[Samba] winbind: group membership issues.

[Nord, James]

After a lot of scratching and searching it looks like I may be hitting
Solaris' max 16 groups limit.  Arrgggg.

/James

> -----Original Message-----
> From: samba-bounces+jnord=ndsuk.com at lists.samba.org 
> [mailto:samba-bounces+jnord=ndsuk.com at lists.samba.org] On 
> Behalf Of Nord, James
> Sent: 16 January 2008 10:07
> To: samba at lists.samba.org
> Subject: [Samba] winbind: group membership issues.
> 
> Hi all,
>  
> I  have a Solaris 10 (update 4) box (x86) that is joined to 
> an active directory via samba/winbind (3.0.25c version 
> included with Solaris including latest patches).
> 
> The users are working fine however their group membership is not.
> 
> Users that should be members of certain groups do not seem to 
> be: in that if I run 'groups' and check the group member ship 
> for my domain account I am missing entry of some groups yet I 
> can verify that I should be a member of the missing groups by 
> running 'getent group "domain\\group name"' and seeing my 
> domain username entered.
> 
> winbind has the following parameters set
>     winbind enum users = yes
>     winbind enum groups = yes
>     winbind nested groups = yes
> 
> I am at a loss as to why it picks up some groups and not others.
> 
> The name service cache deamon is not running.
>  
> wbinfo -u, -g, and -t all report correctly
> 
> Has anyone come across something similar or know how to solve 
> this issue?
> 
> -- smb.conf --
> [global]
>         workgroup = NDS-UK
>         realm = UK.NDS.COM
>         server string = SCG NAS server
>         security = ADS
>         use kerberos keytab = true
>         ;password server = ukdc2.uk.nds.com
>         ;passdb backend = tdbsam
>         encrypt passwords = true
>  
>         log file = /var/samba/log/log.%m
>         max log size = 50
>         load printers = No
>         os level = 33
>         domain master = No
>         wins proxy = Yes
>         wins server = 172.20.126.100, 172.18.253.100
>         ldap ssl = no
>  
> 
> 	 
> 
> 
> # winbind configuration:
>  
>         ;winbind separator = +
>         winbind enum users = yes
>         winbind enum groups = yes
>         winbind nested groups = yes
>         ;template homedir = /samba/pchome/%D/%U
>         template shell = /usr/bin/bash
>  
>         idmap domains = NDS-UK
>         idmap config NDS-UK:default = yes
>         idmap config NDS-UK:backend = tdb
>         idmap config NDS-UK:range = 10000-20000
>  
>         idmap alloc backend = tdb
>         idmap alloc config:range = 10000-20000
>  
> 
> [printers]
>         comment = All Printers
>         path = /var/spool/samba
>         printable = Yes
>         browseable = No
>  
> [TSFiles]
>         comment = MPEG-2 transport streams
>         path = /zfs/internal/streams
>         writeable = true
>         ;user = @"NDS-UK\\domain users"
>         vfs objects = zfsacl
>         nfs4: mode = special
>         ;inherit permissions = true
>         ; root prexexec = /usr/bin/snapshot_date.sh 
> /zfs/internal/streams
>  
> -- end smb.conf --
>  
>  
> -- nsswitch.conf --
> passwd:     files winbind
> group:      files winbind
>  
> # You must also set up the /etc/resolv.conf file for DNS name 
> # server lookup.  See resolv.conf(4).
> hosts:      files dns
>  
> # Note that IPv4 addresses are searched for in all of the 
> ipnodes databases # before searching the hosts databases.
> ipnodes:   files dns
>  
> networks:   files
> protocols:  files
> rpc:        files
> ethers:     files
> netmasks:   files
> bootparams: files
> publickey:  files
> # At present there isn't a 'files' backend for netgroup;  the 
> system will
> #   figure it out pretty quickly, and won't use netgroups at all.
> netgroup:   files
> automount:  files
> aliases:    files
> services:   files
> printers:       user files
>  
> auth_attr:  files
> prof_attr:  files
> project:    files
>  
> tnrhtp:     files
> tnrhdb:     files
> -- end nsswitch.conf --
> 
> Regards,
> 
> James 
*********************************************************************************************************
This e-mail is confidential, the property of NDS Ltd and intended for the addressee only.  Any dissemination, copying or distribution of this message or any attachments by anyone other than the intended recipient is strictly prohibited.  If you have received this message in error, please immediately notify the postmaster at nds.com and destroy the original message.  Messages sent to and from NDS may be monitored.  NDS cannot guarantee any message delivery method is secure or error-free.  Information could be intercepted, corrupted, lost, destroyed, arrive late or incomplete, or contain viruses.  We do not accept responsibility for any errors or omissions in this message and/or attachment that arise as a result of transmission.  You should carry out your own virus checks before opening any attachment.  Any views or opinions presented are solely those of the author and do not necessarily represent those of NDS.

To protect the environment please do not print this e-mail unless necessary.

NDS Limited Registered office: One Heathrow Boulevard, 286 Bath Road, West Drayton, Middlesex, UB7 0DQ, United Kingdom. A company registered in England and Wales  Registered no. 3080780   VAT no. GB 603 8808 40-00
**********************************************************************************************************