samba - Jul 2002 - Precedence of usernames w/Winbind

I might be missing obvious here, but here goes:

Samba 2.2.4.

Using "winbind use default domain = <DOMAIN>" option usernames
map
correctly, however, when logging on from an W2K machine I still get
the autogenerated UID instead of my NIS (Or /etc/passwd) UID.

Both nis and files precede winbind in /etc/nsswitch.conf

Commenting out winbind from /etc/nsswitch.conf works, which means
there isn't some magic piece of code that communicates with winbind
directly.

If so - how come I get assigned my winbind UID and not my /etc/passwd
UID? What exactly am I missing?

I was under the impression that all Samba does with lookups is a
getpw* and doesn't muck about. Running getent passwd put my NIS UID 
_before_ the winbind UID. Shouldn't that mean that I would be assigned
my normal UID before it turns to the autogenerated one?

Thanks!
Nir.

--
Nir Soffer -=- Software Engineer, Exanet Inc. -=-
"Father, why are all the children weeping? / They are merely crying son
 O, are they merely crying, father? / Yes, true weeping is yet to come"
        -- Nick Cave and the Bad Seeds, The Weeping Song

Nir Soffer wrote:
> 
> I might be missing obvious here, but here goes:
> 
> Samba 2.2.4.
> 
> Using "winbind use default domain = <DOMAIN>" option
usernames map
> correctly, however, when logging on from an W2K machine I still get
> the autogenerated UID instead of my NIS (Or /etc/passwd) UID.
Two points:

Why are you running winbind?  It seems you really just want
'security=domain', and don't need winbindd.

Secondly.  'winbind use sdefault domain =' is *NOT SUPPORTED* in 2.2. 
The option exists only becouse of a merge from HEAD, where we completed
implementation.  The 2.2 code has *known flaws* with this option in
effect.
> Both nis and files precede winbind in /etc/nsswitch.conf
> 
> Commenting out winbind from /etc/nsswitch.conf works, which means
> there isn't some magic piece of code that communicates with winbind
> directly.
> 
> If so - how come I get assigned my winbind UID and not my /etc/passwd
> UID? What exactly am I missing?
It does a lookup of 'domain\username' actually, and gets the UID from
there.
> I was under the impression that all Samba does with lookups is a
> getpw* and doesn't muck about. Running getent passwd put my NIS UID
> _before_ the winbind UID. Shouldn't that mean that I would be assigned
> my normal UID before it turns to the autogenerated one?
Samba incresinly does all sorts of things...  Using getpw*() lookups
sometimes is not appropriate, or (as in this case) is simply done in a
way you might not quite expect.

Andrew Bartlett

-- 
Andrew Bartlett                                 abartlet@pcug.org.au
Manager, Authentication Subsystems, Samba Team  abartlet@samba.org
Student Network Administrator, Hawker College   abartlet@hawkerc.net
samba.org     build.samba.org     hawkerc.net

> 
> Nir Soffer wrote:
> > 
> > I might be missing obvious here, but here goes:
> > 
> > Samba 2.2.4.
> > 
> > Using "winbind use default domain = <DOMAIN>" option
usernames map
> > correctly, however, when logging on from an W2K machine I still get
> > the autogenerated UID instead of my NIS (Or /etc/passwd) UID.
> 
> Two points:
> 
> Why are you running winbind?  It seems you really just want
> 'security=domain', and don't need winbindd.
I'd like to have winbind supply the username and the UID in the case
that
the user doesn't exist in the YP map. (As I'd expect from the semantic
of
anything implemented with NSS).
 
> Secondly.  'winbind use sdefault domain =' is *NOT SUPPORTED* in
2.2.
> The option exists only becouse of a merge from HEAD, where we 
> completed
> implementation.  The 2.2 code has *known flaws* with this option in
> effect.
Okey doke. I just looked at the code and saw that it was there. Is there
a
place I can hope to find a list of those known flaws?
> It does a lookup of 'domain\username' actually, and gets the UID
from
> there.
I guess that's one of the known flaws thing, because 
getent passwd <username> works perfectly. Oh well. Any chance of this 
matter being taken care of in 2.2?

Thanks a lot!

Nir.
--
Nir Soffer -=- Software Engineer, Exanet Inc. -=-
"Father, why are all the children weeping? / They are merely crying son
 O, are they merely crying, father? / Yes, true weeping is yet to come"
        -- Nick Cave and the Bad Seeds, The Weeping Song