[Samba] winbind: problems with group names

[Dirk Gouders]

Hi,

I am running a 3.6.0 server as a member of a Samba4 domain controller
and am noticing some behaviour that I do not understand (the domain is
FB5, the domain member servers's name is tango)

It took me some time to get winbind showing domain users and groups
but finally with backend idmap_rid it is _nearly_ working.
`getent passwd' and `gentent group' list domain users and groups:

...
FB5+dg:*:1624:1013:dg:/home/FB5/dg:/bin/sh

...
FB5+allowed rodc password replication group:x:1071:
FB5+enterprise read-only domain controllers:x:998:
FB5+denied rodc password replication group:x:1072:FB5+krbtgt
FB5+read-only domain controllers:x:1021:
FB5+group policy creator owners:x:1020:FB5+administrator
FB5+ras and ias servers:x:1053:
FB5+domain controllers:x:1016:
FB5+enterprise admins:x:1019:FB5+administrator
FB5+domain computers:x:1015:
FB5+cert publishers:x:1017:
FB5+dnsupdateproxy:x:1603:
FB5+domain admins:x:1012:FB5+administrator
FB5+domain guests:x:1014:
FB5+schema admins:x:1018:FB5+administrator
FB5+domain users:x:1013:
FB5+dnsadmins:x:1602:

But when I use other programs that should display user and group names,
the group names are TANGO+none instead of FB5+something:

$ id FB5+dg
uid=1624(FB5+dg) gid=1013(TANGO+none) groups=1013(TANGO+none)

# ls -la /home/FB5/dg/
total 8
drwx------ 2 FB5+dg TANGO+none 4096 Sep 15 10:46 .
drwxr-xr-x 5 root   root       4096 Sep 15 11:28 ..

I tried to remove group_mapping.tdb and winbindd_cache.tdb but that
did not help.  From what I see if I run winbindd with -d (and from the
above output), it seems as if it tries to do a group mapping in the
domain TANGO (the name of the member server) which obviously fails but I
have no idea what I probably have misconfigured.

Thanks,

Dirk