[Samba] Winbind idmap question

mathias dufresne infractory at gmail.com
Thu Apr 21 12:50:42 UTC 2016


Solved!

The issue:
---------------------------------------------------------------
wbinfo -i <username>
failed to call wbcGetpwnam: WBC_ERR_DOMAIN_NOT_FOUND
Could not get info for user <username>
---------------------------------------------------------------
and
---------------------------------------------------------------
id <username>
id: <username>: no such user
---------------------------------------------------------------

When these both commands (with same user) were working on any other DC.

Solution:
Samba was stopped. I took files from some working DC to push them on the
broken one. Samba was started, issue solved.

Copied files list:
private/idmap.ldb
private/hklm.ldb
private/schannel_store.tdb
private/secrets.*
private/share.ldb
registry.tdb
share_info.tdb
winbindd_cache.tdb
account_policy.tdb

This seems to me an issue from Samba itself.

A small note: when the issue was existing processing to wbinfo -i
<username> was filling net cache with the right information about the user
but for some reason I don't understand at all wbinfo was hanging. So did
"id".

"net cache flush" was the solution to get rid of auto-generated UIDs (for
users get their own UID from uidNumber in AD LDAP tree).

mathias


2016-04-21 13:36 GMT+02:00 mathias dufresne <infractory at gmail.com>:

> And why do I want to get rid of id mapping?
>
> Because starting my tests this morning, checking id of the same user on 3
> DC I get 3 different UIDs for the same user. That's why we would prefer to
> rely on uidNumber.
>
> 2016-04-21 12:40 GMT+02:00 mathias dufresne <infractory at gmail.com>:
>
>> All DC are running same Samba version : 4.4.2. All DC are hosted on same
>> Centos 7.
>>
>> On broken server(s):
>> wbinfo -i mdufresne
>> failed to call wbcGetpwnam: WBC_ERR_DOMAIN_NOT_FOUND
>> Could not get info for user mdufresne
>>
>> On working servers:
>> wbinfo -i mdufresne
>> AD.DOMAIN\mdufresne:*:12104:100:Mathias Dufresne
>> (TEMP):/home/AD.DGFIP/mdufresne:/bin/false
>>
>> The smb.conf is:
>> ---------------------------------------------------------------------
>> # Global parameters
>> [global]
>>         workgroup = AD.DOMAIN
>>         realm = AD.DOMAIN.TLD
>>         netbios name = DNS20
>>         server role = active directory domain controller
>>
>>         server services = -dns
>>         idmap_ldb:use rfc2307 = yes
>>
>>         acl_xattr:ignore system acls = yes
>>         winbind nss info = rfc2307
>>
>> [netlogon]
>>         path = /var/lib/samba/sysvol/ad.domain.tld/scripts
>>         read only = No
>>
>> [sysvol]
>>         path = /var/lib/samba/sysvol
>>         read only = No
>> ---------------------------------------------------------------------
>>
>> krb5.conf is:
>> ---------------------------------------------------------------------
>> [libdefaults]
>>         default_realm = AD.DOMAIN.TLD
>>         dns_lookup_realm = false
>>         dns_lookup_kdc = true
>> ---------------------------------------------------------------------
>>
>> nsswitch.conf winbind related is:
>> ---------------------------------------------------------------------
>> passwd:     files winbind
>> shadow:     files winbind
>> group:      files winbind
>> ---------------------------------------------------------------------
>>
>> And finally PAM configuration (only winbind related stuffs):
>> ---------------------------------------------------------------------
>> /etc/pam.d/fingerprint-auth:account     [default=bad success=ok
>> user_unknown=ignore] pam_winbind.so krb5_auth krb5_ccache_type=KEYRING
>> /etc/pam.d/fingerprint-auth:session     optional      pam_winbind.so
>> krb5_auth krb5_ccache_type=KEYRING
>> /etc/pam.d/fingerprint-auth-ac:account     [default=bad success=ok
>> user_unknown=ignore] pam_winbind.so krb5_auth krb5_ccache_type=KEYRING
>> /etc/pam.d/fingerprint-auth-ac:session     optional      pam_winbind.so
>> krb5_auth krb5_ccache_type=KEYRING
>> /etc/pam.d/password-auth:auth        sufficient    pam_winbind.so
>> krb5_auth krb5_ccache_type=KEYRING use_first_pass
>> /etc/pam.d/password-auth:account     [default=bad success=ok
>> user_unknown=ignore] pam_winbind.so krb5_auth krb5_ccache_type=KEYRING
>> /etc/pam.d/password-auth:password    sufficient    pam_winbind.so
>> krb5_auth krb5_ccache_type=KEYRING use_authtok
>> /etc/pam.d/password-auth:session     optional      pam_winbind.so
>> krb5_auth krb5_ccache_type=KEYRING
>> /etc/pam.d/password-auth-ac:auth        sufficient    pam_winbind.so
>> krb5_auth krb5_ccache_type=KEYRING use_first_pass
>> /etc/pam.d/password-auth-ac:account     [default=bad success=ok
>> user_unknown=ignore] pam_winbind.so krb5_auth krb5_ccache_type=KEYRING
>> /etc/pam.d/password-auth-ac:password    sufficient    pam_winbind.so
>> krb5_auth krb5_ccache_type=KEYRING use_authtok
>> /etc/pam.d/password-auth-ac:session     optional      pam_winbind.so
>> krb5_auth krb5_ccache_type=KEYRING
>> /etc/pam.d/smartcard-auth:account     [default=bad success=ok
>> user_unknown=ignore] pam_winbind.so krb5_auth krb5_ccache_type=KEYRING
>> /etc/pam.d/smartcard-auth:session     optional      pam_winbind.so
>> krb5_auth krb5_ccache_type=KEYRING
>> /etc/pam.d/smartcard-auth-ac:account     [default=bad success=ok
>> user_unknown=ignore] pam_winbind.so krb5_auth krb5_ccache_type=KEYRING
>> /etc/pam.d/smartcard-auth-ac:session     optional      pam_winbind.so
>> krb5_auth krb5_ccache_type=KEYRING
>> /etc/pam.d/system-auth-ac:auth        sufficient    pam_winbind.so
>> krb5_auth krb5_ccache_type=KEYRING use_first_pass
>> /etc/pam.d/system-auth-ac:account     [default=bad success=ok
>> user_unknown=ignore] pam_winbind.so krb5_auth krb5_ccache_type=KEYRING
>> /etc/pam.d/system-auth-ac:password    sufficient    pam_winbind.so
>> krb5_auth krb5_ccache_type=KEYRING use_authtok
>> /etc/pam.d/system-auth-ac:session     optional      pam_winbind.so
>> krb5_auth krb5_ccache_type=KEYRING
>> ---------------------------------------------------------------------
>>
>> This PAM configuration was obtained using RH authconfig tool:
>> authconfig --enablewinbindkrb5 --enablewinbindauth --update
>>
>>
>>
>> 2016-04-21 12:25 GMT+02:00 Jonathan Hunter <jmhunter1 at gmail.com>:
>>
>>> Hi,
>>>
>>> Does "wbinfo -i <user>" work, and return the same results, on all the
>>> DCs?
>>>
>>> Are the DCs running the distribution & versions (e.g. CentOS, Debian,
>>> whatever) or are there differences there, also?
>>>
>>> On 21 April 2016 at 11:16, mathias dufresne <infractory at gmail.com>
>>> wrote:
>>>
>>> > Hi Jonathan,
>>> >
>>> > Thank you for that, that solved the issue.
>>> >
>>> > Unfortunately I get another issue: on one DC id <user> gives "no such
>>> > user".
>>> > Adding domain (id ad.domain\\<user>) does not help.
>>> > Adding the whole domain (id ad.domain.tld\\<user>) does not help more.
>>> >
>>> > I did checked PAM, NSS and Samba configurations, this server is using
>>> same
>>> > configurations as the two working DC. I'm puzzled.
>>> >
>>> > 2016-04-21 11:52 GMT+02:00 Jonathan Hunter <jmhunter1 at gmail.com>:
>>> >
>>> >> You can try "net cache flush" (if you want to inspect the cache, use
>>> "net
>>> >> cache list")
>>> >>
>>> >> On 21 April 2016 at 10:40, mathias dufresne <infractory at gmail.com>
>>> wrote:
>>> >>
>>> >> > Hi all,
>>> >> >
>>> >> > Back on playing winbind I first configure PAM and NSS then tried id
>>> >> > <my_user_name> without setting for that user uidNumber.
>>> >> >
>>> >> > This user get UID from idmap.
>>> >> >
>>> >> > I set up uidNumber into LDAP tree for that user but this user still
>>> get
>>> >> uid
>>> >> > from idmap rather than from uidNumber attribute.
>>> >> >
>>> >> > I set up another user with uidNumber into LDAP tree and after doing
>>> >> that I
>>> >> > tried "id <my_second_user>". Here id returns the content of
>>> uidNumber
>>> >> LDAP
>>> >> > attribute as user UID.
>>> >> >
>>> >> > Question: how to make the first user to get rid of idmaped UID?
>>> >> > --
>>> >> > To unsubscribe from this list go to the following URL and read the
>>> >> > instructions:  https://lists.samba.org/mailman/options/samba
>>> >> >
>>> >>
>>> >>
>>> >>
>>> >> --
>>> >> "If we knew what it was we were doing, it would not be called
>>> research,
>>> >> would it?"
>>> >>       - Albert Einstein
>>> >> --
>>> >> To unsubscribe from this list go to the following URL and read the
>>> >> instructions:  https://lists.samba.org/mailman/options/samba
>>> >>
>>> >
>>> >
>>>
>>>
>>> --
>>> "If we knew what it was we were doing, it would not be called research,
>>> would it?"
>>>       - Albert Einstein
>>> --
>>> To unsubscribe from this list go to the following URL and read the
>>> instructions:  https://lists.samba.org/mailman/options/samba
>>>
>>
>>
>


More information about the samba mailing list