samba - Jul 2005 - Missing Groups (from LDAP?)

Hi all,

We have a working 3.0.9 installation here, but I am unable to build any 
version now that will correctly. 

The problem seems to be that samba is unable to pickup the groups of a 
user.  We are using an LDAP backend.  It all works fine on 3.0.9, but 
not on 3.0.14a2 or 3.0.20p1.  Here's the test/example data:

The OS knows the groups from NIS:

jurassic:42>id -a iss03c
uid=13460(iss03c) gid=201(is) 
groups=682(sudo),1195(cisco),815(dhcp),1233(issysnet)

Samba can't see them:

jurassic:43>./net user info iss03c
Password:

<no output>

In nsswitch.conf:

group:      files nis

smb.conf is the same as that for a working configuration, except for 
being a different workgroup.


I have a verbose log.smbd output for the duration of the 'net user 
info', if that would help. 

At the moment, I'm principally thinking of what the 'gotchas' can be
that are causing me this problem, so any advice would be appreciated.

Thanks
Ade

Hi all,

Further developments.........
>
> We have a working 3.0.9 installation here, but I am unable to build 
> **any** (including 3.0.9) version now that will correctly.
> The problem seems to be that samba is unable to pickup the groups of a 
> user.  We are using an LDAP backend.  It all works fine on 3.0.9, but 
> not on 3.0.14a2 or 3.0.20p1. 
>
> jurassic:43>./net user info iss03c
> Password:
>
> <no output>
Having snooped the network traffic, I have found out that Samba is
looking things up in LDAP correctly, and getting appropriate results
back.  Hence, I now have the question of what happens after that.  The
passdb backend configuration only consists of ldap, nothing else.  Is
this chunk of log file relevant (it shows that Samba has got the LDAP
response back, at least) - I have no idea which of the rest of the debug
log is worth including:

[2005/07/17 16:03:09, 5] auth/auth_util.c:debug_unix_user_token(473)
  UNIX token of user 13460
  Primary group is 201 and contains 6 supplementary groups
  Group[  0]: 201
  Group[  1]: 682
  Group[  2]: 815
  Group[  3]: 1195
  Group[  4]: 1233
  Group[  5]: 1281
[2005/07/17 16:03:09, 5] smbd/uid.c:change_to_user(304)
  change_to_user uid=(0,13460) gid=(0,201)


I'm getting a distinct feeling this is now going to be something really
stupid on my part, but it is incredibly frustrating and I can't work it
out, so all help very much appreciated, even if you do just tell me i've
been an idiot (with justification, preferably).

Thanks
Ade