samba - Jun 2020 - GID to group name mapping failure

Hi,

I've ended up in a weird situation with my Windows AD environment.
My linux host was originally joined to the domain. For some reason,
the domain server got reset and created a fresh domain with the same
name and all the AD objects (including users/groups) were recreated.

After this, I tried leaving the domain (which was failing with 'No
such file or directory' error). I then joined the domain again, which
went through successfully. Mounting the cifs share worked too.
However, winbindd is unable to map the GID to the group name.

I think that SID for both user and group may have changed from the
last time I was domain joined.

lxsmbadmin at lxsmb-canvm15:~/mnt/lxsmbcanacc1/share1/lxsmbadmin$ getent
group 'domain users'
domain users:x:10513:

lxsmbadmin at lxsmb-canvm15:~/mnt/lxsmbcanacc1/share1/lxsmbadmin$ id
uid=11195(lxsmbadmin) gid=10513
groups=10513,3001(BUILTIN\users),10520(group policy creator
owners),10572(denied rodc password replication
group),11102(dnsadmins),11104(aad dc
administrators),11195(lxsmbadmin),11266(fileshareallaccess),11273(group-readwrite)

lxsmbadmin at lxsmb-canvm15:~/mnt/lxsmbcanacc1/share1/lxsmbadmin$ stat file
  File: file
  Size: 0               Blocks: 0          IO Block: 1048576 regular empty file
Device: 34h/52d Inode: 11529346987463802880  Links: 1
Access: (0700/-rwx------)  Uid: (11195/lxsmbadmin)   Gid: (10513/ UNKNOWN)
Access: 2020-06-15 12:55:14.153863400 +0000
Modify: 2020-06-15 12:55:14.153863400 +0000
Change: 2020-06-15 13:10:20.279420600 +0000
 Birth: -

Attached the debug level logs and smb.conf for your reference.

-- 
-Shyam

On 16/06/2020 10:52, Shyam Prasad N via samba-technical
wrote:
> Hi,
>
> I've ended up in a weird situation with my Windows AD environment.
> My linux host was originally joined to the domain. For some reason,
> the domain server got reset and created a fresh domain with the same
> name and all the AD objects (including users/groups) were recreated.
How on earth did that happen ?

If it is a 'new' domain then it will have a new domain SID.
> However, winbindd is unable to map the GID to the group name.
>
> I think that SID for both user and group may have changed from the
> last time I was domain joined.
Whilst the users & groups SID may have changed, the winbind 'rid' 
backend uses the 'RID' to identify the user or group. This means that 
the users RID may have changed (along with the domain SID), but the RID 
for Domain Users is fixed at '513'. So, it looks like this is a domain 
SID problem.

I would try leaving the domain again, reboot the computer, then re-join 
the domain. If this doesn't work, you may have to delete the .tdb files 
from /var/lib/samba

Rowland