[Samba] idmap_ad

Gaiseric Vandal gaiseric.vandal at gmail.com
Tue Sep 20 13:00:23 UTC 2016


Thanks for the feedback.

I currently have 3 production domains.
-  MYDOMAIN.COM is a  production Windows 2008 domain used to support MS 
Exchange  (but not file sharing.)
-  TECH  -    Samba3 "classic" domain  with unix domain controllers that 
supports most users for authentication and file sharing.  The DC 
machines are both Samba domains (for Windows clients) and KRB/LDAP 
servers for Linux clients.
- SALES -Small Win 2008 AD domain for a separate group.

I want to eventually  build a  TECH.MYDOMAIN.COM domain as a child 
domain of MYDOMAIN.COM and migrate computers from the "classic" TECH 
domain to the new TECH.MYDOMAIN.COM.      I will  want to preserve user 
ID numbers as much as possible.    Some of the user accounts go back 15 
years in the production TECH domain, when local service accounts didn't 
go over uidNumber 100.     For the moment I am just testing machines in 
the parent domain rather than add too many variables upfront.

" winbind nss info = templater"  was a typo, I did try    "winbind nss 
info = templates"

I fixed nsswitch.conf

I think I had krb.conf set up properly with realm before joining the domain.

                  # cat /etc/krb5.conf
                  default = FILE:/var/log/krb5libs.log
                  kdc = FILE:/var/log/krb5kdc.log
                  admin_server = FILE:/var/log/kadmind.log

                  dns_lookup_realm = false
                  ticket_lifetime = 24h
                  renew_lifetime = 7d
                  forwardable = true
                  rdns = false

                default_realm = MYDOMAIN.COM

                MYDOMAIN.COM = {
                   kdc = pdc.mydomain.com
                   admin_server = pdc.mydomain.com


                mydomain.com = MYDOMAIN.COM
                .mydomain.com = MYDOMAIN.COM

But to be safe I did rejoin domain

            # net ads join -U administrator -S pdc.mydomain.com
            Enter administrator's password:
            Using short domain name -- MYDOMAIN
            Joined 'LINUX1' to dns domain 'mydomain.com'

            # net ads testjoin
            Join is OK

Set a uidNumber of 1000 for one of the user accounts and updated the 
idmap range for MYDOMAIN to be from 100-1999.

Still not luck.

Kinit indicates the machine account does exist

        # kinit linux1
        Password for linux1 at MYDOMAIN.COM:  ^C

Since mapping for the child domain is working it indicates that the 
idmap_tdb back is OK and that the problem may be with idmap_ad ?

        #smbd -b

        --with Options:

        Builtin modules:
            vfs_posixacl auth_sam auth_winbind auth_domain auth_builtin
        vfs_default nss_info_template idmap_tdb idmap_passdb idmap_nss

        Build Options:


I could presumably use idmap_ldap to maintain a consistent mapping 
across machines.    Since file servers serve users from both Windows and 
Unix systems, it is important to make sure that the uidNumbers and 
gidNumbers are consistent across machines and between Unix and Samba.

I am a little hesitant to try recompiling samba because then I am not 
sure if nsswitch is calling the correct winbind files.


On 09/20/16 04:49, Rowland Penny via samba wrote:
> See inline comments:
> On Mon, 19 Sep 2016 17:36:05 -0400
> Gaiseric Vandal via samba <samba at lists.samba.org> wrote:
>> I am trying to configure idmap_ad on a linux member server (fedora
>> core 23, samba 4.3.11) with a Windows 2008 domain controller.    The
>> domain is "MYDOMAIN.COM" with a child domain of
>> "CHILD1.MYDOMAIN.COM."  By default those domains trust each other.
>> The MYDOMAIN PDC  has the unix identity mapping feature installed, so
>> I can use "active directory users and computers" to set unix
>> uidNumbers and gidNumbers (which start at 100.)      I have set
>> uidNumbers for some users but not others.      I have not  up unix
>> identity mapping on the child domain.
> This may be your problem, why are using 100-900 ? standard Unix users
> start at 1000, BUILTIN and anything outside the domain is using
> 2000-9999, so why not use IDs starting at 10000 ???
> Have you also given Domain Users a gidNumber ??
>> The partial smb.conf is
>>           security = ads
>>           workgroup = MYDOMAIN
>>           netbios name = LINUX1
>>           realm = MYDOMAIN.COM
>>          idmap config *:backend = tdb
>>          idmap config *:range = 2000-9999
>>          idmap config MYDOMAIN:backend = ad
>>          idmap config MYDOMAIN:schema_mode = rfc2307
>>          idmap config MYDOMAIN:range = 100-900
>>          winbind nss info = rfc2307
>>            winbind enum users = yes
>>           winbind enum groups = yes
>> I did need to fix a symlink since samba was looking for some
>> libraries in the wrong place
>>       #ln -s /usr/lib64/ldb /usr/lib64/samba/ldb
>> I was able to join the domain
>>       #net ads join -U administrator -S pdc.mydomain.com
>> I set /etc/krb5.conf to point to the domain controllers as the
>> kerberos server (although I don't think this is necessary at this
>> stage.)
> You needed this set up before you joined the domain and it should point
> to the realm.
>> the "wbinfo -u" and "wbinfo -g"  show users from the domain.
>> I updated /etc/nsswitch.conf to include winbind
>>           passwd:     files sss winbind
>>           shadow:     files sss winbind
> I would suggest removing 'sss' if you are not using it, also remove
> 'winbind' from the shadow line and putting it on the group line.
>> (sssd daemon is not enabled.)
>> The "getent passwd" command does NOT show users from MYDOMAIN. The
>> weird thing is that it does show users from the child domain.
> Well, it would, they are getting mapped because they are not in your
> domain.
>> CHILD1\administrator:*:2000:2004:Administrator:/home/CHILD1/administrator:/bin/false
>> CHILD1\guest:*:2001:2005:Guest:/home/CHILD1/guest:/bin/false
>> CHILD1\krbtgt:*:2002:2004:krbtgt:/home/CHILD1/krbtgt:/bin/false
>> CHILD1\bobsmith:*:2003:2004:Bob Smith:/home/CHILD1/bobsmith:/bin/false
>> CHILD1\mydomain$:*:2004:2004:MYDOMAIN$:/home/CHILD1/ssci_:/bin/false
>> I tried the following settings with no luck
>>       winbind nss info = templater
> I take it that is a typo and should have been 'template' and all that
> does (if using the 'ad' backend) is just use uidNumber & gidNumber
> attributes.
>>       idmap config MYDOMAIN:schema_mode = sfu
> If using 'ad' backend, just stick to 'schema_mode = rfc2307'
>>       winbind use default domain = yes
> This just removes the domain name from user & groupnames.
>> The "testparm -v | grep domain" gives the following
>>       allow trusted domains = Yes
>>       map untrusted to domain = No
>>       domain logons = No
>>       domain master = Auto
>>       winbind use default domain = No
>>       winbind trusted domains only = No
>>       winbind max domain connections = 1
>> FYI I do have another linux machine , not running samba, that is
>> configured to use LDAP/Kerberos authentication against the same
>> domain controller so I am pretty use the unix attributes are set up
>> correctly.
>> Appreciate any help.
> It might well do, but winbind works differently, see here for more info:
> https://wiki.samba.org/index.php/Setup_Samba_as_an_AD_Domain_Member
> Rowland

More information about the samba mailing list