[Samba] Can I authenticate with windows UPN names using winbind? If so how?
samba at tlinx.org
Wed May 21 17:57:21 MDT 2014
> Hi all,
> I am trying to set up an linux server that allows users to log in via their
> windows UPN names rather than their SamID's.
> I've bound both linux boxen to our Active Directory Server running 2008R2
> and can return domain usernames with the tools wbinfo and getent.
> Wbinfo -n shows me the user's sid is mapped the same whether I use the
> samID or UPN
I think it would be easier to use the 'Domain\User' format Would it work
to use the 'domain\user' format? You are more likely to get that to
work than using '@', as '@' has special meanings to many utils...
I.e. Since user at hostname with many utils, = "using user 'user', do
something on hostname. I.e. the '@' can't be part of a username as it
implies the "object"
host that the command acts upon.
How would "email", know joe at tomcat.com isn't meant to be addressed to "joe"
Local examples (not the best examples, because when I log into the
it's the PDC, so treats my domain account as a local account.
lw.Bliss> uname -a
CYGWIN_NT-6.1 Athenae 1.7.29(0.272/5/3) 2014-04-07 13:46 x86_64 Cygwin
Admins),513(Bliss\Domain Users) [...]
lw.Bliss> ssh 'Bliss\lw at ishtar'
Admins),513(Domain Users),544(Administrators) [...]
May 21 16:36:52 Ishtar sshd: pam_winbind(sshd:account): user
May 21 16:36:52 Ishtar sshd: Accepted publickey for Bliss\\lw
from 192.168.4.12 port 59451 ssh2
I have both 'lw' & Bliss\lw in /etc/passwd. I also have a full upcase
in /etc/passwd since samba doesn't respect case in 3.6.x (it did ignored
case in 3.4 (preserving it)), but Samba broke windows compat by no longer
respecting (but ignoring) case.
My /etc/pw+grp files are "coordinated" so as to reserve unique ID's
I also use backend=nss and do not have separate ranges for the local PDC
accounts and Domain accounts.
You might want to make sure that your /etc/login.defs file (linux)
allows spaces and backslash in the "CHARACTER CLASS", like:
CHARACTER_CLASS <readability break>
[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz_] <readability break>
Please forgive me if this is really, not what you
want, and you really want the '@' separator.
More information about the samba