samba - Nov 2018 - How to Samba share with mixed Active Directory 'Classic' authentication

On Thu, 14 Jun 2018 16:03:35 -0400
Mark Foley via samba <samba at lists.samba.org> wrote:
> Nevertheless, 'ls' does give names though I don't seem to have
either
> libnss-winbind or libpam-winbind files on my AD/DC.
I keep forgetting that you use slackware, I suppose it uses something
different, but do you have any file like: libnss_winbind.so.2
> 
> Circling back to the OP, with 4.4.16 I got:  
> 
> > ls -l
>
/var/lib/samba/sysvol/hprs.local/policies/\{B78D19CB-914B-48F4-AA63-FD8708A553D7\}/Machine/
> total 16
> drwxrwx--- 3 BUILTIN\administrators users 4096 2014-09-13 03:22
> Microsoft/ -rwxrwx--- 1 BUILTIN\administrators users  958 2014-09-13
> 04:01 Registry.pol* drwxrwx--- 4 BUILTIN\administrators users 4096
> 2014-09-13 03:22 Scripts/
> 
> Now, with 4.8.2, doing the same ls gives me:
> 
> > ls -l
>
/var/lib/samba/sysvol/hprs.local/policies/\{B78D19CB-914B-48F4-AA63-FD8708A553D7\}/Machine/
> total 16
> drwxrwx--- 3 3000000 users 4096 2014-09-13 03:22 Microsoft/
> -rwxrwx--- 1 3000000 users  958 2014-09-13 04:01 Registry.pol*
> drwxrwx--- 4 3000000 users 4096 2014-09-13 03:22 Scripts/
> 
> I'm still not sure I've gleaned an answer. I'll check sam.ldb
and
> imap.ldb for clues.
For some reason, nsswitch (and/or idmap.ldb) isn't mapping '3000000'
to
'Administrators'
> 
> > > With 4.8.2 on my DC's i see: 
> > > ls -al sysvol/
> > > drwxrwx---+ 5 root BUILTIN\administrators 4096 Dec 21 13:14
> > > internal.domain.tld 
> 
> Funny you should mention that. I was going to post the same thing,
> mine is:
> 
> rwxrwxr--+ 3 root BUILTIN\administrators   4096 2014-09-03 00:46
> sysvol/
> 
> I thought it strange that it would list the 300000 groupname, but for
> files owned by 300000 it will only list the UID number, not the
> username. 
AH-Ha, the only place that maps an ID to a user AND a group is
idmap.ldb, where it get 'ID_TYPE_BOTH'. Have you given
'Administrators' a uidNumber ? or is it being mapped to
'ID_TYPE_UID'
in idmap.ldb ?


> 
> and am missing Louis':
> group:3000002:rwx
> group:3000003:r-x
> 
> whereas Louis has:
> group:BUILTIN\134server\040operators:r-x
> 
> For 'other' I have "other::r--" whereas Louis has
"other::---"
> 
> For default I am again missing user 3000001 and my 3000003 is rwx
> rather than Louis' r-x. My 'default-group' is "r-x",
Louis' "---".
> Same group difference with 'default' as mentioned above with my
> 040AUTHORITY and Louis' 040operators.
> My "default:other::r-x", Louis'
"default:other::---"
> 
> Are my different settings bad?
Not necessarily, different DC's get different ID's for the
users/groups.
> 
> > And Louis also uses 'acl_xattr:ignore system acls = yes', 
> 
> How do you know that? I don't see that listed in Louis' message?
I just do ;-)

Try reading 'man vfs_acl_xattr'
> 
> > this means that you can ignore the system ACL and what getfacl
> > produces.
> >
> > The permissions you set from windows is actually stored in in
> > 'security.NTACL'
> >
> > To see the contents of this attr:
> >
> > getfattr -n security.NTACL /home/testdata
> > getfattr: Removing leading '/' from absolute path names
> > # file: home/testdata
> > security.NTACL=0sAwA [deleted] KCAAA
> >
> > Not very readable is it ?
> 
> Tried that on /var/lib/samba/sysvol. Yup, gobbledygook!
Just set them from Windows and ignore the Unix acls

Rowland

On Thu, 14 Jun 2018 21:37:58 +0100 Rowland Penny wrote:
>
> On Thu, 14 Jun 2018 16:03:35 -0400
> Mark Foley via samba <samba at lists.samba.org> wrote:
>
> > Nevertheless, 'ls' does give names though I don't seem to
have either
> > libnss-winbind or libpam-winbind files on my AD/DC.
>
> I keep forgetting that you use slackware, I suppose it uses something
> different, but do you have any file like: libnss_winbind.so.2
Yes, I have:

-rwxr-xr-x 1 root root 13928 2015-04-17 12:46:33
/usr/lib64/pppd/2.4.7/winbind.so
-rwxr-xr-x 1 root root 47864 2016-06-23 18:40:38
/usr/lib64/kde4/kgreet_winbind.so
-rwxr-xr-x 1 root root 1307104 2018-06-10 22:37:16
/usr/lib64/python2.7/site-packages/samba/dcerpc/winbind.so
-rwxr-xr-x 1 root root 14112 2018-06-10 22:37:16 /usr/lib64/libnss_winbind.so.2
lrwxrwxrwx 1 root root 19 2018-06-10 22:39:17 /usr/lib64/libnss_winbind.so ->
libnss_winbind.so.2

Might it be prudent to remove (or rename) the lib modules from 2015 and 2016?
Perhaps the lib
search order is picking up the wrong one.
> > Circling back to the OP, with 4.4.16 I got:  
> > 
> > > ls -l
> >
/var/lib/samba/sysvol/hprs.local/policies/\{B78D19CB-914B-48F4-AA63-FD8708A553D7\}/Machine/
> > total 16
> > drwxrwx--- 3 BUILTIN\administrators users 4096 2014-09-13 03:22
> > Microsoft/ -rwxrwx--- 1 BUILTIN\administrators users  958 2014-09-13
> > 04:01 Registry.pol* drwxrwx--- 4 BUILTIN\administrators users 4096
> > 2014-09-13 03:22 Scripts/
> > 
> > Now, with 4.8.2, doing the same ls gives me:
> > 
> > > ls -l
> >
/var/lib/samba/sysvol/hprs.local/policies/\{B78D19CB-914B-48F4-AA63-FD8708A553D7\}/Machine/
> > total 16
> > drwxrwx--- 3 3000000 users 4096 2014-09-13 03:22 Microsoft/
> > -rwxrwx--- 1 3000000 users  958 2014-09-13 04:01 Registry.pol*
> > drwxrwx--- 4 3000000 users 4096 2014-09-13 03:22 Scripts/
> > 
> > I'm still not sure I've gleaned an answer. I'll check
sam.ldb and
> > imap.ldb for clues.
> For some reason, nsswitch (and/or idmap.ldb) isn't mapping
'3000000' to
> 'Administrators'
... but it used to with 4.4.16 ...

in my idmap.ldb I have only:

# record 71
dn: CN=S-1-5-32-544
cn: S-1-5-32-544
objectClass: sidMap
objectSid: S-1-5-32-544
type: ID_TYPE_BOTH
xidNumber: 3000000
distinguishedName: CN=S-1-5-32-544

in sam.ldb for objectSID: S-1-5-32-544, I have:

# record 163   
dn: CN=Administrators,CN=Builtin,DC=hprs,DC=local
objectClass: top
objectClass: group
cn: Administrators
description: Administrators have complete and unrestricted access to the compu
 ter/domain
instanceType: 4
whenCreated: 20140903044615.0Z
uSNCreated: 3562
name: Administrators
objectGUID: 06970ceb-a0bb-4d7a-b878-51f54ac210bd
objectSid: S-1-5-32-544
adminCount: 1
sAMAccountName: Administrators
sAMAccountType: 536870912
systemFlags: -1946157056
groupType: -2147483643
objectCategory: CN=Group,CN=Schema,CN=Configuration,DC=hprs,DC=local
isCriticalSystemObject: TRUE  
whenChanged: 20150825012848.0Z
uSNChanged: 6468
member: CN=Enterprise Admins,CN=Users,DC=hprs,DC=local
member: CN=Domain Admins,CN=Users,DC=hprs,DC=local
member: CN=Administrator,CN=Users,DC=hprs,DC=local
distinguishedName: CN=Administrators,CN=Builtin,DC=hprs,DC=local

Is there someplace else I can look for this? In ADUC for the
'Administrator' I have nothing in
NIS Domain, UID or Primary Group name/GID.  Should I for this user, or is
'Administrator'
"special"?

For all "normal" domain users I have:

NIS Domain: hprs
UID: 1000x
Primary group name/GID: Domain Users
> > > > With 4.8.2 on my DC's i see: 
> > > > ls -al sysvol/
> > > > drwxrwx---+ 5 root BUILTIN\administrators 4096 Dec 21 13:14
> > > > internal.domain.tld 
> > 
> > Funny you should mention that. I was going to post the same thing,
> > mine is:
> > 
> > rwxrwxr--+ 3 root BUILTIN\administrators   4096 2014-09-03 00:46
> > sysvol/
> > 
> > I thought it strange that it would list the 300000 groupname, but for
> > files owned by 300000 it will only list the UID number, not the
> > username. 
>
> AH-Ha, the only place that maps an ID to a user AND a group is
> idmap.ldb, where it get 'ID_TYPE_BOTH'. Have you given
> 'Administrators' a uidNumber ? or is it being mapped to
'ID_TYPE_UID'
> in idmap.ldb ?
As shown in my idmap.ldb entry, it has "ID_TYPE_BOTH". A clue?
> > and am missing Louis':
> > group:3000002:rwx
> > group:3000003:r-x
> > 
> > whereas Louis has:
> > group:BUILTIN\134server\040operators:r-x
> > 
> > For 'other' I have "other::r--" whereas Louis has
"other::---"
> > 
> > For default I am again missing user 3000001 and my 3000003 is rwx
> > rather than Louis' r-x. My 'default-group' is
"r-x", Louis' "---".
> > Same group difference with 'default' as mentioned above with
my
> > 040AUTHORITY and Louis' 040operators.
> > My "default:other::r-x", Louis'
"default:other::---"
> > 
> > Are my different settings bad?
> Not necessarily, different DC's get different ID's for the
> users/groups.
OK, so not to worry here.
> > > And Louis also uses 'acl_xattr:ignore system acls = yes',
> > 
> > How do you know that? I don't see that listed in Louis'
message?
>
> I just do ;-)
>
> Try reading 'man vfs_acl_xattr'
The man page says in part:

 "When set to yes, a best effort mapping from/to the POSIX ACL layer will
not be done by this
  module.  The default is no, which means that Samba keeps setting and
evaluating both the system
  ACLs and the NT ACLs.  This is better if you need your system ACLs be set for
local or NFS file
  access, too.  If you only access the data via Samba you might set this to yes
to achieve better
  NT ACL compatibility."

then lists additional settings for file mods if 'yes' is selected. I
assume mine is set to the
default 'no'. So is this something I should fiddle with or is it no big
deal?
> > > this means that you can ignore the system ACL and what getfacl
> > > produces.
> > >
> > > The permissions you set from windows is actually stored in in
> > > 'security.NTACL'
> > >
> > > To see the contents of this attr:
> > >
> > > getfattr -n security.NTACL /home/testdata
> > > getfattr: Removing leading '/' from absolute path names
> > > # file: home/testdata
> > > security.NTACL=0sAwA [deleted] KCAAA
> > >
> > > Not very readable is it ?
> > 
> > Tried that on /var/lib/samba/sysvol. Yup, gobbledygook!
>
> Just set them from Windows and ignore the Unix acls
>
> Rowland
Which I assume answers the "no big deal" question just posed: not to
worry.

So, do you see anything amiss, e.g. with my idmap.ldb setting, ADUC?

--Mark

On Thu, 14 Jun 2018 20:10:03 -0400
Mark Foley via samba <samba at lists.samba.org> wrote:
> On Thu, 14 Jun 2018 21:37:58 +0100 Rowland Penny wrote:
> >
> > On Thu, 14 Jun 2018 16:03:35 -0400
> > Mark Foley via samba <samba at lists.samba.org> wrote:
> >
> > > Nevertheless, 'ls' does give names though I don't
seem to have
> > > either libnss-winbind or libpam-winbind files on my AD/DC.
> >
> > I keep forgetting that you use slackware, I suppose it uses
> > something different, but do you have any file like:
> > libnss_winbind.so.2
> 
> Yes, I have:
> 
> -rwxr-xr-x 1 root root 13928 2015-04-17
> 12:46:33 /usr/lib64/pppd/2.4.7/winbind.so -rwxr-xr-x 1 root root
> 47864 2016-06-23 18:40:38 /usr/lib64/kde4/kgreet_winbind.so
> -rwxr-xr-x 1 root root 1307104 2018-06-10
> 22:37:16 /usr/lib64/python2.7/site-packages/samba/dcerpc/winbind.so
> -rwxr-xr-x 1 root root 14112 2018-06-10
> 22:37:16 /usr/lib64/libnss_winbind.so.2 lrwxrwxrwx 1 root root 19
> 2018-06-10 22:39:17 /usr/lib64/libnss_winbind.so ->
> libnss_winbind.so.2
> 
> Might it be prudent to remove (or rename) the lib modules from 2015
> and 2016? Perhaps the lib search order is picking up the wrong one.
Unless something strange is going on (and I don't think it is), you
have the correct links, the others are for something else.
> 
> > > Circling back to the OP, with 4.4.16 I got:  
> > > 
> > > > ls -l
> > >
/var/lib/samba/sysvol/hprs.local/policies/\{B78D19CB-914B-48F4-AA63-FD8708A553D7\}/Machine/
> > > total 16
> > > drwxrwx--- 3 BUILTIN\administrators users 4096 2014-09-13 03:22
> > > Microsoft/ -rwxrwx--- 1 BUILTIN\administrators users  958
> > > 2014-09-13 04:01 Registry.pol* drwxrwx--- 4
> > > BUILTIN\administrators users 4096 2014-09-13 03:22 Scripts/
> > > 
> > > Now, with 4.8.2, doing the same ls gives me:
> > > 
> > > > ls -l
> > >
/var/lib/samba/sysvol/hprs.local/policies/\{B78D19CB-914B-48F4-AA63-FD8708A553D7\}/Machine/
> > > total 16
> > > drwxrwx--- 3 3000000 users 4096 2014-09-13 03:22 Microsoft/
> > > -rwxrwx--- 1 3000000 users  958 2014-09-13 04:01 Registry.pol*
> > > drwxrwx--- 4 3000000 users 4096 2014-09-13 03:22 Scripts/
> > > 
> > > I'm still not sure I've gleaned an answer. I'll check
sam.ldb and
> > > imap.ldb for clues.
> 
> > For some reason, nsswitch (and/or idmap.ldb) isn't mapping
> > '3000000' to 'Administrators'
> 
> ... but it used to with 4.4.16 ...
> 
> in my idmap.ldb I have only:
> 
> # record 71
> dn: CN=S-1-5-32-544
> cn: S-1-5-32-544
> objectClass: sidMap
> objectSid: S-1-5-32-544
> type: ID_TYPE_BOTH
> xidNumber: 3000000
> distinguishedName: CN=S-1-5-32-544
So '3000000' is 'Administrators' and is both a group and a user.
> 
> in sam.ldb for objectSID: S-1-5-32-544, I have:
> 
> # record 163   
> dn: CN=Administrators,CN=Builtin,DC=hprs,DC=local
> objectClass: top
> objectClass: group
> cn: Administrators
> description: Administrators have complete and unrestricted access to
> the compu ter/domain
> instanceType: 4
> whenCreated: 20140903044615.0Z
> uSNCreated: 3562
> name: Administrators
> objectGUID: 06970ceb-a0bb-4d7a-b878-51f54ac210bd
> objectSid: S-1-5-32-544
> adminCount: 1
> sAMAccountName: Administrators
> sAMAccountType: 536870912
> systemFlags: -1946157056
> groupType: -2147483643
> objectCategory: CN=Group,CN=Schema,CN=Configuration,DC=hprs,DC=local
> isCriticalSystemObject: TRUE  
> whenChanged: 20150825012848.0Z
> uSNChanged: 6468
> member: CN=Enterprise Admins,CN=Users,DC=hprs,DC=local
> member: CN=Domain Admins,CN=Users,DC=hprs,DC=local
> member: CN=Administrator,CN=Users,DC=hprs,DC=local
> distinguishedName: CN=Administrators,CN=Builtin,DC=hprs,DC=local
>
So no uidNumber or gidNumber.
 
> Is there someplace else I can look for this? In ADUC for the
> 'Administrator' I have nothing in NIS Domain, UID or Primary Group
> name/GID.  Should I for this user, or is 'Administrator'
"special"?
Good, you shouldn't have, if you look in idmap.ldb, you will find that
RID '500' is mapped to 'xidNumber' '0'.
 
> > AH-Ha, the only place that maps an ID to a user AND a group is
> > idmap.ldb, where it get 'ID_TYPE_BOTH'. Have you given
> > 'Administrators' a uidNumber ? or is it being mapped to
> > 'ID_TYPE_UID' in idmap.ldb ?
> 
> As shown in my idmap.ldb entry, it has "ID_TYPE_BOTH". A clue?
> 
Not really, more a poser, everything looks okay, but it still isn't
working fully, perhaps time to run 'net cache flush' again ?
> 
> > > > And Louis also uses 'acl_xattr:ignore system acls =
yes',
> > > 
> > > How do you know that? I don't see that listed in Louis'
message?
> >
> > I just do ;-)
> >
> > Try reading 'man vfs_acl_xattr'
> 
> The man page says in part:
> 
>  "When set to yes, a best effort mapping from/to the POSIX ACL layer
> will not be done by this module.  The default is no, which means that
> Samba keeps setting and evaluating both the system ACLs and the NT
> ACLs.  This is better if you need your system ACLs be set for local
> or NFS file access, too.  If you only access the data via Samba you
> might set this to yes to achieve better NT ACL compatibility."
> 
> then lists additional settings for file mods if 'yes' is selected.
I
> assume mine is set to the default 'no'. So is this something I
should
> fiddle with or is it no big deal?
From my understanding, when 'acl_xattr:ignore system acls = no' is set
(the default), Samba will attempt to change the ACLs when set from
Windows, it will use 'setfacl' whilst doing this, it will also write
the extended attributes to security.NTACL. If 'no' is changed to
'yes',
it does what it says on the tin, the Unix ACLs are ignored, you can
change them on the Unix side to whatever you like, but from the Windows
side, they will be ignored as if they were not there. From the
perspective of whether you should set it or not, I would tend towards
fixing your current problem first and decide later.
  
Rowland

On Fri, 15 Jun 2018 08:08:53 +0100 Rowland Penny <rpenny at samba.org>
wrote:
>
> On Thu, 14 Jun 2018 20:10:03 -0400
> Mark Foley via samba <samba at lists.samba.org> wrote:
>
> > On Thu, 14 Jun 2018 21:37:58 +0100 Rowland Penny wrote:
> > >
> > > On Thu, 14 Jun 2018 16:03:35 -0400
> > > Mark Foley via samba <samba at lists.samba.org> wrote:
> > >
> > > > Nevertheless, 'ls' does give names though I
don't seem to have
> > > > either libnss-winbind or libpam-winbind files on my AD/DC.
> > >
> > > I keep forgetting that you use slackware, I suppose it uses
> > > something different, but do you have any file like:
> > > libnss_winbind.so.2
> > 
> > Yes, I have:
> > 
> > -rwxr-xr-x 1 root root 13928 2015-04-17
> > 12:46:33 /usr/lib64/pppd/2.4.7/winbind.so -rwxr-xr-x 1 root root
> > 47864 2016-06-23 18:40:38 /usr/lib64/kde4/kgreet_winbind.so
> > -rwxr-xr-x 1 root root 1307104 2018-06-10
> > 22:37:16 /usr/lib64/python2.7/site-packages/samba/dcerpc/winbind.so
> > -rwxr-xr-x 1 root root 14112 2018-06-10
> > 22:37:16 /usr/lib64/libnss_winbind.so.2 lrwxrwxrwx 1 root root 19
> > 2018-06-10 22:39:17 /usr/lib64/libnss_winbind.so ->
> > libnss_winbind.so.2
> > 
> > Might it be prudent to remove (or rename) the lib modules from 2015
> > and 2016? Perhaps the lib search order is picking up the wrong one.
>
> Unless something strange is going on (and I don't think it is), you
> have the correct links, the others are for something else.
>
> > 
> > > > Circling back to the OP, with 4.4.16 I got:  
> > > > 
> > > > > ls -l
> > > >
/var/lib/samba/sysvol/hprs.local/policies/\{B78D19CB-914B-48F4-AA63-FD8708A553D7\}/Machine/
> > > > total 16
> > > > drwxrwx--- 3 BUILTIN\administrators users 4096 2014-09-13
03:22
> > > > Microsoft/ -rwxrwx--- 1 BUILTIN\administrators users  958
> > > > 2014-09-13 04:01 Registry.pol* drwxrwx--- 4
> > > > BUILTIN\administrators users 4096 2014-09-13 03:22 Scripts/
> > > > 
> > > > Now, with 4.8.2, doing the same ls gives me:
> > > > 
> > > > > ls -l
> > > >
/var/lib/samba/sysvol/hprs.local/policies/\{B78D19CB-914B-48F4-AA63-FD8708A553D7\}/Machine/
> > > > total 16
> > > > drwxrwx--- 3 3000000 users 4096 2014-09-13 03:22 Microsoft/
> > > > -rwxrwx--- 1 3000000 users  958 2014-09-13 04:01
Registry.pol*
> > > > drwxrwx--- 4 3000000 users 4096 2014-09-13 03:22 Scripts/
> > > > 
> > > > I'm still not sure I've gleaned an answer. I'll
check sam.ldb and
> > > > imap.ldb for clues.
> > 
> > > For some reason, nsswitch (and/or idmap.ldb) isn't mapping
> > > '3000000' to 'Administrators'
> > 
> > ... but it used to with 4.4.16 ...
> > 
> > in my idmap.ldb I have only:
> > 
> > # record 71
> > dn: CN=S-1-5-32-544
> > cn: S-1-5-32-544
> > objectClass: sidMap
> > objectSid: S-1-5-32-544
> > type: ID_TYPE_BOTH
> > xidNumber: 3000000
> > distinguishedName: CN=S-1-5-32-544
>
> So '3000000' is 'Administrators' and is both a group and a
user.
>
> > 
> > in sam.ldb for objectSID: S-1-5-32-544, I have:
> > 
> > # record 163   
> > dn: CN=Administrators,CN=Builtin,DC=hprs,DC=local
> > objectClass: top
> > objectClass: group
> > cn: Administrators
> > description: Administrators have complete and unrestricted access to
> > the compu ter/domain
> > instanceType: 4
> > whenCreated: 20140903044615.0Z
> > uSNCreated: 3562
> > name: Administrators
> > objectGUID: 06970ceb-a0bb-4d7a-b878-51f54ac210bd
> > objectSid: S-1-5-32-544
> > adminCount: 1
> > sAMAccountName: Administrators
> > sAMAccountType: 536870912
> > systemFlags: -1946157056
> > groupType: -2147483643
> > objectCategory: CN=Group,CN=Schema,CN=Configuration,DC=hprs,DC=local
> > isCriticalSystemObject: TRUE  
> > whenChanged: 20150825012848.0Z
> > uSNChanged: 6468
> > member: CN=Enterprise Admins,CN=Users,DC=hprs,DC=local
> > member: CN=Domain Admins,CN=Users,DC=hprs,DC=local
> > member: CN=Administrator,CN=Users,DC=hprs,DC=local
> > distinguishedName: CN=Administrators,CN=Builtin,DC=hprs,DC=local
> >
>
> So no uidNumber or gidNumber.
>  
> > Is there someplace else I can look for this? In ADUC for the
> > 'Administrator' I have nothing in NIS Domain, UID or Primary
Group
> > name/GID.  Should I for this user, or is 'Administrator'
"special"?
>
> Good, you shouldn't have, if you look in idmap.ldb, you will find that
> RID '500' is mapped to 'xidNumber' '0'.
>  
> > > AH-Ha, the only place that maps an ID to a user AND a group is
> > > idmap.ldb, where it get 'ID_TYPE_BOTH'. Have you given
> > > 'Administrators' a uidNumber ? or is it being mapped to
> > > 'ID_TYPE_UID' in idmap.ldb ?
> > 
> > As shown in my idmap.ldb entry, it has "ID_TYPE_BOTH". A
clue?
> > 
>
> Not really, more a poser, everything looks okay, but it still isn't
> working fully, perhaps time to run 'net cache flush' again ?
ran 'net cache flush', then restarted samba. No change. 

So, libnss_winbind.so is correct, idmap.ldb is correct, sam.ldb is correct, ADUC
is correct,
yet still getting only UID on 'ls' for BUILTIN\administrators.  I'm
Stumped!

Is there anything else to check/try?

[acl_xattr stuff deleted]

--Mark

I have a Samba4 AD Domain with one of the file servers as a domain member. This
file server
host the main network shares for the domain. Currently, Windows users mapping
this share are
authenticated using their AD domain credentials. That all works just fine.

What I want to do now is ALSO allow a user on a network host which IS NOT a
domain member, and
the user is not domain users to also map/mount this share, possibly via the
"Classic"
'security = user' mechanism. Can this be done? That is, can both
mechanisms be accomodated somehow?

THX --Mark

Below is the current smb.conf with 'security = ADS' and various idmaps.

[global]
netbios name = OHPRSSTORAGE

# workgroup = NT-Domain-Name or Workgroup-Name, eg: LINUX2
#   workgroup = WORKGROUP

# server string is the equivalent of the NT Description field
   server string = HPRS NAS server

domain master = no
prefered master = no

realm = HPRS.LOCAL
workgroup = HPRS
usershare allow guests = Yes
usershare max shares = 10
security = ADS
template shell = /bin/bash

max log size = 10000

load printers = no
printing = bsd
printcap name = /dev/null
disable spoolss = yes
                
idmap config *:backend = tdb
idmap config *:range = 2000-9999
idmap config HPRS:backend = ad
idmap config HPRS:schema_mode = rfc2307
idmap config HPRS:range = 10000-10099

winbind enum groups = Yes
winbind enum users = Yes
winbind nss info = rfc2307
winbind offline logon = Yes
winbind refresh tickets = Yes
winbind use default domain = Yes

[public]
comment = OHPRS main file and document repository
path = /mnt/RAID/public

# for the following settings see:
https://www.samba.org/samba/docs/using_samba/ch08.html
hide dot files = yes
# set o+x to mark a file as hidden (doesn't work for folders)
map hidden = yes
# User's outlook .pst files are in a folder named "outlook"
hide files = /Outlook/outlook/~*/

# locking: https://www.samba.org/samba/docs/using_samba/ch08.html
veto oplock files = /OfficeCalendar.pst/

inherit acls = yes
valid users = @"domain users"

# guest ok = yes
# guest only = yes

locking = yes
public = yes
writeable = yes
browseable= yes
printable = no
create mask = 0660
force user = ohprso
force group = ohprs
force create mode = 0660
directory mask = 2771