thr3ads.net - samba - [Samba] posixAccount objectClass [Feb 2013]

If this information is useful, please help other people find it:
Share via:

Andreas Gaiser/L

2013-Feb-23 16:38 UTC

[Samba] posixAccount objectClass

Hi fellow list users,


I'm setting up a 4.0.3 DC and I am observing the following issue:

- nsswitch.conf contains winbind for passwd and group
- provisioned with use_rfc2307
- creating user with ADUC
- creating group
- adding Unix Attributes to user and group
- 1st part of issue: ADUC throws error message (translated from German
XP: "The object properties of the object could not be changed. [4 more
line of misleading information about possible networking issues]")
- but nevertheless it adds a Unix userID which is displayed when opening
the object properties/Unix Attributes tab again
- 2nd part of issue: winbind on the DC itself does not respect the
uidNumber attribute, though it's visible with an LDAP client (Apache
DS), checked with wbinfo -i and with getent passwd
- taking a closer look at the object, I find the objectClass
(posixAccount) missing
- adding posixAccount as objectClass (I have to click through a warning
and reject creating an ntSecurityDescriptor attribute) winbind suddenly
used the uidNumber Attribute

Is there something I miss or is this to be considered a bug?


Regards,

Andreas
-- 
Andreas Gaiser, Berlin, Germany

Thomas Simmons

2013-Feb-23 17:05 UTC

head link

[Samba] posixAccount objectClass

On Sat, Feb 23, 2013 at 11:38 AM, Andreas Gaiser/L <info at
multifake.net>wrote:
> Hi fellow list users,
>
>
> I'm setting up a 4.0.3 DC and I am observing the following issue:
>
> - nsswitch.conf contains winbind for passwd and group
> - provisioned with use_rfc2307
> - creating user with ADUC
> - creating group
> - adding Unix Attributes to user and group
> - 1st part of issue: ADUC throws error message (translated from German
> XP: "The object properties of the object could not be changed. [4 more
> line of misleading information about possible networking issues]")
> - but nevertheless it adds a Unix userID which is displayed when opening
> the object properties/Unix Attributes tab again
> - 2nd part of issue: winbind on the DC itself does not respect the
> uidNumber attribute, though it's visible with an LDAP client (Apache
> DS), checked with wbinfo -i and with getent passwd
> - taking a closer look at the object, I find the objectClass
> (posixAccount) missing
> - adding posixAccount as objectClass (I have to click through a warning
> and reject creating an ntSecurityDescriptor attribute) winbind suddenly
> used the uidNumber Attribute
>
> Is there something I miss or is this to be considered a bug?
>
> If this is the problem I am thinking of, I originally noticed it in 4.0.0.I believe Andrew provided a patch, however I don't need this in my
production environment and only stumbled onto the issue while testing
something else, so I don't know if what I'm referring to was fixed in
later
releases. I'll see if I can find the thread and bug shortly.
>
> Regards,
>
> Andreas
> --
> Andreas Gaiser, Berlin, Germany
> --
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba
>

Hansjoerg Maurer

2013-Feb-25 09:59 UTC

head link

[Samba] posixAccount objectClass

Hi

there was a thread 
" Samba 4, Winbind & RFC2307" at 26.12.2012 on this list
which covers that issue, including a patch from andrew and another  fix
I provided

Regrads

Hansj?rg

?




-- 
Dr. Hansj?rg Maurer
itsystems Deutschland AG
Linprunstra?e 10
80335 M?nchen
Tel:   +49-89-52 04 68-41
Fax:   +49-89-52 04 68-59
E-Mail: hansjoerg.maurer at itsd.de <mailto:hansjoerg.maurer at itsd.de> 
<mailto:hansjoerg.maurer at itsd.de <mailto:hansjoerg.maurer at
itsd.de> >
Web:    http://www.itsd.de <http://www.itsd.de> 
<http://www.itsd.de/> <http://www.itsd.de/%3E> ;

Amtsgericht M?nchen HRB 132146
USt-IdNr. DE 812991301
Steuer-Nr. 143/100/81575

Aufsichtsratsvorsitzender:
Stefan Adam
Vorstand:
Dr. Michael Krocka
Dr. Hansj?rg Maurer

 
 
-----Urspr?ngliche Nachricht-----> Von:Andreas Gaiser/L <info at multifake.net <mailto:info at
multifake.net> >
> Gesendet: Sam 23 Februar 2013 18:52
> An: Samba Mailing List <samba at lists.samba.org <mailto:samba at
lists.samba.org> >
> Betreff: Re: [Samba] posixAccount objectClass
> 
> Hi Thomas, greeting to all readers,
> 
> >     Is there something I miss or is this to be considered a bug?
> > 
> > If this is the problem I am thinking of, I originally noticed it in
> > 4.0.0. I believe Andrew provided a patch, however I don't need
this in
> > my production environment and only stumbled onto the issue while
testing
> > something else, so I don't know if what I'm referring to was
fixed in
> > later releases. I'll see if I can find the thread and bug shortly.
> > 
> 
> I remember a thread which was about winbind ignoring objects without
> posixAccount/posixGroup OCs. The conclusion was to change winbind to not
> ignore them. But, actually, shouldn't S4 in DC mode really add them? Or
> is ADUC the culprit here?
> 
> I didn't check out yet how recent Samba 3.6 winbind behaves as a member
> here. When I tried against 4.0.0 I ended up using Wireshark to analyse
> LDAP traffic and figured RFC2307 attrs weren't returned by the LDAP
> server although requested by winbind, whereas they WERE returned to
> Apache Directory Studio at the same time - logged in as
> Administrator at sub.domain.tld <mailto:Administrator at
sub.domain.tld> ; a permission issue I guess. Is this a
> known issue? I blamed it to poor provisioning (without RFC2307 in the
> beginning) that day. Will try again this part later this weekend.
> 
> At the moment, I'm working on a script that adds Unix Attributes
> automatically to all relevant users (i.e. all that winbind shows on a
> member. Btw. I would love to have a way to filter them, because most
> groups I won't ever need and they're gonna make things look
complicated
> on the Unix side. Does anybody know anything about this?).
> 
> 
> Andreas
> -- 
> Andreas Gaiser, Berlin, Germany
> -- 
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba
> 

 <http://www.itsd.de/files/2913/5783/3549/mailfooter.gif> itsystems
Deutschland AG
Sorglos und leise. So geht IT. <http://www.itsd.de> 
Kontakt: info at itsd.de <mailto:info at itsd.de> | F: +49 89 520468 40 |
Linprunstr. 10 | 80335 M?nchen

Amtsgericht M?nchen HRB 132146 | USt-IdNr. DE 812991301 | Steuer-Nr.
143/100/81575
i Aufsichtsratsvorsitzender: Stefan Adam | Vorstand: Dr. Hansj?rg Maurer

Maybe Matching Threads

Search for more possibly parallel threads

samba - Feb 2013 - posixAccount objectClass

[Samba] posixAccount objectClass

[Samba] posixAccount objectClass

[Samba] posixAccount objectClass

Maybe Matching Threads