samba - Nov 2013 - Winbindd and Domain local groups

Hi,
 
I have been trying to use Winbindd in SLES 11 SP3 (Samba version 3.6.3-17.25.1)
to fetch AD (Windows 2008 R2) identities into the Linux box and currently
running into some problem w.r.t domain local groups and thought I could get some
help here..
 
I have a two domain setup, in which DOMAIN1 is the parent domain and DOMAIN2 is
the child domain. I have 2 users DOMAIN1\user1, DOMAIN2\user2 and they are part
of a global group DOMAIN1\group1 and DOMAIN2\group2 respectively. I have joined
my SLES box to the DOMAIN1 (net ads join -U Administrator). I have also created
a new domain local group in DOMAIN2 called DOMAIN2\domainlocal2 and added
DOMAIN1\group1 and DOMAIN2\group2 as members of this domain local group.
 
With this setup, if I see wbinfo --user-sids=<SID of DOMAIN2\user2> or 
wbinfo --user-domgroups=<SID of DOMAIN2\user2>, I could see that the user
is a member of DOMAIN2\domainlocal2 (along with the global group
DOMAIN2\group2). But, If I do the same thing for the user DOMAIN1\user1, I
don't find DOMAIN2\domainlocal2 as a valid group (I could find the global
group DOMAIN1\group1 in the list)
 
The same test works for universal groups, but not for domain local groups.
 
Is there something wrong with my setup or my understanding (I expect the domain
local groups to be a part of valid groups)?
Or is there anything more to it?
 
Thanks,
Solai

Hi,
 
I have been trying to use Winbindd in SLES 11 SP3 (Samba version 3.6.3-17.25.1)
to fetch AD (Windows 2008 R2) identities into the Linux box and currently
running into some problem w.r.t domain local groups and thought I could get some
help here..
 
I have a two domain setup, in which DOMAIN1 is the parent domain and DOMAIN2 is
the child domain. I have 2 users DOMAIN1\user1, DOMAIN2\user2 and they are part
of a global group DOMAIN1\group1 and DOMAIN2\group2 respectively. I have joined
my SLES box to the DOMAIN1 (net ads join -U Administrator). I have also created
a new domain local group in DOMAIN2 called DOMAIN2\domainlocal2 and added
DOMAIN1\group1 and DOMAIN2\group2 as members of this domain local group.
 
With this setup, if I see wbinfo --user-sids=<SID of DOMAIN2\user2> or 
wbinfo --user-domgroups=<SID of DOMAIN2\user2>, I could see that the user
is a member of DOMAIN2\domainlocal2 (along with the global group
DOMAIN2\group2). But, If I do the same thing for the user DOMAIN1\user1, I
don't find DOMAIN2\domainlocal2 as a valid group (I could find the global
group DOMAIN1\group1 in the list)
 
The same test works for universal groups, but not for domain local groups.
 
Is there something wrong with my setup or my understanding (I expect the domain
local groups to be a part of valid groups)?
Or is there anything more to it?
 
Thanks,
Solai

I also have the same issue with trusted domains and local domain group
memberships ...?
RHEL 6 + samba 3.6.9  = doesnt work
RHEL 5 + samba 3.6.6 = works


Did you resolve your issue ?