Hi, I'm implementing a Samba service on Solaris (the native CIFS service being unreliable in our environment); all is working well but I have a couple of questions regarding winbind which I can't find answers to in the documentation. I'm using 3.0.37 at the moment, but it wouldn't be a big deal to use a more recent version if necessary. The system will join an existing Windows AD. We have Unix UIDs/GIDs already assigned, so I really need winbind to NOT allocate UIDs on its own, but to use our existing ones. We don't have the option of extending the AD schema to include UIDs; our existing Unix accounts are all in LDAP. What I've done to get round this is to use the ldap backend for winbind, and create the mappings myself. This seems to work perfectly well but I can't believe there's not a means within winbind to use the account username to look up UIDs from an existing range. My questions are therefore: 1. Can I rely on winbind to never delete mappings from its database? I.e. if I've created its backend LDAP database myself, can I be sure that those mappings won't ever need to be recreated? 2. I wonder if the 'idmap alloc' options would actually do what I want, but I can't find a simple explanation of what alloc backends actually do. Am I barking up the wrong tree thinking that an appropriate alloc backend will do what I want? -- Liam Gretton liam.gretton at le.ac.uk HPC Architect http://www.le.ac.uk/its/ IT Services Tel: +44 (0)116 2522254 University Of Leicester, University Road Leicestershire LE1 7RH, United Kingdom
On 02/04/10 04:07, Liam Gretton wrote:> Hi, > > I'm implementing a Samba service on Solaris (the native CIFS service > being unreliable in our environment); all is working well but I have a > couple of questions regarding winbind which I can't find answers to in > the documentation. I'm using 3.0.37 at the moment, but it wouldn't be > a big deal to use a more recent version if necessary. > > The system will join an existing Windows AD. > > We have Unix UIDs/GIDs already assigned, so I really need winbind to > NOT allocate UIDs on its own, but to use our existing ones. We don't > have the option of extending the AD schema to include UIDs; our > existing Unix accounts are all in LDAP. > > What I've done to get round this is to use the ldap backend for > winbind, and create the mappings myself. This seems to work perfectly > well but I can't believe there's not a means within winbind to use the > account username to look up UIDs from an existing range. > > My questions are therefore: > > 1. Can I rely on winbind to never delete mappings from its database? > I.e. if I've created its backend LDAP database myself, can I be sure > that those mappings won't ever need to be recreated? > > 2. I wonder if the 'idmap alloc' options would actually do what I > want, but I can't find a simple explanation of what alloc backends > actually do. Am I barking up the wrong tree thinking that an > appropriate alloc backend will do what I want? >It looks like from the Samba how to documentation that you might want to use the RID backend- which would use the Active Directory to store the IDMAP info instead of a standalone LDAP server. It doesn't actually say that you HAVE to use the RID backend. I don't think you need to extend the AD schema. I have an MS Active Directory Server (for MS Exchange support) which is completely separate from the samba-based domain. If I use an ldap tool to export a use to an LDIF file I see the following allowedAttributes: uidNumber allowedAttributes: uid allowedAttributes: gidNumber Also, MS Services for Unix uses relies on unix attributes - I don't think it has to expand the schema when installed. But if you install it it may give you the option to tweak the uid. (I have been thinking about trying to move my LDAP functionality from a standalone Sun LDAP Directory Server to the Active Directory "LDAP" server to better consolidate directories.) I would want to point out that under Sun's Samba 3.0.3x release I have had a lot of problems with domain trusts with a Windows 2003 server (mixed mode) and the idmapping cache- even with idmapping in LDAP. The PDC and one BDC are running 3.0.3x. I have a 2nd BDC running Samba 3.4.x (compiled from source) which seems to handle this a lot better. Compiling Samba from source is a bit of a pain as well. The Samba build from sunfreeware is pretty good but it doesn't include the nss_windind.so file and I think zfs isn't properly supported. Form the opensolaris forums it looks like sun is hoping to release Samba 3.4.x in the near future.
I guess I'll stick with the method I'm currently using then. Can anyone answer my original questions below, or would I be better off asking in samba-technical? 1. Is winbind guaranteed to never delete mappings from its database, only to add new ones? 2. Is 'idmap alloc' documented anywhere? I can't find an explanation of what the alloc options actually do. -- Liam Gretton liam.gretton at le.ac.uk HPC Architect http://www.le.ac.uk/its/ IT Services Tel: +44 (0)116 2522254 University Of Leicester, University Road Leicestershire LE1 7RH, United Kingdom