[Samba] Winbind - DUAL_SID2UID empty domain?
rh87 at duke.edu
Wed Apr 21 15:04:34 MDT 2010
I am having a strange problem that I thought someone might be help resolve. I am using Samba 3.4.7 at the moment, but I've had the same issue with Samba 3.4.6 and Samba 3.5.2.
NOTE: Domain, hostnames, usernames and SIDs have been changed to protect the guilty.
I am seeing an unable to successfully execute a variety of lookups from wbinfo and I think this is the underlying cause of some other issues I am seeing. For example:
# wbinfo -s "S-1-1-11-1111111111-1111111111-1111111111-11111"
This also works:
# wbinfo -n joeuser
S-1-1-11-1111111111-1111111111-1111111111-11111 SID_USER (1)
# wbinfo -i joeuser
Could not get info for user joeuser
It seems like pretty much anything that involves the idmap backend in some way fails.
I noticed a strange message in the logs at the same time. I see the request come in. In log.wb-ADDOMAIN, I see several requests from winbindd come in, and they both work (first a LOOKUPNAME, then a DUAL_USERINFO). Then I see this:
==> winbindd.log <==
[2010/04/21 16:17:25, 10] winbindd/winbindd_cache.c:492(refresh_sequence_number)
refresh_sequence_number: ADDOMAIN time ok
[2010/04/21 16:17:25, 10] winbindd/winbindd_cache.c:537(refresh_sequence_number)
refresh_sequence_number: ADDOMAIN seq number is now 13991956
[2010/04/21 16:17:25, 10] winbindd/winbindd_cache.c:577(centry_expired)
centry_expired: Key NSS/NA/JOEUSER for domain ADDOMAIN is good.
[2010/04/21 16:17:25, 10] winbindd/winbindd_cache.c:661(wcache_fetch)
wcache_fetch: returning entry NSS/NA/JOEUSER for domain ADDOMAIN
[2010/04/21 16:17:25, 10] winbindd/winbindd_cache.c:1053(resolve_username_to_alias)
resolve_username_to_alias: [Cached] - mapped joeuser to joeuser
[2010/04/21 16:17:25, 10] winbindd/winbindd_idmap.c:269(winbindd_sid2uid_async)
winbindd_sid2uid_async found domain ADDOMAIN, have_idmap_config = 0
[2010/04/21 16:17:25, 10] winbindd/winbindd_dual.c:125(async_request)
Sending request to child pid 1607 (domain='')
Upon which I see the following in log.winbindd-idmap (a request for DUAL_SID2UID):
[2010/04/21 16:17:25, 4] winbindd/winbindd_dual.c:1452(fork_domain_child)
child daemon request 51
[2010/04/21 16:17:25, 10] winbindd/winbindd_dual.c:452(child_process_request)
child_process_request: request fn DUAL_SID2UID
[2010/04/21 16:17:25, 3] winbindd/winbindd_idmap.c:293(winbindd_dual_sid2uid)
[ 1599]: sid to uid S-1-1-11-1111111111-1111111111-1111111111-11111
[2010/04/21 16:17:25, 10] winbindd/idmap_util.c:157(idmap_sid_to_uid)
idmap_sid_to_uid: sid = [S-1-1-11-1111111111-1111111111-1111111111-11111], domain = ''
[2010/04/21 16:17:25, 10] winbindd/idmap.c:765(idmap_backends_sid_to_unixid)
idmap_backends_sid_to_unixid: domain = '', sid = [S-1-1-11-1111111111-1111111111-1111111111-11111]
[2010/04/21 16:17:25, 10] winbindd/idmap.c:465(idmap_find_domain)
idmap_find_domain called for domain ''
[2010/04/21 16:17:25, 10] winbindd/idmap_ad.c:71(ad_idmap_cached_connection_internal)
ad_idmap_cached_connection: called for domain '*'
[2010/04/21 16:17:25, 10] winbindd/idmap_ad.c:112(ad_idmap_cached_connection_internal)
ldap_server from saf cache: ''
[2010/04/21 16:17:25, 10] winbindd/idmap_ad.c:117(ad_idmap_cached_connection_internal)
find_domain_from_name_noinit did not find domain '*'
[2010/04/21 16:17:30, 1] winbindd/idmap_ad.c:143(ad_idmap_cached_connection_internal)
ad_idmap_init: failed to connect to AD
[2010/04/21 16:17:30, 1] winbindd/idmap_ad.c:543(idmap_ad_sids_to_unixids)
ADS uninitialized: No logon servers
[2010/04/21 16:17:30, 10] winbindd/idmap.c:465(idmap_find_domain)
idmap_find_domain called for domain 'NULL'
[2010/04/21 16:17:30, 3] winbindd/idmap.c:674(idmap_new_mapping)
default domain not writable
[2010/04/21 16:17:30, 10] winbindd/idmap_util.c:212(idmap_sid_to_uid)
idmap_new_mapping failed: NT_STATUS_MEDIA_WRITE_PROTECTED
This seems to me to indicate that it is trying to do a SID to UID translation for the wrong (empty) domain. In that context, it makes a certain amount of sense that it can't connect to any login servers (I assume it looks for DCs for the domain '', can't find them, and fails). Since various other commands that make use of data from the AD work (and it was able to get the SID from the AD in this very request), I don't think it is having trouble talking to the AD.
Does anyone have any thoughts as to why that might be?
OS: Centos 5.4 (kernel: 2.6.18)
Samba version: 3.4.6, 3.4.7, 3.5.2 (sernet packages)
Relevant bits of smb.conf:
workgroup = ADDOMAIN
security = ads
realm = ADDOMAIN.SOME.ORG
idmap backend = ad
idmap uid = 1000-1999999
idmap gid = 1000-1999999
client ntlmv2 auth = yes
ntlm auth = no
password server = a_random_dc.addomain.some.org
winbind nss info = rfc2307
winbind normalize names = yes
winbind use default domain = yes
winbind nested groups = yes
The domain is a Windows 2000 Active Directory with RFC2307 extensions.
I have this server set up with krb5/nss_ldap configured against the AD as well. Commands like 'id', 'groups', and 'getent passwd/groups' work just fine. I can make queries via the openldap client and all the attributes seem valid.
Ryan Hardy <ryan.hardy at duke.edu>
Sr. Systems Programmer
More information about the samba