samba - Jun 2017 - failed to call wbcGetpwnam/wbcGetgrnam/wbcGetpwsid WBC_ERR_DOMAIN_NOT_FOUND

On Wed, 7 Jun 2017 17:01:03 +0200
"L.P.H. van Belle via samba" <samba at lists.samba.org> wrote:
> He did not test :
> getent passwd username
> result ?
> 
> He did test : 
> getent passwd
> result ok
> 
> He could test with : 
> wbinfo --own-domain
> Results: 
> NTDOM
> 
> And this should show: 
> wbinfo --all-domains
> Results: 
> BUILDIN
> HOSTNAME
> NTDOM
> 
> Im guessing, the last one wil fail. 
> Things to check. 
> samba idmap setup. 
> nsswitch.conf
> idmap.conf
> pam setup.
> 
> So best option lookt to me upgrade to 4.6.5 and run samba-tool
> testparm. That show config errors in idmap.
Hi Louis,

As I said, I set up an ARCH DC and got everything to work, I then sent
him my notes, his response was 'great, but I have been using my setup
for some time'

I got everything to work, wbinfo and getent.

I would agree, the user needs to upgrade and then follow your advice
(and my notes) and try again. I still cannot understand why he is using
a rolling release for something that really needs a static base with
few updates. 
> 
> That all i can think off, i dont know arch linux that well also. 
I have decided I don't want to know Arch any better ;-)


> > Hi Louis, hope you are having a good holiday ;-)
> Yes, i had a good holiday, thanks. Bit low on sleep but that worked
> out.. 
I thought the whole idea behind a holiday was to relax and take things
easy ;-)
> Yes, correct but for you. 
>
https://wiki.archlinux.org/index.php/Samba/Active_Directory_domain_controller
> A basic but pretty good setup for arch. ;-) so next time it wont take
> long.
Setting up Samba didn't take much time, it was getting Arch installed
that took all the time for me.

Rowland

Rowland - please, don't get in the way of others being constructive to
solving this issue. I do not need to know your opinions.

Louis - thanks for your responses. I have just updated to 4.6.4 (4.6.5
isn't in a repo yet) and run samba-tool testparm. Unfortunately, no issues.
It also does not fix the underlying issue.

As for your other questions:

# getent passwd testuser
<nothing>

# wbinfo --own-domain
SMC

# wbinfo --all-domains
BUILTIN
SMC


idmap setup is as I posted in my original post: https://pastebin.com
/yWPtWrEF

I do not have an idmap.conf?

# cat /etc/nsswitch.conf
passwd: compat winbind
group: compat winbind
<omitted other non-relevant lines>

PAM is not configured as I'm not doing any *nix authentication.

Thanks again Louis

Alex


On 7 June 2017 at 16:28, Rowland Penny via samba <samba at
lists.samba.org>
wrote:
> On Wed, 7 Jun 2017 17:01:03 +0200
> "L.P.H. van Belle via samba" <samba at lists.samba.org>
wrote:
>
> > He did not test :
> > getent passwd username
> > result ?
> >
> > He did test :
> > getent passwd
> > result ok
> >
> > He could test with :
> > wbinfo --own-domain
> > Results:
> > NTDOM
> >
> > And this should show:
> > wbinfo --all-domains
> > Results:
> > BUILDIN
> > HOSTNAME
> > NTDOM
> >
> > Im guessing, the last one wil fail.
> > Things to check.
> > samba idmap setup.
> > nsswitch.conf
> > idmap.conf
> > pam setup.
> >
> > So best option lookt to me upgrade to 4.6.5 and run samba-tool
> > testparm. That show config errors in idmap.
>
> Hi Louis,
>
> As I said, I set up an ARCH DC and got everything to work, I then sent
> him my notes, his response was 'great, but I have been using my setup
> for some time'
>
> I got everything to work, wbinfo and getent.
>
> I would agree, the user needs to upgrade and then follow your advice
> (and my notes) and try again. I still cannot understand why he is using
> a rolling release for something that really needs a static base with
> few updates.
> >
> > That all i can think off, i dont know arch linux that well also.
>
> I have decided I don't want to know Arch any better ;-)
>
>
>
> > > Hi Louis, hope you are having a good holiday ;-)
> > Yes, i had a good holiday, thanks. Bit low on sleep but that worked
> > out..
>
> I thought the whole idea behind a holiday was to relax and take things
> easy ;-)
>
> > Yes, correct but for you.
> > https://wiki.archlinux.org/index.php/Samba/Active_
> Directory_domain_controller
> > A basic but pretty good setup for arch. ;-) so next time it wont take
> > long.
>
> Setting up Samba didn't take much time, it was getting Arch installed
> that took all the time for me.
>
> Rowland
>
> --
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba
>

On Thu, 8 Jun 2017 10:41:39 +0100
Alex Matthews via samba <samba at lists.samba.org> wrote:
> Rowland - please, don't get in the way of others being constructive to
> solving this issue. I do not need to know your opinions.
I was being constructive. I will also reply to this and try to be
constructive.
> 
> Louis - thanks for your responses. I have just updated to 4.6.4 (4.6.5
> isn't in a repo yet) and run samba-tool testparm. Unfortunately, no
> issues. It also does not fix the underlying issue.
> 
> As for your other questions:
> 
> # getent passwd testuser
> <nothing>
> 
> # wbinfo --own-domain
> SMC
> 
> # wbinfo --all-domains
> BUILTIN
> SMC
> 
> 
> idmap setup is as I posted in my original post: https://pastebin.com
> /yWPtWrEF
You don't have any idmap configuration in that smb.conf.
 
> 
> I do not have an idmap.conf?
it is part of smb.conf
> 
> # cat /etc/nsswitch.conf
> passwd: compat winbind
> group: compat winbind
> <omitted other non-relevant lines>
> 
> PAM is not configured as I'm not doing any *nix authentication.
At last, there is your problem, you need PAM because you need Unix
authentication. If you set up PAM 'getent passwd testuser' will work.

Rowland

( copy the parts from Rowlands mail ) 
> I do not have an idmap.conf?
it is part of smb.conf
A small mixup here, See below. 
There are 2 idmap definitions ( smb.conf and idmap.conf ) 
idmap.conf is/should normaly not be needed, this all depends on the setup.

More comment below. 
> -----Oorspronkelijk bericht-----
> Van: samba [mailto:samba-bounces at lists.samba.org] Namens Alex 
> Matthews via samba
> Verzonden: donderdag 8 juni 2017 11:42
> Aan: samba at lists.samba.org
> Onderwerp: Re: [Samba] failed to call 
> wbcGetpwnam/wbcGetgrnam/wbcGetpwsid WBC_ERR_DOMAIN_NOT_FOUND
> 
> Rowland - please, don't get in the way of others being 
> constructive to solving this issue. I do not need to know 
> your opinions.
Really, we also need Rowland, and i do apriciate all his comments. 
We try to learn or each other, so be nice, he is one of the good guys. 
> 
> Louis - thanks for your responses. I have just updated to 
> 4.6.4 (4.6.5 isn't in a repo yet) and run samba-tool 
> testparm. Unfortunately, no issues.
> It also does not fix the underlying issue.
> 
> As for your other questions:
> 
> # getent passwd testuser
> <nothing>
> 
> # wbinfo --own-domain
> SMC
> 
> # wbinfo --all-domains
> BUILTIN
> SMC
Here im missing te COMPUTERNAME
Why? I dont know. (yet)

> 
> 
> idmap setup is as I posted in my original post: 
> https://pastebin.com /yWPtWrEF
> 
> I do not have an idmap.conf?
Dont know, check if /etc/idmap.conf exist. Of maybe on an other location. 
( /etc/idmap.conf on debian from nfs-common package) 

( mine, the important part : set your own domain here, if id differs from FQDN
minus hostname )
cat /etc/idmapd.conf
[General]

Verbosity = 0
Pipefs-Directory = /run/rpc_pipefs

# set your own domain here, if id differs from FQDN minus hostname
# Domain = localdomain

> 
> # cat /etc/nsswitch.conf
> passwd: compat winbind
> group: compat winbind
> <omitted other non-relevant lines>
> 
> PAM is not configured as I'm not doing any *nix authentication.
Any user with ID is a unix user, so yes you need that.
As Rowland also told. 

> 
> Thanks again Louis
Your welkom.
> 
> Alex
> 
> 
> On 7 June 2017 at 16:28, Rowland Penny via samba 
> <samba at lists.samba.org>
> wrote:
> 
> > On Wed, 7 Jun 2017 17:01:03 +0200
> > "L.P.H. van Belle via samba" <samba at
lists.samba.org> wrote:
> >
> > > He did not test :
> > > getent passwd username
> > > result ?
> > >
> > > He did test :
> > > getent passwd
> > > result ok
> > >
> > > He could test with :
> > > wbinfo --own-domain
> > > Results:
> > > NTDOM
> > >
> > > And this should show:
> > > wbinfo --all-domains
> > > Results:
> > > BUILDIN
> > > HOSTNAME
> > > NTDOM
> > >
> > > Im guessing, the last one wil fail.
> > > Things to check.
> > > samba idmap setup.
> > > nsswitch.conf
> > > idmap.conf
> > > pam setup.
> > >
> > > So best option lookt to me upgrade to 4.6.5 and run samba-tool 
> > > testparm. That show config errors in idmap.
> >
> > Hi Louis,
> >
> > As I said, I set up an ARCH DC and got everything to work, 
> I then sent 
> > him my notes, his response was 'great, but I have been 
> using my setup 
> > for some time'
> >
> > I got everything to work, wbinfo and getent.
> >
> > I would agree, the user needs to upgrade and then follow 
> your advice 
> > (and my notes) and try again. I still cannot understand why he is 
> > using a rolling release for something that really needs a 
> static base 
> > with few updates.
> > >
> > > That all i can think off, i dont know arch linux that well also.
> >
> > I have decided I don't want to know Arch any better ;-)
> >
> >
> >
> > > > Hi Louis, hope you are having a good holiday ;-)
> > > Yes, i had a good holiday, thanks. Bit low on sleep but 
> that worked 
> > > out..
> >
> > I thought the whole idea behind a holiday was to relax and 
> take things 
> > easy ;-)
> >
> > > Yes, correct but for you.
> > > https://wiki.archlinux.org/index.php/Samba/Active_
> > Directory_domain_controller
> > > A basic but pretty good setup for arch. ;-) so next time it wont 
> > > take long.
> >
> > Setting up Samba didn't take much time, it was getting Arch 
> installed 
> > that took all the time for me.
> >
> > Rowland
> >
> > --
> > To unsubscribe from this list go to the following URL and read the
> > instructions:  https://lists.samba.org/mailman/options/samba
> >
> --
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba
> 
>

On Thu, 8 Jun 2017 12:28:39 +0200
"L.P.H. van Belle via samba" <samba at lists.samba.org> wrote:
> There are 2 idmap definitions ( smb.conf and idmap.conf ) 
> idmap.conf is/should normaly not be needed, this all depends on the
> setup.
No there aren't.
> 
> More comment below. 
> 
> Really, we also need Rowland, and i do apriciate all his comments. 
> We try to learn or each other, so be nice, he is one of the good
> guys. 
Thanks for your kind words Louis
> > # wbinfo --all-domains
> > BUILTIN
> > SMC
> Here im missing te COMPUTERNAME
> Why? I dont know. (yet)
Fairly sure you only get the COMPUTERNAME if Samba has been started
with the default smb.conf, I get it on a domain member (which the
debian install started Samba before I configured it), but I don't
get it on a DC (which I compiled and didn't start until after the
provision) 
> 
> 
> > 
> > 
> > idmap setup is as I posted in my original post: 
> > https://pastebin.com /yWPtWrEF
> > 
> > I do not have an idmap.conf?
> Dont know, check if /etc/idmap.conf exist. Of maybe on an other
> location. ( /etc/idmap.conf on debian from nfs-common package) 
That would be idmapd.conf, not idmap.conf
> 
> ( mine, the important part : set your own domain here, if id differs
> from FQDN minus hostname ) cat /etc/idmapd.conf
See, I told you ;-)
> [General]
> 
> Verbosity = 0
> Pipefs-Directory = /run/rpc_pipefs
> 
> # set your own domain here, if id differs from FQDN minus hostname
> # Domain = localdomain
> 
This has nothing to do with Samba.

Rowland

> That would be idmapd.conf, not idmap.conf
Oeps, you correct. Typo there.. 
And you only might need this when you use nfs. 
But i dont know if he uses that. 

 # wbinfo --all-domains
Yes, the COMPUTERNAME only shows on the member servers. 

Thanks for the corrections. ;-) 

Greetz, 

Louis
> -----Oorspronkelijk bericht-----
> Van: samba [mailto:samba-bounces at lists.samba.org] Namens 
> Rowland Penny via samba
> Verzonden: donderdag 8 juni 2017 12:55
> Aan: samba at lists.samba.org
> Onderwerp: Re: [Samba] failed to call 
> wbcGetpwnam/wbcGetgrnam/wbcGetpwsid WBC_ERR_DOMAIN_NOT_FOUND
> 
> On Thu, 8 Jun 2017 12:28:39 +0200
> "L.P.H. van Belle via samba" <samba at lists.samba.org>
wrote:
> 
> > There are 2 idmap definitions ( smb.conf and idmap.conf ) 
> idmap.conf 
> > is/should normaly not be needed, this all depends on the setup.
> 
> No there aren't.
> 
> > 
> > More comment below. 
> > 
> > Really, we also need Rowland, and i do apriciate all his comments. 
> > We try to learn or each other, so be nice, he is one of the 
> good guys.
> 
> Thanks for your kind words Louis
> 
> > > # wbinfo --all-domains
> > > BUILTIN
> > > SMC
> > Here im missing te COMPUTERNAME
> > Why? I dont know. (yet)
> 
> Fairly sure you only get the COMPUTERNAME if Samba has been 
> started with the default smb.conf, I get it on a domain 
> member (which the debian install started Samba before I 
> configured it), but I don't get it on a DC (which I compiled 
> and didn't start until after the
> provision) 
> 
> > 
> > 
> > > 
> > > 
> > > idmap setup is as I posted in my original post: 
> > > https://pastebin.com /yWPtWrEF
> > > 
> > > I do not have an idmap.conf?
> > Dont know, check if /etc/idmap.conf exist. Of maybe on an other 
> > location. ( /etc/idmap.conf on debian from nfs-common package)
> 
> That would be idmapd.conf, not idmap.conf
> 
> > 
> > ( mine, the important part : set your own domain here, if 
> id differs 
> > from FQDN minus hostname ) cat /etc/idmapd.conf
> 
> See, I told you ;-)
> 
> > [General]
> > 
> > Verbosity = 0
> > Pipefs-Directory = /run/rpc_pipefs
> > 
> > # set your own domain here, if id differs from FQDN minus 
> hostname # 
> > Domain = localdomain
> > 
> 
> This has nothing to do with Samba.
> 
> Rowland
> 
> --
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba
> 
>