samba - Jul 2005 - Where to go next; Winbind/LDAP/ID mapping

Hi,

I've configured 2 RHEL4 boxes running samba-3.0.10-1.4E to
join our W2K AD domain and run as member servers. wbinfo
-u/-g and getent passwd/group work OK and resolve users
within the domain and I've created a test share with domain
permissions that we can copy to etc.
So now I've reached a bit of a crossroads. As I understand
it winbind maps the domain SID's to UID's/GID's on a random
basis, but as the 2 boxes will eventually form part of a
cluster I need to make sure that the ID mappingsare
identical on each box otherwise I'll have a hell of a job
when failing over.
Looking through the Samba How-To and By-Example
documentation to check current configuration it doesn't seem
to be clear (at least to me :) ) what the best/recommended
practice is in this situation. Can I use AD as the LDAP
backend? Should I use IDMAP_RID and replicate the .tdb files
between nodes - there are 30,000+ accounts in AD? Would I
even have to replicate the .tdb if it uses a predictable
mapping system? Or is confguring a second LDAP server to
store the mapped ID's my only option?
If anyone has any experience or knowledge I'd love to hear
from you.

Cheers.

Simon

Hi,

Thanks to those who got back to me the last time I posted.

I've been reading up on LDAP and piecing together the puzzle
using the Samba By-Example doc and other pieces of
information found on the web. I'm now up to the stage where
I believe I have a working LDAP directory configured  -
ldapsearch yields expected results - and Samba can connect
to it OK - tested by changing LDAP password and checking
logs for connect errors. The NSS tools from PADL are also
compiled and configured as per  Samba By-Example.

What I haven't found clear though is how Samba/Winbind
populate the LDAP directory with the ID mappings.
Do I have to use the user/group add scripts - bearing in
mind the box is a domain member and is not going to be
acting as a PDC? Or should Winbind add the ID mapping when a
user attempts to connect to a share?

At the moment wbinfo -t, wbinfo -u and wbinfo -g work OK but
getent passwd/group only displays local users and groups. If
a domain user attempts to connect to a share with full
access permissions they are prompted for login information.
How can Winbind add the user to LDAP if the user cannot
connect to the share as they currently don't exist?

If required I can post conf files for LDAP/Samba/NSS_LDAP,

Thanks,

Simon