samba - May 2002 - WinBind does not work well with Rational ClearCase (bugfix atta ched :)

Andrew,

Thank you for your suggestions.

The real problem is Rational Technical support.  When you pay someone 100k+ 
they tend to look for any excuse to deem you "unsupported".  If you
don't have
your default group set to the clearcase user group, then technical support 
will decide that thats where your problem is!  I am sure you know how that 
goes...

I have solved problems like this in the past with the group sticky bit.  I 
agree this is the "correct" way to do this.  The only trouble with
ClearCase
is they use a kernel patch to enable some kind of custom modified file system. 
 I suspect it just will not work without the default group set :(

Go figure, we get the best and most responsive help from the part we paid 
nothing for.

-Stephen
>Andrew Bartlett said:
>Gerald Carter wrote:
>> 
>> On Wed, 15 May 2002, Jazdzewski, StephenX A wrote:
>> 
>> > Hello Samba,
>> >
>> > We tried to use samba-2.2.4-1 with Rational ClearCase and had a
problem
>> > using WinBind.
>> >
>> > ClearCase requires the primary group id to be set to the clearcase
users
>> > group.  WinBind sets the primary group to something like
>> > DOMAIN_GROUP_RID_USERS.
>> 
>> Winbind set's the primary group to whatever is specified by the
PDC.
>> Why should we override it?  I think I understand what your problem is
>> but I'm not convinvced that this patch should be applied to the
main
>> tree.
>
>I wonder if this problem would be better solved with appropriate use of
>the group sticky bit (chmod g+s) on the directory?
>
>Other than that, we sometimes play a bit 'fast and loose' with NT4
>groups, due to the way we have to reterive them.  This means that we set
>the primary group to 'domain users' for 'getent' bulk
requests.  I'm not
>sure what we are currently doing for other lookups.
>
>Andrew Bartlett
>
>-- 
>Andrew Bartlett                                 abartlet@pcug.org.au
>Manager, Authentication Subsystems, Samba Team  abartlet@samba.org
>Student Network Administrator, Hawker College   abartlet@hawkerc.net
>http://samba.org     http://build.samba.org     http://hawkerc.net

On Sat, 18 May 2002, Stephen Jazdzewski wrote:
> The real problem is Rational Technical support.  When you pay someone 100k+
> they tend to look for any excuse to deem you "unsupported".  If
you don't have
> your default group set to the clearcase user group, then technical support 
> will decide that thats where your problem is!  I am sure you know how that 
> goes...
> 
You are accessing clearcase on UNIX right?  Not through Samba.
You need winbindd so that Windows domain users can have a UNIX account
and access the respoitory on the UNIX server.  Right?

Is anyone else having this same problem?




jerry
 ---------------------------------------------------------------------
 Hewlett-Packard                                     http://www.hp.com
 SAMBA Team                                       http://www.samba.org
 --                                            http://www.plainjoe.org
 "Sam's Teach Yourself Samba in 24 Hours" 2ed.      ISBN
0-672-32269-2
 --"I never saved anything for the swim back." Ethan Hawk in Gattaca--

>You are accessing clearcase on UNIX right?
Yes we will be.  But not right now.  Since ClearCase will not support Unix 
clients from a Windows VOB server, we started with a Linux Server even though 
our first clients are all windows.
>Not through Samba.
No, we are using Samba in addition to WinBind.  I am fuzzy on why ClearCase 
needs Samba in addition to it's own stuff.  I think that is how the Windows 
View Server talks to the Unix VOB Server.
>You need winbindd so that Windows domain users can have a UNIX account
>and access the respoitory on the UNIX server.  Right?
Yes that is correct.

Most sites can control the primary windows group users get for any Domain.  We 
can add users to a clearcase group, but can't make it the user's primary
group.  clearcase has a patch to get around it under Windows.  They use a 
special environment variable.

I limited the "winbind primary group" so it would only set the primary
group
if the user is actually a member of the group in the first place.  But this 
can be overridden with the "winbind force primary".  The primary group
value
is a RID and *not* a Unix GID.

I suspect if I use Andrew's suggestion and set g+s on the directories it may
work, and this has worked for me in the past when using NFS & NIS+.  But one
of the first questions on the pre-techsupport droid's check list is
"type 'id'
and read me your default user group...".

This default group thing has *never* been a problem for me under Unix.

Once I applied the patch, clearcase started working like a charm.

-Stephen