[Samba] Samba 4.1.4 and winbind

[steve]

On Sat, 2014-02-01 at 09:35 +0000, Rowland Penny wrote:
> After the 'you should use winbind saga', I decide that I needed to learn 
> about using winbind with samba 4 clients.
> 
> So I created a VM running ubuntu 12.04 server and installed and compiled 
> samba 4 to use as a test client.
> 
> created /usr/local/samba/etc/smb.conf
> 
> [global]
>      workgroup = EXAMPLE
>      security = ADS
>      realm = EXAMPLE.COM
>      encrypt passwords = yes
>      server string = %h server (Samba)
>      idmap config *:backend = tdb
>      idmap config *:range = 70001-80000
>      idmap config EXAMPLE:backend = ad
>      idmap config EXAMPLE:schema_mode = rfc2307
>      idmap config EXAMPLE:range = 1000-40000
> 
>      winbind nss info = rfc2307
>      winbind trusted domains only = no
>      winbind use default domain = yes
>      winbind enum users  = yes
>      winbind enum groups = yes
> 
>      domain master = no
>      local master = no
>      preferred master = no
>      os level = 20
>      map to guest = bad user
> 
> Set up pam etc and started the three samba daemons, checked they were 
> running via 'ps ax'
> 
> My domain users uidNumber's start at 10000, so they are within 1000-40000
> 
> BUT, getent passwd & group did not return anything, although wbinfo -u & 
> -g did return the domain users & groups.
> 
> Gave it a bit of thought, now I gave Domain Users the gidNumber of '100' 
> i.e. 'users' on my linux box, so I altered 'idmap config EXAMPLE:range = 
> 1000-40000' to 'idmap config EXAMPLE:range = 0-40000' and restarted the 
> daemons.
> 
> Winbind now works, so from this, I summise that a user needs both a 
> uidNumber & gidNumber before the ad backend will extract them from AD 
> and both need to be inside the range supplied.

Hi Rowland
Thanks for the effort and can we confirm this behaviour. You have put
into words what must have been many a confusing 'it still doesn't work'
many times before. I can't find any reference to winbind needing BOTH
uidNumber and gidNumber to be within the range. For those that have only
included the uidNumber attribute in AD, this will never have getent
return. Both must be specified.
> 
> This sort of begs the question, if you are using the ad backend and 
> presumably have already given your users & groups a uidNumber &/or a 
> gidNumber, why does winbind need the range line at all for the domain? 
> Shouldn't winbind just extract any and all records, where the object has 
> the required RFC2307 attributes?

It doesn't make sense to have to specify the range. A more predictable
behaviour for us would be to simply use whatever the administrator has
specified in AD. Forget the ranges. I think they are there as a
throwback to te days when id mapping was always done outside AD. Now we
have the attributes at our disposable, could we get rid of them? 
> 
> There is still one problem though, 'getent group' still does not return 
> anything, but 'getent group <a group name>' does.

We have never got getent group to return with any version of winbind
since 3.5.something.
> 
> And you wonder why I tell everybody to use that package I cannot name! 
> it just works.

We don't wonder. Were it not for you guys, we'd still be struggling to
come to terms with anything 2307ish!

Thanks again for your plain English. I wish that our descriptive powers
were on a par with yours.
Steve pp .
> 
> Rowland
>