[Samba] problem with sambaNextRid (WAS: updating samba/ldap: do I need new attributes?)

[Thierry Lacoste]

Hello,

I did the steps described below and I have a problem with machine RIDs.

When I first join a machine, samba adds to my sambaDomainName ldap entry
a sambaNextRid attribute with a value of 1000.
Now samba uses this value (incremented each time) to give its RID
to the machine.

This is going to be a real problem as my current samba computes RDIs
as 1000+2*UID.

FWIW I'm using smbldap-tools to create user accounts and I have
add machine script = /usr/local/sbin/smbldap-useradd -w '%u'
in my smb.conf though I don't think it is relevant because
AFAIK this script is only called to create the posix machine account.

What are my options?
If at all possible, I'd rather stick to the 1000+2*UID algorithm.

I googled about it and I know that others where caught too
but I wasn't able to find a solution.

Regards,
Thierry.

Quoting Adam Williams <awilliam at mdah.state.ms.us>:

> your steps are fine.  you don't need the samba LDAP entries you listed,
> when ou do smbpasswd -a user, it will add the minimum required LDAP
> entries for samba.
>
> lacoste at miage.univ-paris12.fr wrote:
>> Hello,
>>
>> I plan to update my samba-3.0.22/openldap-2.3.24
>> to samba-3.0.34/openldap-2.4.15 and I'm currently testing it.
>> This is on FreeBSD.
>>
>> My idea is :
>> 1) slapcat the openldap server and save the various tdb files.
>> 2) deinstall samba and openldap and wipe out the bdb files
>> 3) install the newer versions
>> 4) slapadd to the new openldap server
>>
>> This seems to work in my test lab.
>> During my tests I also built a new domain afresh and realized that the
>> sambaDomainName ldap entry has some attributes that are not in my
>> production server: sambaMinPwdLength, sambaLogonToChgPwd,   
>> sambaLockoutDuration,
>> sambaLockoutObservationWindow, sambaLockoutThreshold, sambaForceLogoff.
>>
>> Do I have to add these attributes to my ldif file before slapadd?
>> More generally, do I have to add some attributes to my ldap entries?
>>
>> Regards,
>> Thierry
>>
>>
>>