samba - Mar 2022 - Problem with AD & idmap

On 02/03/2022 15:53, Rowland Penny via samba wrote:
> On Wed, 2022-03-02 at 15:35 +0100, Lars Schimmer via samba wrote:
>>
>>
>>   ids                      : *
>>                   ids: struct wbint_TransIDArray
>>                       num_ids                  : 0x00000001 (1)
>>                       ids: ARRAY(1)
>>                           ids: struct wbint_TransID
>>                               type_hint                : ID_TYPE_BOTH
>> (3)
>>                               domain_index             : 0x00000000
>> (0)
>>                               rid                      : 0x00000614
>> (1556)
>>                               xid: struct unixid
>>                                   id                       :
>> 0xffffffff
>> (4294967295)
>>                                   type                     :
>> ID_TYPE_NOT_SPECIFIED (0)
>>
>> [2022/03/02 15:24:18.165081, 10, pid=1448, effective(0, 0), real(0,
>> 0),
>> class=winbind]
>> ../../source3/winbindd/idmap_ad.c:953(idmap_ad_sids_to_unixids)
>>   idmap_ad_sids_to_unixids: No xid in
>> CN=Tobias,DC=cgv,DC=tugraz,DC=at
> 
> That is just a debug message from a for loop, it is telling you that no
> 'xid' was found. I then goes onto the next user.
Yeah, but why? Isn't the rix needed?
> Have you tried running 'net cache flush' ?
yeah, each time I did a change to the smb.conf, I did restart smb,
winbind and net cache flush.
Also did reboot several times. The result is always the same.
With RID backend I get the users, with ad backend not.

> Rowland
> 
> 
> 

MfG,
Lars Schimmer
-- 
-------------------------------------------------------------
TU Graz, Institut f?r ComputerGraphik & WissensVisualisierung
Tel: +43 316 873-5405       E-Mail: l.schimmer at cgv.tugraz.at
Fax: +43 316 873-5402       PGP-Key-ID: 0x4A9B1723

On Wed, 2022-03-02 at 15:59 +0100, Lars Schimmer via samba
wrote:
> 
> 
> Yeah, but why? Isn't the rix needed?
There are uidNumber, gidNumber and xidNumber attributes. the xidNumber
attributes are only found and used on a Samba AD DC. I am not really
into 'C' , but it looks to me that the relevant code is run on all
Samba machines, so you get the debug message on a Unix domain member if
the debug level is turned up to high.
> 
> > Have you tried running 'net cache flush' ?
> 
> yeah, each time I did a change to the smb.conf, I did restart smb,
> winbind and net cache flush.
> Also did reboot several times. The result is always the same.
> With RID backend I get the users, with ad backend not.
Have you actually looked in AD, does Domain Users have a gidNumber
attribute ? Do your users have the primaryGroupID attribute set to
'513' ? Do the relevant users have a uidNumber attribute ?

The fact that the 'rid' idmap backend works, shows that Samba is
working. When you change to the 'ad' backend and it doesn't work,
usually means that there is something wrong with the uidNumber &
gidNumber attributes in AD.
Try running 'testparm -s', this may show errors.

Rowland