[Samba] Winbind group mapping

[Rowland penny]

On 04/09/2019 12:49, Sören Busse via samba wrote:
> Hey there,
>
> currently I'm trying to map my users and groups using winbind on a 
> samba fileserver member server which is connected to a samba DC. Both 
> are running version 4.10.0 from the 19.04 ubuntu repository.
>
> Here's my samba member servers smb.conf:
>
> [global]
> security = ADS
> workgroup = SAMDOM
> realm = SAMDOM.DOMAIN:TLD
> log file = /var/log/samba/%m.log
> log level = 1
> server min protocol = SMB2
> bind interfaces only = yes
> interfaces = lo 10.42.6.2
> idmap config * : backend = tdb
> idmap config * : range = 3000-7999
> idmap config SCHULE : backend = ad
> idmap config SCHULE : range = 100000-999999
> idmap config SCHULE : schema_mode = rfc2307
> idmap config SCHULE : unix_nss_info = no
> idmap config SCHULE : unix_primary_group = yes
> template shell = /bin/bash
> template homedir = /home/%U
> username map = /etc/samba/user.map
>
> [Share]
> comment = Share
> path = /share/Share
> read only = no
> store dos attributes = no
> create mask = 0660
> force create mode = 0660
> directory mask = 0770
> force directory mode = 0770
>
> I would like to match the normal Linux user and group behavior as much 
> as possible. 

Why ?

You are joining what is to all intents and purposes a Windows AD, so you 
really need to do things in a Windows way.

> Normally when creating a user you would create a group with the same 
> name and same id as the user,
Only on a Unix machine.
> which will result in an "id"-command output like this:
> uid=1000(soeren) gid=1000(soeren) Gruppen=1000(soeren)
>
> When I now add a user to my domain and set the uid and gid to the same 
> value e.g 100 000 without creating a seperate group with the gid 100 
> 000 the "id"-command output would looks like this:
> uid=100000(soeren) gid=100000 Gruppen=100000
> So the ids are mapped correctly, but the gid is missing the name. This 
> is reasonable because winbind is looking for a group with the id 100 
> 000 but can't find any so the name can't be set.

You are using the winbind 'ad' backend, so have you added a unique 
uidNumber attribute to your users and a gidNumber attribute to Domain 
Users ?

If you have, you should get results like these:

getent passwd SAMDOM\\rowland
rowland:*:10000:10000:Rowland Penny:/home/rowland:/bin/bash

getent group SAMDOM\\Domain\ Users
domain users:x:10000:

There appears to be problems with the 'unix_primary_group = yes' 
parameter, it doesn't work everywhere.

>
> The solution would be to simply create a group with the id 100 000. 
> However you can't have the group to use the same sAMAccountname as the 
> user, because it's only allowed to exists once. So I have to choose a 
> different group name with a well-known prefix like "group_soeren" for 
> any user groups (As far as I know the sAMAccountname of the group is 
> allowed to be longer than 20 characters, isn't it? This would allow to 
> set a prefix altough the username might already be 20 characters long)

Do you really need a personal group for every user ?

Also, for backwards capability, sAMAccountname is limited to 20 characters.

We, here in England, have a saying 'When in Rome, do as the Romans do', 
this could be rewritten as 'When in Windows AD, do as Windows does' ;-)

Rowland