[Samba] SID history secondary group set bloat

[Weiser, Michael]

Hi slow,

> ah, now I get it. :)

Thanks for bearing with me. :)

> No, that's not supported, but it might be possible to add such a feature
> with some development effort.

Okay, I thought as much. I was already thinking of a generic SID filter config option that could be used to tell the ID mapping layer to ignore all SIDs starting with a particular domain SID, similar to winbind:ignore domains:

winbind:ignore domain sids = S-1-5-21-2623811102-3361044346-30300840 S-1-5-21-1623811102-3361044346-30300840
(or extending winbind:ignore domains to accept SIDs if the net outcome would be the same anyway)

or

idmap config S-1-5-21-2623811102-3361044346-30300840 : ignore = true
idmap config S-1-5-21-1623811102-3361044346-30300840 : ignore = true

Would that make sense and be feasible? Or where would you put it?

Getting back to my problematic idmap_nss setup: How bad, workaround-wise, is my idea to prefill winbind_idmap.tdb with mappings for the SID history SIDs all pointing to the same gid like so:

[root at fedora33 ~]# tdbtool /var/lib/samba/winbindd_idmap.tdb
tdb> delete S-1-5-21-1623811102-3361044346-30300840-72199\00
tdb> delete GID\20100006\00
tdb> store S-1-5-21-1623811102-3361044346-30300840-72199\00 GID\20100007\00
tdb>
[root at fedora33 ~]# net cache flush

Thanks,
--
Michael Weiser
Senior Solutions Architect
T +49 30 2007 697 22
science + computing ag
Am Studio 16
D-12489 Berlin
https://atos.net/de/deutschland/sc

________________________________________
From: Ralph Boehme <slow at samba.org>
Sent: 10 June 2021 09:32:56
To: Weiser, Michael
Cc: Laubender, Guido; samba at lists.samba.org
Subject: Re: [Samba] SID history secondary group set bloat

Am 10.06.21 um 08:27 schrieb Weiser, Michael:
> My question remains if there's a way to prevent SID history SIDs from
> being mapped once they're no longer needed on a particular samba
> server, to prevent unnecessary bloating of the secondary group list,
> i.e. if there's a way to tell autorid (or nss) to recognize that
> 472199(EXAMPLE\secret), 572198(EXAMPLE\secret) and
> 301141(EXAMPLE\secret) are all the same group and only add gid 301141
> to the UNIX token.

ah, now I get it. :)

No, that's not supported, but it might be possible to add such a feature
with some development effort.

Cheers!
-slow

--
Ralph Boehme, Samba Team                https://samba.org/
Samba Developer, SerNet GmbH   https://sernet.de/en/samba/
GPG-Fingerprint   FAE2C6088A24252051C559E4AA1E9B7126399E46