[Samba] winbindd(8)-> groups: cannot find name for group ID ... [SEC=UNCLASSIFIED]

[Wilkinson, Alex]

Hi all,

On one of my Linux AD clients (Ubuntu 10.04.1 LTS - 2.6.32-24-generic) when i log
in via ssh i get the following errors:

   groups: cannot find name for group ID 10000
   groups: cannot find name for group ID 10001
   groups: cannot find name for group ID 10002
   groups: cannot find name for group ID 10003
   groups: cannot find name for group ID 10004

The login still succeeds perfectly fine i.e via winbindd(8) + Samba 3.4.7.

Looking at the debug output for an interactive winbindd(8) session i see:

   [ 2797]: gid 10000 to sid
   Could not find domain for sid S-1-5-21-xxxxxxxxxx-xxxxxxxxxx-xxxxxxxxxx-xxxxx
   [ 2877]: getgrgid 10001
   child daemon request 55
   [ 2797]: gid 10001 to sid
   Could not find domain for sid S-1-5-21-xxxxxxxxxx-xxxxxxxxxx-xxxxxxxxxx-xxxx
   [ 2877]: getgrgid 10002
   child daemon request 55
   [ 2797]: gid 10002 to sid
   Could not find domain for sid S-1-5-21-xxxxxxxxxx-xxxxxxxxxx-xxxxxxxxxx-xxxxx
   [ 2877]: getgrgid 10003
   child daemon request 55
   [ 2797]: gid 10003 to sid
   Could not find domain for sid S-1-5-21-xxxxxxxxxx-xxxxxxxxxx-xxxxxxxxxx-xxxx
   [ 2877]: getgrgid 10004
   child daemon request 55
   [ 2797]: gid 10004 to sid
   Could not find domain for sid S-1-5-21-xxxxxxxxx-xxxxxxxxx-xxxxxxxxxx-xxxx

relevant smb.conf entry looks like:

   idmap backend                   = tdb
   idmap uid                       = 10000-500000
   idmap gid                       = 10000-500000
   idmap config DOMAIN:backend     = rid
   idmap config DOMAIN:range       = 10000-500000

Can anyone suggest what is wrong here or how to debug further ?

Thanks

  -Alex

IMPORTANT: This email remains the property of the Department of Defence and is subject to the jurisdiction of section 70 of the Crimes Act 1914. If you have received this email in error, you are requested to contact the sender and delete the email.