[Samba] idmaps, again

[Rowland Penny]

On Fri, 22 Mar 2019 10:38:26 +0100
"Stefan G. Weichinger via samba" <samba at lists.samba.org> wrote:

> Am 21.03.19 um 22:42 schrieb Rowland Penny via samba:
> > On Thu, 21 Mar 2019 22:34:02 +0100
> > "Stefan G. Weichinger via samba" <samba at lists.samba.org> wrote:
> >   
> >> Am 21.03.19 um 19:54 schrieb Rowland Penny via samba:
> >>  
> >>> This is one of the decisions you have to make, do you want to have
> >>> the same ID's everywhere, or just on Unix domain members ?     
> >>
> >> We only have one Unix domain member aside from the DCs and that is
> >> the samba file server.
> >>  
> >>> Do you want to
> >>> set different login shells and/or different home directories ?    
> >>
> >> nope
> >>
> >> the AD users don't do ssh or bash or so ... "only" file access and
> >> stuff like login/logout and GPOs etc
> >>
> >> (only I and the main admin there use ssh to the servers ...)  
> > 
> > Then you don't really need to be using the 'ad' backend.
> >   
> >>  
> >>> If you want the same ID's everywhere and the ability to set
> >>> different login shells/homedirectories for your users, then you
> >>> must use the 'ad' backend, this does involve adding uidNumber
> >>> attributes to the user objects. This is what the Unix Attributes
> >>> tab used to do.
> >>>
> >>> If none of the above applies, then you can use the 'rid' backend,
> >>> this will give you the same ID's on all Unix domain members, but
> >>> all users that connect to the computer will get the same login
> >>> shell and homedirectory, you also will not have to add anything to
> >>> AD.    
> >>
> >> And is it possible to change the backend from ad to rid with
> >> reasonable effort?  
> > 
> > Yes and then again no ;-)
> > 
> > Yes, it is easy to change from 'ad' to 'rid', but you would also
> > have to change the file ownerships as well.  
> 
> ok, but that doesn't sound too bad: rather generic permissions there,
> we could solve that with some chmod-runs, I assume.
> 
> They basically use one fat share and have rather simple ACLs in place.

It only really gets complicated if you have multiple shares and lots of
users.

> 
> Is there a specific procedure to follow for this change or is it
> simply editing smb.conf on the DM, restart, and editing the
> permissions?

Yes, that is basically it, the only thing I would add is to run 'net
cache flush' after restarting Samba.

> 
> Would the users itself need some editing as well (inside LDAP/AD)?

This is really up to you, you could, if you so wish, remove all the
rfc2307 attributes from AD, or you could just ignore them.

Rowland