samba - Nov 2017 - Samba AD and NIS integration

I have questions regarding the operation of AD and integrating NIS or LDAP with
it.
I have a small heterogenous network consisting of various computing devices
running either Windows 10 pro or a flavour of Linux. I am setting up a NAS box
running Debian Stretch and Samba 4.5.12 to be the central file server and
authenticator for the network, including LDAP aware software such as owncloud. I
have carefully followed the samba.org instructions for setting up the AD
including rfc2307 data, except for ignoring the recommendation regarding not
running AD and file services from the same box - I cannot afford two boxes for
the job and I believe I can live with the limitations if one.
Can someone please help with these questions:
1. What are the id ranges that the AD uses / expects for uidNumber and
gidNumber? Is there any working way of controlling those ranges, given idmap
breaks stuff? Winbind only seems to respond to id queries if the numbers are
created in the correct range, but I cannot find what the exact ranges are.
2. Is there a way of making NIS use Samba AD as the central repo for user
credentials? I would like to support NIS/NFS clients if possible. I am open to
using LDAP/NFS instead.
3. Can someone please point me at a good guide for configuring a server so that
Samba AD's LDAP can support LDAP authentication requests from other systems
too?
The key point is I would like Samba to be 'king of the castle' here -
for it to store and maintain the authoritative login credentials across all my
systems.
Thanks
Stephen

-- 
Sent from my Android device with K-9 Mail. Please excuse my brevity.

On Wed, 15 Nov 2017 22:22:38 +0000
Stephen Parry via samba <samba at lists.samba.org> wrote:
> I have questions regarding the operation of AD and integrating NIS or
> LDAP with it. I have a small heterogenous network consisting of
> various computing devices running either Windows 10 pro or a flavour
> of Linux. I am setting up a NAS box running Debian Stretch and Samba
> 4.5.12 to be the central file server and authenticator for the
> network, including LDAP aware software such as owncloud. I have
> carefully followed the samba.org instructions for setting up the AD
> including rfc2307 data, except for ignoring the recommendation
> regarding not running AD and file services from the same box - I
> cannot afford two boxes for the job and I believe I can live with the
> limitations if one. Can someone please help with these questions: 
>1. What are the id ranges that the AD uses / expects for uidNumber and
> gidNumber? 
The id ranges are what you choose, reading this may help:

https://wiki.samba.org/index.php/Setting_up_Samba_as_a_Domain_Member#Setting_up_a_Basic_smb.conf_File
>Is there any working way of controlling those ranges,
> given idmap breaks stuff? 
What do you mean 'idmap breaks things' ?
>Winbind only seems to respond to id queries
> if the numbers are created in the correct range, but I cannot find
> what the exact ranges are.
Winbind only uses the ranges you set in smb.conf, but then the users
and groups must have uidNumber or gidNumber attributes containing
numbers inside the 'DOMAIN' range.

> 2. Is there a way of making NIS use Samba
> AD as the central repo for user credentials? 
If you mean make the Unix OS know who the AD users and groups are, then
yes.
>I would like to support
> NIS/NFS clients if possible. I am open to using LDAP/NFS instead. 
I think you mean Unix/NFS clients and yes this is very doable  
>3. Can someone please point me at a good guide for configuring a server
> so that Samba AD's LDAP can support LDAP authentication requests from
> other systems too? The key point is I would like Samba to be 'king of
> the castle' here - for it to store and maintain the authoritative
> login credentials across all my systems. Thanks Stephen
> 
Try reading the Samba wiki:

https://wiki.samba.org/index.php/Main_Page

Rowland