[Samba] force user gives access denied unless SAM entry?

[Rowland Penny]

On Tue, 2021-11-16 at 13:56 -0800, Kip Kennedy via samba wrote:
> > The user must be authenticated before it gets anywhere near the
> > share
> > and with your setup if the user is authenticated and is allowed
> > read/write access to the share everything will be saved as your
> > 'forced
> > user'
> > However, 'bob' will never be allowed access by Samba (not unless
> > guest
> > access is set up correctly) because Samba hasn't got a clue who
> > 'bob'
> > is.
> 
> Sorry if it wasn't clear, I am authenticating and connecting fine as 
> 'alice'. I can then change directories and list files without error 
> (file system reading as 'bob'). Only when I try and write do I
> receive 
> an Access Denied (file system writing as 'bob').
> 
> Why should 'bob' need Samba authentication? As I read it, force user
> is 
> used only for Linux file permissions. Shouldn't 'bob' need only exist
> as 
> a local Linux account?
> 
> The log is showing an error about a SID / SAM lookup for 'bob'.
> Unless 
> force user is also attempting to force SID mappings shouldn't the 
> connected 'alice' be used for those SID lookups, not 'bob'? If I add 
> 'bob' to the SAM - even as a disabled account - the write will
> succeed.

I think it might help if you post the smb.conf from your standalone
server.

If 'bob' is unknown to Samba, then the user 'bob' cannot connect to the
share via Samba (unless 'map to guest = bad user' is set in [global]
and 'guest ok = yes' or 'public = yes' is set in the share.

The user must be authenticated by Samba (either as a Samba user, or by
being a 'guest' user as described above. All of this authentication
happens before the connecting user is allowed near the share.

If you read 'man smb.conf', under 'force user', it says this:

This user name only gets used once a connection is established.
Thus clients still need to connect as a valid user and supply a valid
password.

Rowland