Hi all, this is a re-post, maybe the Samba Team can help ?
I'm testing group mapping, wondering how It works exactly...
I thought Samba was storing a mapping table allowing to retreive infos on
Unix/Windows groups in a DYNAMIC way. Unfortunately, group mapping seems to
be static, here is what I did :
[I'm using Samba b3v3 + LDAP, WITHOUT nss-ldap/pam-ldap/winbind ->
everything is stored in my /etc/passwd and /etc/group + in LDAP for Samba
accounts]
1) Created Unix group (let's say domusers) : groupadd domusers
2) Created LDAP group, with ldapadd, and a file containing :
dn: cn=domusers,ou=Users,dc=domain,dc=org
objectClass: posixGroup
gidNumber: 1001
cn: domusers
memberUid: foo
3) Created Unix user (foo, primary group domusers) : useradd -g domusers
foo
4) Created Group mapping : net groupmap add sid=<mySID>-513
unixgroup=domusers ntgroup="Domain Users" type=domain (then "net
groupmap
list", OK)
5) Finally, created LDAP (samba) user : smbpasswd -a foo
Ok, no problem, foo gets the domain local sid + the domain users rid as
SambaPrimaryGroupSid, he IS a Win Domain User.
Here is what I don't understand : If I delete the groupmapping or modify
it, the SambaPrimaryGroupSid of foo isn't modified ! Foo remains a Domain
User...
Another example : if I create first the user, then the mapping : the user
doens't get the new SambaPrimaryGroupSid and doesn't become a Domain
User...
Am I missing something ? Is the mapping only used while creating users ? I
thought the table was used in a more dynamic way... Is there a technical
limit in implementing this function this way ? Please help me...
Regards,
Gana?l.
