thr3ads.net - samba - [Samba] winbind / idmap

If this information is useful, please help other people find it:
Share via:

Bruce Hohl

2005-Feb-20 03:42 UTC

[Samba] winbind / idmap_rid

Thanks in advance for any help in resolving this issue.
I am experiencing the following issue on both a test and 
production server.  Data from the test server follows:

I am using winbind with the idmap_rid parameter.
After each time I restart winbind I have to rejoin the
domain in order for "wbinfo -t" to succeed.
User connections also fail.

I am running:
samba-3.0.10-0.1  (SuSE 9.1 Pro)
heimdal-0.6.1rc3-55.9

My smb.conf globals are as follows:
[global]
        # general #
        workgroup = GROTECOMPANY
        realm = GROTECOMPANY.COM
        map to guest = Bad User
        password server = 192.168.1.201
        security = ADS
        log level = 1
        preferred master = no
        local master = no
        domain master = no
        wins server = 192.168.1.201
        ldap ssl = no
        socket options = TCP_NODELAY SO_RCVBUF=8192
SO_SNDBUF=8192
        # winbind ####################################
        # IDMAP_RID with Winbind available with 3.0.8:
        idmap backend = idmap_rid:GROTECOMPANY=10000-20000
        allow trusted domains = no
	##############################################
        idmap uid = 10000-20000
        idmap gid = 10000-20000
        winbind separator = /
        winbind use default domain = yes
        winbind enum users = yes
        winbind enum groups = yes
        # printing #
        printing = cups
        printcap name = cups
        printer admin = administrator
	

LOG (log level = 3) MESSAGES FROM "wbinfo -t" COMMAND AFTER
RESTART OF WINBIND:
=====================================================================[2005/02/19
22:12:54, 3]
nsswitch/winbindd_misc.c:winbindd_interface_version(261)
  [ 7251]: request interface version
[2005/02/19 22:12:54, 3]
nsswitch/winbindd_misc.c:winbindd_priv_pipe_dir(297)
  [ 7251]: request location of privileged pipe
[2005/02/19 22:12:54, 3]
nsswitch/winbindd_misc.c:winbindd_check_machine_acct(41)
  [ 7251]: check machine account
[2005/02/19 22:12:54, 3]
nsswitch/winbindd_cm.c:cm_get_ipc_userpass(109)
  IPC$ connections done anonymously
[2005/02/19 22:12:54, 3]
libsmb/cliconnect.c:cli_session_setup_spnego(713)
  Doing spnego session setup (blob length=113)
[2005/02/19 22:12:54, 3]
libsmb/cliconnect.c:cli_session_setup_spnego(738)
  got OID=1 2 840 48018 1 2 2
[2005/02/19 22:12:54, 3]
libsmb/cliconnect.c:cli_session_setup_spnego(738)
  got OID=1 2 840 113554 1 2 2
[2005/02/19 22:12:54, 3]
libsmb/cliconnect.c:cli_session_setup_spnego(738)
  got OID=1 2 840 113554 1 2 2 3
[2005/02/19 22:12:54, 3]
libsmb/cliconnect.c:cli_session_setup_spnego(738)
  got OID=1 3 6 1 4 1 311 2 2 10
[2005/02/19 22:12:54, 3]
libsmb/cliconnect.c:cli_session_setup_spnego(745)
  got principal=visual1$@GROTECOMPANY.COM
[2005/02/19 22:12:54, 2]
libsmb/cliconnect.c:cli_session_setup_kerberos(538)
  Doing kerberos session setup
[2005/02/19 22:12:54, 3]
libsmb/clikrb5.c:ads_cleanup_expired_creds(319)
  Ticket in ccache[MEMORY:cliconnect] expiration Sun, 20 Feb
2005 08:12:45 GMT
[2005/02/19 22:12:54, 0]
rpc_client/cli_netlogon.c:cli_nt_setup_creds(256)
  cli_nt_setup_creds: request challenge failed
[2005/02/19 22:12:54, 3]
nsswitch/winbindd_cm.c:cm_prepare_connection(384)
  schannel refused - continuing without schannel
(NT_STATUS_INVALID_COMPUTER_NAME)
[2005/02/19 22:12:54, 0]
rpc_client/cli_netlogon.c:cli_nt_setup_creds(256)
  cli_nt_setup_creds: request challenge failed
[2005/02/19 22:12:54, 3]
nsswitch/winbindd_misc.c:winbindd_check_machine_acct(68)
  could not open handle to NETLOGON pipe
[2005/02/19 22:12:54, 2]
nsswitch/winbindd_misc.c:winbindd_check_machine_acct(98)
  Checking the trust account password returned
NT_STATUS_INVALID_COMPUTER_NAME

Guenther Deschner

2005-Feb-20 10:08 UTC

head link

[Samba] winbind / idmap_rid

Hi,

On Sat, Feb 19, 2005 at 03:42:27PM -1200, Bruce Hohl
wrote:> I am using winbind with the idmap_rid parameter.
> After each time I restart winbind I have to rejoin the
> domain in order for "wbinfo -t" to succeed.
> User connections also fail.
This is not related to idmap_rid. Could you please try to use
a netbios-name in the password server parameter and try again?

Thanks,

Guenther

-- 
Guenther Deschner                                               Samba Team
SerNet GmbH - Goettingen                                      gd@samba,org
gd@sernet.de
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 240 bytes
Desc: not available
Url :
http://lists.samba.org/archive/samba/attachments/20050220/88cb5bc8/attachment.bin

Bruce Hohl

2005-Feb-20 22:02 UTC

head link

[Samba] winbind / idmap_rid

> On Sat, Feb 19, 2005 at 03:42:27PM -1200, Bruce Hohl
> > wrote: I am using winbind with the idmap_rid parameter.
> > After each time I restart winbind I have to rejoin the
> > domain in order for "wbinfo -t" to succeed.
> > User connections also fail.
> 
> This is not related to idmap_rid. Could you please try to
> use a netbios-name in the password server parameter and
> try again?
> 
> Thanks,
> 
> Guenther
> Guenther,
Adding a netbios-name instead of any IP address for the
password server parameter has corrected the behavior noted
above on both my test and production systems.  Thank you for
this help.  Would it also be better to use a net-bios name
for the wins server parameter?
Bruce

Guenther Deschner

2005-Feb-21 10:01 UTC

head link

[Samba] winbind / idmap_rid

Hi Bruce,

On Sun, Feb 20, 2005 at 10:02:30AM -1200, Bruce Hohl
wrote:> Guenther,
> Adding a netbios-name instead of any IP address for the
> password server parameter has corrected the behavior noted
> above on both my test and production systems.  Thank you for
> this help.  Would it also be better to use a net-bios name
> for the wins server parameter?
Not, that is not necessary. 

That "password server" actually requires a netbios-name is a bug in
older
Samba Releases and is fixed at least in SVN, AFAIK.

Guenther

-- 
Guenther Deschner                                               Samba Team
SerNet GmbH - Goettingen                                      gd@samba,org
gd@sernet.de
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: not available
Url :
http://lists.samba.org/archive/samba/attachments/20050221/917db4dc/attachment.bin

samba - Feb 2005 - winbind / idmap_rid

[Samba] winbind / idmap_rid

[Samba] winbind / idmap_rid

[Samba] winbind / idmap_rid

[Samba] winbind / idmap_rid