samba - Sep 2019 - How to Change UIDs

Rowland,
I must be missing something here.  Why can't the OP set the UID in ADUC to
match that required in the other system?  The Samba
Domain member can use the ad backend, (rather than the rid), and no doubt file
permissions will have to be readjusted accordingly,
but at least the UID's will match the other system.   The Windows DC
doesn't care about the RFC2307 attributes, so that shouldn't be
affected.

Roy
> -----Original Message-----
> From: samba [mailto:samba-bounces at lists.samba.org] On Behalf Of Rowland
penny via samba
> Sent: 05 September 2019 17:18
> To: sambalist
> Subject: Re: [Samba] How to Change UIDs
> 
> On 05/09/2019 15:47, Tyrus Shivers wrote:
> > Understood.
> >
> > Just to confirm there is no way to change the UID of users or manually
> > assign them? When I do id "user", I get just a UID and
several group
> > IDs, I do not get anything that starts with a S. I do understand the
> > SID from Windows is tied somehow to the UID
> The winbind 'rid' backend takes the SID, removes the RID and
calculates
> the 'UID' from this, it will be a unique number because all RIDs
are unique.
> >
> > I cannot setup a trust on my end. The remote share is managed by a
> > different set of admins, their only option for me to connect is to
> > have the UIDs that match their database of UIDs. It is a closed
> > network and the UIDs they have for users is tied to a different
> > authentication resource than our network.
> 
> Then you are at an impasse
> 
> Rowland
> 
> 
> 
> --
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba

On 05/09/2019 22:45, Roy Eastwood wrote:
> Rowland,
> I must be missing something here.  Why can't the OP set the UID in ADUC
to match that required in the other system?  The Samba
> Domain member can use the ad backend, (rather than the rid), and no doubt
file permissions will have to be readjusted accordingly,
> but at least the UID's will match the other system.   The Windows DC
doesn't care about the RFC2307 attributes, so that shouldn't be
> affected.
>
It all depends on your definition of 'UID' ;-)

The OP is using the winbind 'rid' backend and as such, is unlikely to 
have uidNumber & gidNumber attributes in AD. He also hasn't told us just
what he is trying to connect to.

Just changing what 'id' or 'getent'? produces is unlikely to be
enough
if he is trying to connect from one AD domain to another e.g. changing a 
user in the 'SAMDOM' domains UID from 1234 to 4321 would still make the 
user a member of the 'SAMDOM' domain, but it would make the user a new
user.

What I also cannot understand why he cannot sort this out himself, try 
going to 'www.bestgateeng.com'

Rowland

On Fri, Sep 6, 2019 at 2:55 AM Rowland penny via samba <
samba at lists.samba.org> wrote:
> On 05/09/2019 22:45, Roy Eastwood wrote:
> > Rowland,
> > I must be missing something here.  Why can't the OP set the UID in
ADUC
> to match that required in the other system?  The Samba
> > Domain member can use the ad backend, (rather than the rid), and no
> doubt file permissions will have to be readjusted accordingly,
> > but at least the UID's will match the other system.   The Windows
DC
> doesn't care about the RFC2307 attributes, so that shouldn't be
> > affected.
> >
> It all depends on your definition of 'UID' ;-)
>
> The OP is using the winbind 'rid' backend and as such, is unlikely
to
> have uidNumber & gidNumber attributes in AD. He also hasn't told us
just
> what he is trying to connect to.
>
I am trying to connect to a shared drive ( I believe it is Windows based)
on another Domain which we have access to (created by their admins) which
has different UID for our users that match their authenticating source.
Since all of these networks are closed, I am limited to what I can do in
terms of just opening them up for access, etc.  Our linux vm's cannot mount
that share because we do not have permissions and that is because the UID
is different.
>
> Just changing what 'id' or 'getent'  produces is unlikely
to be enough
> if he is trying to connect from one AD domain to another e.g. changing a
> user in the 'SAMDOM' domains UID from 1234 to 4321 would still make
the
> user a member of the 'SAMDOM' domain, but it would make the user a
new
> user.
>
I did make attempts at the previously and you are correct it does not work
properly.
>
> What I also cannot understand why he cannot sort this out himself, try
> going to 'www.bestgateeng.com'
>
I am not sure what you mean or are referring to by that statement. This
system was passed off to me, I have no access to the previous admins or
documentation on how and why everything is setup the way it is. After
exhausting what I know I came here to ask a question to see if I perhaps
missed something.
>
> Rowland
>
>
> --
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba
>

-- 
V/R
Tyrus Shivers
Bestgate Engineering LLC
Direct: (410) 872-2457
tyrus.shivers at bestgateeng.com

<tyrus.shivers at bestgateeng.com>
This e-mail transmission and any documents, files or previous e-mail
messages attached to it, may be privileged and confidential and is intended
only for the use of the intended recipient of this message.  If you are not
the intended recipient, or a person responsible for delivering it to the
intended recipient, you are hereby notified that any review, disclosure,
retention, copying, dissemination, distribution or use of any of the
information contained in, or attached to this e-mail transmission is
strictly prohibited.  If you have received this transmission in error,
please immediately notify the sender by return e-mail or by telephone at
the above number and delete this e-mail message and its attachments.