samba - Jun 2017 - failed to call wbcGetpwnam/wbcGetgrnam/wbcGetpwsid WBC_ERR_DOMAIN_NOT_FOUND

On Thu, 8 Jun 2017 10:41:39 +0100
Alex Matthews via samba <samba at lists.samba.org> wrote:
> Rowland - please, don't get in the way of others being constructive to
> solving this issue. I do not need to know your opinions.
I was being constructive. I will also reply to this and try to be
constructive.
> 
> Louis - thanks for your responses. I have just updated to 4.6.4 (4.6.5
> isn't in a repo yet) and run samba-tool testparm. Unfortunately, no
> issues. It also does not fix the underlying issue.
> 
> As for your other questions:
> 
> # getent passwd testuser
> <nothing>
> 
> # wbinfo --own-domain
> SMC
> 
> # wbinfo --all-domains
> BUILTIN
> SMC
> 
> 
> idmap setup is as I posted in my original post: https://pastebin.com
> /yWPtWrEF
You don't have any idmap configuration in that smb.conf.
 
> 
> I do not have an idmap.conf?
it is part of smb.conf
> 
> # cat /etc/nsswitch.conf
> passwd: compat winbind
> group: compat winbind
> <omitted other non-relevant lines>
> 
> PAM is not configured as I'm not doing any *nix authentication.
At last, there is your problem, you need PAM because you need Unix
authentication. If you set up PAM 'getent passwd testuser' will work.

Rowland

> You don't have any idmap configuration in that smb.conf.
Correct. That is my idmap configuration.
> At last, there is your problem, you need PAM because you need Unix
authentication.
If you set up PAM 'getent passwd testuser' will work.

<bangs head against a brick wall HARD> That is NOT my problem because I am
not trying to get unix auth to work... I am trying to get wbinfo to work
wbinfo and 'getent passwd username' do not require PAM to be configured.

To prove this, I have just created a dummy domain controller and DID NO PAM
CONFIGURATION AT ALL and guess what, 'getent passwd username' works, as
do
the wbinfo lines. So will you please stop harping on about PAM. It has
NOTHING to do with this issue. My problem is something deep within samba.
Something has gone AWOL somewhere. I don't believe it is a configuration
issue.

@Louis - Rowland is very good at parroting back meaningless information and
proving that "something should work" however he is utterly useless at
getting to the bottom of an issue, or understand that this MIGHT NOT BE a
configuration issue. I don't know that makes him a "good guy"



On 8 June 2017 at 10:59, Rowland Penny via samba <samba at
lists.samba.org>
wrote:
> On Thu, 8 Jun 2017 10:41:39 +0100
> Alex Matthews via samba <samba at lists.samba.org> wrote:
>
> > Rowland - please, don't get in the way of others being
constructive to
> > solving this issue. I do not need to know your opinions.
>
> I was being constructive. I will also reply to this and try to be
> constructive.
>
> >
> > Louis - thanks for your responses. I have just updated to 4.6.4 (4.6.5
> > isn't in a repo yet) and run samba-tool testparm. Unfortunately,
no
> > issues. It also does not fix the underlying issue.
> >
> > As for your other questions:
> >
> > # getent passwd testuser
> > <nothing>
> >
> > # wbinfo --own-domain
> > SMC
> >
> > # wbinfo --all-domains
> > BUILTIN
> > SMC
> >
> >
> > idmap setup is as I posted in my original post: https://pastebin.com
> > /yWPtWrEF
>
> You don't have any idmap configuration in that smb.conf.
>
> >
> > I do not have an idmap.conf?
>
> it is part of smb.conf
>
> >
> > # cat /etc/nsswitch.conf
> > passwd: compat winbind
> > group: compat winbind
> > <omitted other non-relevant lines>
> >
> > PAM is not configured as I'm not doing any *nix authentication.
>
> At last, there is your problem, you need PAM because you need Unix
> authentication. If you set up PAM 'getent passwd testuser' will
work.
>
> Rowland
>
> --
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba
>

On Thu, 8 Jun 2017 12:20:22 +0100
Alex Matthews via samba <samba at lists.samba.org> wrote:
> > You don't have any idmap configuration in that smb.conf.
> Correct. That is my idmap configuration.
> 
> > At last, there is your problem, you need PAM because you need Unix
> > authentication.
> If you set up PAM 'getent passwd testuser' will work.
> 
> <bangs head against a brick wall HARD> That is NOT my problem because
> I am not trying to get unix auth to work... I am trying to get wbinfo
> to work wbinfo and 'getent passwd username' do not require PAM to
be
> configured.
Well, there has to be a first time for everything, but whilst 'wbinfo'
doesn't need PAM, 'getent' certainly does.
> 
> To prove this, I have just created a dummy domain controller and DID
> NO PAM CONFIGURATION AT ALL and guess what, 'getent passwd
username'
> works, as do the wbinfo lines.
I did the same and getent didn't work for me until I altered PAM.
>  So will you please stop harping on
> about PAM. It has NOTHING to do with this issue. My problem is
> something deep within samba. Something has gone AWOL somewhere. I
> don't believe it is a configuration issue.
I feel it must be a configuration problem, because I had it working
with Arch linux and the stock Samba packages.
> 
> @Louis - Rowland is very good at parroting back meaningless
> information and proving that "something should work" however he
is
> utterly useless at getting to the bottom of an issue, or understand
> that this MIGHT NOT BE a configuration issue. I don't know that makes
> him a "good guy"
Could it have anything to do with me being a member of the Samba
team ???

Whilst it might not be a configuration problem, this is unlikely,
unless you have altered the samba packages or have a mix up between the
various Samba packages that Arch provides.

I have it working, you say you have it working on test DC, it just
doesn't work on your main DC. All I can suggest is, see if you can see
any differences between the packages on your test machine and your main
DC, different versions, conf files etc.

I, or anybody else, cannot do any more than this, we do not have access
to your machines.

Rowland

Now... we are not getting anyware this way, and flaming one other does not help.

So we need this answeres before we can contiue.
Please do not refer to previous posts, i want the current configs.

Post you smb.conf complete please.
You may change names of domains and/or ipadress but leave all other things in
it.

wbinfo -i "testuser" failed to call wbcGetpwnam:
WBC_ERR_DOMAIN_NOT_FOUND Could not get info for user testuser
Is 99.9% of all cases a incorrect (idmap) config in smb.conf

And :
> > @Louis - Rowland is very good at parroting back meaningless 
> > information and proving that "something should work" however
he is
> > utterly useless at getting to the bottom of an issue, or understand 
> > that this MIGHT NOT BE a configuration issue. I don't know 
> > that makes him a "good guy"
Its simple, Rowland, me ( and others) are on this list for years now. 
Rowland is more up2date with current settting within samba. 
I just a sysadmin with lots of different configs and due to that i know a lot.

What i dont know, Rowland often knows and vicaversa. 
And due to his kindness, helpfullness and knowledge and how i know him over the
years, i can say, yes, he is a good guy.

Now you other hand, how long are you on the list. 
Remember, we do try to help you out, if we ask for something like settings, its
because we want/try to help you.
And we need info for that.

I even try to help you in my holiday, and im still waiting on this
answer.
> did you check the change logs as of your old version up to this 
> version? 4.5.8 isnt 12-18 months old. 
What was the previous version?? 
Did you check the change logs??

Review you config, start here. 
https://wiki.archlinux.org/index.php/Active_Directory_Integration#Kerberos

And stop at the "Samba" part, since thats about a member server.


And now start reading: 
https://wiki.samba.org/index.php/Configuring_Winbindd_on_a_Samba_AD_DC 
And check you setup. 

Last, check if pam-krb5 is installed on the problem DC, if not, install it.
And yes pam-krb5... (stop banging you head to the wall please.. ) ;-) 

Why, for example in pam_winbind used krb5_auth, like this.
auth    [success=1 default=ignore]      pam_winbind.so krb5_auth krb5_ccache_typ

If this all does not help, i can only give you one good solution. 

Install a new DC, since that one worked, join the old domain, test again, if all
correct.
Move the FSMO roles to the new server, and demote the old and remove it. 



Greetz, 

Louis



> -----Oorspronkelijk bericht-----
> Van: samba [mailto:samba-bounces at lists.samba.org] Namens 
> Rowland Penny via samba
> Verzonden: donderdag 8 juni 2017 13:48
> Aan: samba at lists.samba.org
> Onderwerp: Re: [Samba] failed to call 
> wbcGetpwnam/wbcGetgrnam/wbcGetpwsid WBC_ERR_DOMAIN_NOT_FOUND
> 
> On Thu, 8 Jun 2017 12:20:22 +0100
> Alex Matthews via samba <samba at lists.samba.org> wrote:
> 
> > > You don't have any idmap configuration in that smb.conf.
> > Correct. That is my idmap configuration.
> > 
> > > At last, there is your problem, you need PAM because you 
> need Unix 
> > > authentication.
> > If you set up PAM 'getent passwd testuser' will work.
> > 
> > <bangs head against a brick wall HARD> That is NOT my 
> problem because 
> > I am not trying to get unix auth to work... I am trying to 
> get wbinfo 
> > to work wbinfo and 'getent passwd username' do not require 
> PAM to be 
> > configured.
> 
> Well, there has to be a first time for everything, but whilst
'wbinfo'
> doesn't need PAM, 'getent' certainly does.
> 
> > 
> > To prove this, I have just created a dummy domain 
> controller and DID 
> > NO PAM CONFIGURATION AT ALL and guess what, 'getent passwd
username'
> > works, as do the wbinfo lines.
> 
> I did the same and getent didn't work for me until I altered PAM.
> 
> >  So will you please stop harping on
> > about PAM. It has NOTHING to do with this issue. My problem is 
> > something deep within samba. Something has gone AWOL somewhere. I 
> > don't believe it is a configuration issue.
> 
> I feel it must be a configuration problem, because I had it 
> working with Arch linux and the stock Samba packages.
> 
> > 
> > @Louis - Rowland is very good at parroting back meaningless 
> > information and proving that "something should work" however
he is
> > utterly useless at getting to the bottom of an issue, or understand 
> > that this MIGHT NOT BE a configuration issue. I don't know 
> that makes 
> > him a "good guy"
> 
> Could it have anything to do with me being a member of the 
> Samba team ???
> 
> Whilst it might not be a configuration problem, this is 
> unlikely, unless you have altered the samba packages or have 
> a mix up between the various Samba packages that Arch provides.
> 
> I have it working, you say you have it working on test DC, it 
> just doesn't work on your main DC. All I can suggest is, see 
> if you can see any differences between the packages on your 
> test machine and your main DC, different versions, conf files etc.
> 
> I, or anybody else, cannot do any more than this, we do not 
> have access to your machines.
> 
> Rowland
> 
> --
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba
> 
>