samba - Feb 2019 - winbind causing huge timeouts/delays since 4.8

On Sun, 24 Feb 2019 12:20:43 +0100
Ralph Böhme <slow at samba.org> wrote:
> 
> 
> > Am 24.02.2019 um 12:14 schrieb Volker Lendecke via samba
> > <samba at lists.samba.org>:
> > 
> > On Sun, Feb 24, 2019 at 08:16:55AM +0000, Rowland Penny via samba
> > wrote:
> >> Well yes, it could be used for the default domain, but what about
> >> the 'DOMAIN' domain ?
> >> 
> >> From my understanding, the default range is meant for the Well
> >> Known SIDs and anything outside the given domains and there are
> >> less than two hundred Well known SIDs.
> >> 
> >> To be honest, I have never really seen the point to autorid, it
> >> just seems to be the 'rid' backend with a way to set the
range
> >> size.
> >> 
> >> I will stick to recommending using 'tdb' for the
'*' domain and
> >> 'ad' or 'rid' for any other domains.
> > 
> > Autorid is made to combine the efficiency of rid with the ease of
> > configuration of tdb. tdb generates a lot of entries in its
> > database, autorid is very small. For me, if we could, we would make
> > autorid the default these days. But this would break too many
> > existing tdb default setups. Of course, wherever people have SFU
> > maintained in AD, that is clearly preferrable. For everybody else,
> > I think autorid is just a great idea. But that's mostly me :-)
> 
> me too. And is we've just seen idmap_ad has its issues in large
> environments.
> 
> -slow
Seen where ? and how ?

The only real problem that I see is that, from a Samba point of view,
you have to store the next available uidNumber or gidNumber outside of
AD e.g. scribbled on a piece of paper.

Rowland

Am 24.02.2019 um 12:46 schrieb Rowland Penny via samba <samba at
lists.samba.org>:
> Seen where ? and how ?
one problem is that, by design, as a domain member, it makes us behave different
compared to a Windows system. Hic sunt dracones.

Another thing that a customer has just been bitten by, was a subtle bug in
winbindd's idmap cache that resulted in all xid2sid requests going through
the idmap backend, iow winbindd issued LDAP requests. With a few thousand users,
things came to a grinding halt.

https://bugzilla.samba.org/show_bug.cgi?id=13802

Patch just landed upstream.

-slow

On Sun, 24 Feb 2019 15:58:39 +0100
Ralph Böhme <slow at samba.org> wrote:
> Am 24.02.2019 um 12:46 schrieb Rowland Penny via samba
> <samba at lists.samba.org>:
> > Seen where ? and how ?
> 
> one problem is that, by design, as a domain member, it makes us
> behave different compared to a Windows system. Hic sunt dracones.
Why not just say 'here be dragons' instead of using a dead language.

Yes we do behave a bit different from Windows, even more so when we do
stupid things like introducing 'unix_primary_group = yes'.
> 
> Another thing that a customer has just been bitten by, was a subtle
> bug in winbindd's idmap cache that resulted in all xid2sid requests
> going through the idmap backend, iow winbindd issued LDAP requests.
> With a few thousand users, things came to a grinding halt.
> 
> https://bugzilla.samba.org/show_bug.cgi?id=13802
> 
> Patch just landed upstream.
> 
> -slow
That is the bug I was referring to and probably (amongst all the other
cruft) what was causing the OP's problem. However, this has nothing to
do with using the 'ad' backend with Active Directory. We keep dancing
around this problem, saying things like 'we need to fix this', we
have been saying this since Samba 4 was released.

Windows Uses the SID-RID to identify the user and the domain it
comes from, surely we can find a way to do this for Samba, we are
half way there with the 'rid' backend.

Rowland