I have a Samba problem with eGroupware. Samba 4 is screwing with my eGroupware UIDs causing Havoc. Samba 4 uses the last four Digits of the SID rather than the UID Number. I need to know how to alter my user entry SID so that the last four digits of the SID is congruent with the UID Numbers of my users. To fix this; I need the ability to edit the last digits of the SID. I've tried shutting down the Samba server and using ldbmodify, but that isn't working. The SiD is in some sort of strange Hash. pdbedit and samba-tool gives me the error: ?? - samldb: objectSid must not be specified! I'm, quickly approaching the need to re-provision my entire Domain, because I Have already corrected this stuff in my older OpenLDAP system. I'd have to re-run Classic Upgrade. I'd rather not lose all my progress. Please help!
> I have a Samba problem with eGroupware. Samba 4 is screwing with my > > eGroupware UIDs causing Havoc. Samba 4 uses the last four Digits of the > SID rather than the UID Number. I need to know how to alter my user > entry SID so that the last four digits of the SID is congruent with the > UID Numbers of my users. > > To fix this; I need the ability to edit the last digits of the SID. I've > tried shutting down the Samba server and using ldbmodify, but that isn't > working. The SiD is in some sort of strange Hash. pdbedit and samba-tool > gives me the error: ?? - samldb: objectSid must not be specified! > > I'm, quickly approaching the need to re-provision my entire Domain, > because I Have already corrected this stuff in my older OpenLDAP system. > I'd have to re-run Classic Upgrade. I'd rather not lose all my progress. > Please help! > >
On 02/07/2019 10:31, Zombie Ryushu via samba wrote:> I have a Samba problem with eGroupware. Samba 4 is screwing with my > > eGroupware UIDs causing Havoc. Samba 4 uses the last four Digits of the > SID rather than the UID Number.If you are running Samba as an AD DC, then Unix UID != RID (what you are referring to as the 'last four Digits')> I need to know how to alter my user > entry SID so that the last four digits of the SID is congruent with the > UID Numbers of my users.Do not even think of doing this, it will break AD.> > To fix this; I need the ability to edit the last digits of the SID. I've > tried shutting down the Samba server and using ldbmodify, but that isn't > working. The SiD is in some sort of strange Hash. pdbedit and samba-tool > gives me the error: ?? - samldb: objectSid must not be specified! > > I'm, quickly approaching the need to re-provision my entire Domain, > because I Have already corrected this stuff in my older OpenLDAP system. > I'd have to re-run Classic Upgrade. I'd rather not lose all my progress. > Please help!Classicupgrade is probably the way to go. Sounds like you need to tell us just how you are running Samba at the moment. Rowland> > >
On 02/07/2019 11:03, Zombie Ryushu via samba wrote:>> I have a Samba problem with eGroupware. Samba 4 is screwing with my >> >> eGroupware UIDs causing Havoc. Samba 4 uses the last four Digits of the >> SID rather than the UID Number. I need to know how to alter my user >> entry SID so that the last four digits of the SID is congruent with the >> UID Numbers of my users. >> >> To fix this; I need the ability to edit the last digits of the SID. I've >> tried shutting down the Samba server and using ldbmodify, but that isn't >> working. The SiD is in some sort of strange Hash. pdbedit and samba-tool >> gives me the error: ?? - samldb: objectSid must not be specified! >> >> I'm, quickly approaching the need to re-provision my entire Domain, >> because I Have already corrected this stuff in my older OpenLDAP system. >> I'd have to re-run Classic Upgrade. I'd rather not lose all my progress. >> Please help! >> >> >?????????????????? Rowland
On 07/02/2019 06:10 AM, Rowland penny via samba wrote:> On 02/07/2019 10:31, Zombie Ryushu via samba wrote: >> I have a Samba problem with eGroupware. Samba 4 is screwing with my >> >> eGroupware UIDs causing Havoc. Samba 4 uses the last four Digits of the >> SID rather than the UID Number. > > If you are running Samba as an AD DC, then Unix UID != RID (what you > are referring to as the 'last four Digits') > > >> ?? I need to know how to alter my user >> entry SID so that the last four digits of the SID is congruent with the >> UID Numbers of my users. > Do not even think of doing this, it will break AD. >> >> To fix this; I need the ability to edit the last digits of the SID. I've >> tried shutting down the Samba server and using ldbmodify, but that isn't >> working. The SiD is in some sort of strange Hash. pdbedit and samba-tool >> gives me the error: ?? - samldb: objectSid must not be specified! >> >> I'm, quickly approaching the need to re-provision my entire Domain, >> because I Have already corrected this stuff in my older OpenLDAP system. >> I'd have to re-run Classic Upgrade. I'd rather not lose all my progress. >> Please help! > > Classicupgrade is probably the way to go. > > Sounds like you need to tell us just how you are running Samba at the > moment. > > Rowland > > >> >> >> > >I am running Samba 4 as an AD, on one system, but I have a legacy OpenLDAP system that runs Samba in NT PDC mode that I am migrating from. There are two Domain Controllers, one migrated, one is not. The origin of the wrong SIDs is actually OpenLDAP. The same SIDs were migrated over. eGroupware is one of the few programs with an outright Samba 4 (Active Directory) Mode. In OpenLDAP mode, eGroupware will use uidNumber. in Samba 4 AD mode, eGroupware will use the last digits of the SID to determine the eGroupware ID. everything from E-mail ACLs for Thunderbird, to Calender Items and Contacts use this as a Primary key in its database. So what has been happening, is that if, say the Unix UID is 501, and the Object SID ends in 998, eGroupware will assume the UID is 998. This is because they were wrong in OpenLDAP, and when the Classic Upgrade was run, that carried over. Now I need to find a way to correct all of them.