samba - Aug 2013 - Samba 3.6.6 idmap problem

Hi All,

I have been stuck on this problem for a day or so now and am in need of a bit of
help.

I am running Samba 3.6.6 with Winbind and all operation and working correctly
apart from the UID and GID mapping. There have been a few post on the net
regarding this but all the solution listed do not work for me.

Here is my smb.conf
---------------------------------------------------
[global]
        workgroup = MYDOMAIN
        realm = INTERNAL.MYDOMAIN.COM
        server string = Services Server
        security = ADS
        allow trusted domains = No
        password server = ps.internal.mydomain.com ps
        log level = 1
        syslog = 0
        log file = /var/log/samba/smbd.log
        max log size = 50
        server signing = auto
        local master = No
        dns proxy = No
        ldap ssl = no
        template shell = /bin/bash
        winbind enum users = yes
        winbind enum groups = yes
        winbind separator = +
        winbind use default domain = Yes
        create mask = 0774
        directory mask = 0775
        hosts allow = 192.
        hosts deny = ALL
        interfaces = 127.0.0.1/8 eth0
        idmap config * : range = 10000-20000
        idmap config * : backend = tdb
        idmap config MYDOMAIN : default = yes
        idmap config MYDOMAIN: range = 100000-200000
        idmap config MYDOMAIN : backend = rid
----------------------------------------------------------------

When I list users using getent all users in the domain appear but there UID and
GID are out by 99000 (e.g. 4108 on my machine  should be 103108)

I know this is to do with idmap but the man pages and online post have not lead
me to a solution.

Any help would be greatly appreciated, thanks.
David

On 09/08/13 11:31, David Blaney wrote:

[SNIP]
>
> When I list users using getent all users in the domain appear but
> there UID and GID are out by 99000 (e.g. 4108 on my machine  should
> be 103108)
>
> I know this is to do with idmap but the man pages and online post
> have not lead me to a solution.
>
I am assuming that because you know what the UID/GID should be then they 
are defined in rfc2307 attributes in your AD.

In which case using "idmap config MYDOMAIN : backend = rid" is not
going
to work, and you should be using the ad backend for idmap.

JAB.

-- 
Jonathan A. Buzzard                 Email: jonathan (at) buzzard.me.uk
Fife, United Kingdom.