samba - Sep 2002 - valid users and groups with winbind

Hi,

Just starting on this list.

I have samba (2.2.5a) on Linux/s390 and winbind authenticating and
providing shares.
I add the global to smb.conf:

  valid users = '@Domain Users'

After that, I can no longer get the share even though I am in the 'Domain
Users' group.

  # id poklcc+mikem
  uid=10001(POKLCC+mikem) gid=10000(POKLCC+Domain Users)
groups=10000(POKLCC+Domain Users)

I am using the same password, but log.smbd says:

[2002/09/26 14:06:45, 2] smbd/service.c:make_connection(331)
  Invalid username/password for smbshare [poklcc+mikem]
[2002/09/26 14:06:45, 3] smbd/error.c:error_packet(110)
  error packet at smbd/reply.c(167) cmd=117 (SMBtconX)
NT_STATUS_WRONG_PASSWORD
[2002/09/26 14:06:45, 3] smbd/process.c:process_smb(877)

The documentation in smb.conf says:

               "A name starting with a '@' is interpreted as an NIS
              netgroup first (if your system supports  NIS),  and
              then  as  a UNIX group if the name was not found in
              the NIS netgroup database."

but it says nothing about winbind.  Is a Windows Domain group equal to an
NIS or UNIX group, or neither?

Thanks.

          -Mike MacIsaac,  IBM   mikemac@us.ibm.com   (845) 433-7061

Michael MacIsaac wrote:
> 
> Hi,
> 
> Just starting on this list.
> 
> I have samba (2.2.5a) on Linux/s390 and winbind authenticating and
> providing shares.
> I add the global to smb.conf:
> 
>   valid users = '@Domain Users'
Winbind groups start with DOMAIN\, and as a quirk, don't need the @
prefix.

So valid users = 'domain\domain users' should do what you want.

Andrew Bartlett

-- 
Andrew Bartlett                                 abartlet@pcug.org.au
Manager, Authentication Subsystems, Samba Team  abartlet@samba.org
Student Network Administrator, Hawker College   abartlet@hawkerc.net
http://samba.org     http://build.samba.org     http://hawkerc.net

Andrew,

	I was having the same problem with getting groups to work,  so I
tried your solution,  but can't get it to work either.  

1. I set up a read only share,  made sure I didn't have write access.

2. I added 

	write list = WALNETNT_karen"
 
   and verified that I now had write access.

3. I then changed the write list to give write access to the whole domain
users group 
   (which karen is a member of),   but I no longer had
   write permission ...  I tried all of the following,  
   but none seemed to work: 

	write list = 'domain\domain users'  
	write list = 'domain\Domain Users'  (case sensitivity check)
	write list = 'WALNETNT\Domain Users' (maybe you meant for me to use
my domain name?)
	write list = 'WALNETNT_Domain Users' (My winbind separator is
"_"
... Use this?)
	write list = 'domain_Domain Users'  
	write list = ''domain_domain users' 
	
I didn't try taking the quotes off,  I didn't think UNIX would deal with
the
space in the domain group name very well.  I logged off and back on as
various domain users while testing this to make sure the permissions weren't
being cached on the client PC.  I'm obviously missing something here,
perhaps you can shed some light?  

	Thanks,

		Karen Wieprecht

-----Original Message-----
From: Andrew Bartlett [mailto:abartlet@samba.org] 
Sent: Thursday, September 26, 2002 7:10 PM
To: Michael MacIsaac
Cc: samba@lists.samba.org
Subject: Re: [Samba] valid users and groups with winbind


Michael MacIsaac wrote:
> 
> Hi,
> 
> Just starting on this list.
> 
> I have samba (2.2.5a) on Linux/s390 and winbind authenticating and 
> providing shares. I add the global to smb.conf:
> 
>   valid users = '@Domain Users'
Winbind groups start with DOMAIN\, and as a quirk, don't need the @ prefix.

So valid users = 'domain\domain users' should do what you want.

Andrew Bartlett

-- 
Andrew Bartlett                                 abartlet@pcug.org.au
Manager, Authentication Subsystems, Samba Team  abartlet@samba.org
Student Network Administrator, Hawker College   abartlet@hawkerc.net
http://samba.org     http://build.samba.org     http://hawkerc.net
-- 
To unsubscribe from this list go to the following URL and read the
instructions:  http://lists.samba.org/mailman/listinfo/samba