[Samba] getent acting unreliable with idmap_ad

[Robert Grasso]

> > I just filled it up properly, but did not mention Kerberos 
> in any way in smb.conf
> 
> Doh, that's what I have too.
> 
> Any chance you could send me a copy of your smb.conf?
> 

well, no problem, I am sure it is not a great piece of smb.conf, actually : here it is : it is the one for my desktop : I removed
the comments and our private names and IPs :

[global]
   netbios name = short
   workgroup = WG
   realm = WG.LAN
   server string = Samba Server - long_name
   hosts allow = 10.0. 127.
   smb ports = 445
   #printcap name = /etc/printcap
   printcap name = cups
   load printers = yes
    printing = cups
cups options = raw
 log level = 1
 log file = /var/log/samba/%m.log
   max log size = 10000
   security = ADS
    password server = s1,s2
   encrypt passwords = yes
   socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
   preferred master = no
name resolve order = wins bcast
    wins server = IP1 IP2
   dns proxy = yes 
   idmap domains = ALLDOMAINS
   idmap config ALLDOMAINS:backend = ad
   idmap config ALLDOMAINS:default = yes
   idmap config ALLDOMAINS:schema_mode = sfu
   idmap config ALLDOMAINS:range = 500 - 20000
   template homedir = /home/%U
   winbind use default domain = yes
   winbind separator = +
   winbind enum users = yes
   winbind enum groups = yes
   winbind nss info = template sfu
   winbind offline logon = true
   winbind refresh tickets = true

Some comments : 
- I used "netbios name", as my desktop Unix name is longer than 15 characters - Windows or Samba did not like it ...
- we have two names for our AD domain - our winadmin did not solve this issue so far, thus I put one name as the "workgroup" and the
other name as the kerberos "realm" ...
- I let "template homedir" in smb.conf by sheer lazyness, with SFU I don't use it
- I used to set "winbind offline logon" and "winbind refresh tickets" when my Samba was unstable, they were tests - then, once I
found the true solution, lazyness again ...

Hope this helps
---
Robert GRASSO 
System Engineer

CEDRAT
15, Chemin de Malacher - Inovallée - 38246 MEYLAN Cedex - FRANCE 
Tel: +33 (0)4 76 90 50 45 Fax: +33 (0)4 76 90 16 09
mailto:Robert.Grasso at cedrat.com
---
Support service       : mailto:support at cedrat.com 
Commercial service : mailto:cedrat at cedrat.com 
Web site                  : http://www.cedrat.com