samba - Mar 2023 - Fwd: samba-gpupdate nsswitch error

Op 14-03-2023 om 10:18 schreef Rowland Penny via samba:
>
>
> On 14/03/2023 08:37, Dr. Nicola Mingotti wrote:
>>
>>
>> On 3/13/23 18:29, David Mulder via samba wrote:
>>>
>>> On 3/13/23 11:24 AM, Rowland Penny via samba wrote:
>>>> Possibly, but it is there and numerous users have asked about
it.
>>>> What you appear to be saying is that there are two problems,
the
>>>> python code which you are trying to fix and that message being 
>>>> printed because it is a Computer trying to get a uid.
>>>>
>>> nm, I just re-read Peter's analysis in bug 15225. These clearly
are
>>> the same issue. So the code I'm working on should resolve both 
>>> messages.
>>>
>>
>> @David, ok will do the upgrade when ready.
>>
>> @Rowland, the "RID" 1600 is the domain controller DC1, i see
from:
>> ---
>> $> wbinfo -R 1600
>> Domain: WINDOM
>> ???? 1600: DC1$ (SID_USER)
>> ---
>>
>
> So, it is (yet again) a computer trying to get a uid, which as I said 
> is possible, because computers are users, but not normally to Linux.
>
> I don't use GPO's, so I don't know how the GPO code identifies 
> computers, but if a uid is required, then it looks like most of the 
> idmap backends will have to be rewritten.
>
> If the uid isn't required, then something should be done to stop that 
> annoying error message, which David has said is a likely outcome of 
> his new GPO code, so we will just have to await that.
I guess the uid is required because a GPO is a file (and something in 
LDAP). The file is retrieved form the sysvol share and in order to deal 
with file permissions on Linux you get identified on the filesytem 
withself with a uid (and gid). In this case it is the computer-account 
that retrieves the file, at least that is my assumption :-)

- Kees.
>
>
> Rowland
>
>

Am 14.03.23 um 10:31 schrieb Kees van Vloten via samba:
> I guess the uid is required because a GPO is a file (and something in 
> LDAP). The file is retrieved form the sysvol share and in order to deal 
> with file permissions on Linux you get identified on the filesytem 
> withself with a uid (and gid). In this case it is the computer-account 
> that retrieves the file, at least that is my assumption ?

That is correct. However, GPOs are normally on a DC and there a computer 
has a uid (or xid or whatever it is called). That why a DC does this 
differently.


Regards

Christian

On 14/03/2023 09:31, Kees van Vloten via samba wrote:
> I guess the uid is required because a GPO is a file (and something in 
> LDAP). The file is retrieved form the sysvol share and in order to deal 
> with file permissions on Linux you get identified on the filesytem 
> withself with a uid (and gid). In this case it is the computer-account 
> that retrieves the file, at least that is my assumption :-)
> 
You could well be right, I wouldn't know, I do not use GPO's.

However, your post led me to trying something, I used getent to try and 
get a Unix ID for a computer. I use the 'rid' idmap backend and on Unix 
domain member, I get this:

rowland at devstation:~$ getent passwd devstation$
devstation$:*:11103:10513::/home/devstation_:/bin/bash

rowland at devstation:~$ getent group devstation$
devstation$:x:11103:devstation$

But when I try with the SID:

rowland at devstation:~$ getent passwd 
S-1-5-21-627072207-2265849604-124128874-1103
rowland at devstation:~$

Nothing, which I can understand, because getent works with names and 
ID's and probably has no concept of Windows SID's.

Rowland