going to answear, 'coz I didn't feel
>> related to the subject.
>> I think I have a little experience in Samba and Winbind. If you need
>> someone to write examples, docs, manpages, etc.. I don't have any
>> problem to fill the blanks. Just tell me where I should start.
> Well, in an attempt at raising the signal to noise ratio, I've
> personally had problems deciphering exactly how to use winbind with
> idmap_ad.
>  - In the smb.conf do I have an idmap decleration per domain, or is the
> example given in the man page "ALLDOMAINS" acceptable?
>  - (As mentioned in an unanswered mail to this list) How do I go about
> compiling the rfc2307 module, either statically or dynamiclly?
> Once I get past the rfc2307 compile question, I think I'll have more
> questions. But since I don't have winbind running well in my environment
> (yet) I can bring those up later.

My 2 cents.  Open Source used to mean just that.  The source was public.
 Anyone can read it.  Howtos were generally created by users that wanted
to give back to the community, not usually developers.

My observation is non-developers frequently confuse documenting samba
with documenting MS windows (c).  As the recent EC decision indicates,
MS has been reluctant to document their product.  Don't blame the samba
team for the MS lack of transparency.

As far as compiling idmap_ad goes, look in the supplied configure script.

# Check whether --with-shared-modules or --without-shared-modules was given.
if test "${with_shared_modules+set}" = set; then
   if test $withval; then
        for i in `echo $withval | sed -e 's/,/ /g'`
                        eval MODULE_$i=SHARED

Then grep the file "grep MODULE_idmap_ configure"

        if test "$MODULE_idmap_ldap"; then
        if test "$MODULE_idmap_tdb"; then
        if test "$MODULE_idmap_passdb"; then
        if test "$MODULE_idmap_nss"; then
        if test "$MODULE_idmap_rid"; then
        if test "$MODULE_idmap_ad"; then

There you have it.


Just pick the ones you want.  idmap_ad includes support for both SFU and
rfc2307.  I once tried to compile idmap_ad as a static module and core
dumpped.  Maybe it's changed but I don't think so.  If your OS has
issues with dynamic modules, you'll probably have to fix it yourself
either thru support with the OS vendor or modifying the samba code.

As far as rfc2307 support goes:

find .|grep idmap_ad

less nsswitch/idmap_ad.c

Second line:
 *  idmap_ad: map between Active Directory and RFC 2307 or "Services for
Unix" (SFU) Accounts

There is a document "A new IDMAP subsystem" on the samba website that I
think is more illuminative than the manpages.

google idmap pdf site:www.samba.org


Regards, Doug

More information about the samba mailing list