[Samba] auth methods = winbind (was: Re: Samba 4 AD share: Access denied)

[Andrew Bartlett]

On Thu, 2014-07-24 at 11:25 -0400, Ryan Ashley wrote:
> I have been using Samba4 for ages and love it as a DC and a 
> print-server. I just setup my first member-server designed solely to 
> host file shares, and have hit an issue. Group policy is mapping it 
> correctly for the users in the group, but those users are getting an 
> access denied message from their Windows 7 Pro 64bit clients when 
> accessing the share. I have configured ACLs and the box resolves users 
> and groups. Everything works, except for the shares. Below I attached 
> all of the information I believe to be useful. Ask if you need more, and 
> thank you for your help!
> 
> smb.conf:
> ======
> [global]

>    auth methods = winbind

Ryan,

I know you have had much advice, a lot of it not actually relevant to
the problems you have at hand (I see you have been distracted down
'kerberos method' for example), and this advice is probably in the same
category.  

However:  Please do not set 'auth methods'.  It has already been set
correctly by the defaults (based on security=), and the parameter only
needs to be set in the most unusual of configurations.  

Yes, it will probably still work (perhaps breaking anonymous access,
which you probably are not using), but the man-page does say:

"This should be considered a developer option and used only in rare
circumstances.  In the majority (if not all) of production servers, the
default setting should be adequate."

Thanks,

Andrew Bartlett

-- 
Andrew Bartlett                       http://samba.org/~abartlet/
Authentication Developer, Samba Team  http://samba.org
Samba Developer, Catalyst IT          http://catalyst.net.nz/services/samba