samba - Oct 2003 - Permissions issue sharing data from multiple servers via multiple protocols

Hi all,

I have several UNIX servers I'd like to configure Samba on but am having
trouble working out the best way to achieve consistent user and group permission
across the file systems on several file servers.
Basically I need to integrate the Samba server into our MS AD domain, using
Kerberos for authentication which all works fine. My problem is achieving
consistent permissioning with AD users and groups across multiple Samba servers
while also maintaining useable permissions for non SMB clients.

What seems to be the best solution is to use winbind to map AD groups to UNIX
uids/gids using LDAP backend to maintain the mapping database, is there any
documentation on how to achieve this? I want to avoid having local winbind maps
with different random mappings on different Samba servers. I have a Sunone LDAP
server with which to host this mapping data.

This still leaves me with the problem of how these permissions might map to
non-smb clients accessing the same data, ie UNIX client mounting the data via
NFS. I guess this basically doesn't work unless I install winbind on every
single unix client? Only other way to do this I can think of is to dump winbind
and create standard UNIX groups on our LDAP server and use net groupmap to
manually map these to AD groups but this is pretty unrealalistic for thousands
of users/groups. If this is as difficult as I think it is then I may be forced
to only allow SMB connections to my Samba servers.


	thanks in advance, Andy Smith.

BBCi at http://www.bbc.co.uk/

This e-mail (and any attachments) is confidential and may contain personal views
which are not the views of the BBC unless specifically
stated.
If you have received it in error, please delete it from your system. Do not use,
copy or disclose the information in any way nor act in
reliance on it and notify the sender immediately. Please note that the BBC
monitors e-mails sent or received.
Further communication will signify your consent to this.