samba - Oct 2020 - question about winbind rid idmaping

On Thu, Oct 29, 2020 at 7:21 AM Rowland penny via samba <
samba at lists.samba.org> wrote:
> On 29/10/2020 11:04, Andrea Cucciarre' via samba wrote:
> > Hello,
> >
> > I have just realized that winbind rid idmapping create the following
> > idmapping for user, below an example:
> >
> > # id HYPERFILE\\simone
> > *uid=11663*(HYPERFILE\simone) gid=10513(HYPERFILE\domain users)
> > groups=10513(HYPERFILE\domain
> > users),*11663*(HYPERFILE\simone),3011(BUILTIN\users)
> >
> > I'm confused about group mapping 11663(HYPERFILE\simone), winbind
> > created a mapping for a group that has same name and id as the user,
> > although such group doesn't exist in my AD domain.
> > This is causing issue in the ACL module that we are developing.
> > Does anybody know why winbind behave that way?
>
> No.
>
> I didn't think it could, the winbind 'rid' calculates the ID
from the
> user or group RID and user & group names are unique. This means that
you
> cannot have a user with the same name as a group, so you can only have
> one RID.
>
> The only thing that I know that can 'create' usergroups is sssd, so
are
> you using this as well ?
>
> I think more info is required here, what OS ? What version of Samba ?
> Please post your smb.conf
>
> Rowland
>
> Several of the idmap backends (including idmap_rid) in samba support
id_type_both (the ID is both a user and a group). This is ultimately needed
for accurately producing Windows-style behavior regarding permissions
(where a group can be the owner of a file). Without knowing the details of
the ACL module, the best path forward would be for you to figure out how to
maintain windows-like behavior.

On 29/10/2020 11:56, Andrew Walker wrote:
>
>
> Several of the idmap backends (including idmap_rid) in samba support 
> id_type_both (the ID is both a user and a group). This is ultimately 
> needed for accurately producing Windows-style behavior regarding 
> permissions (where a group can be the owner of a file). Without 
> knowing the details of the ACL module, the best path forward would be 
> for you to figure out how to maintain windows-like behavior.
The only place that I have found id_type_both to be used, is in 
idmap.ldb on a Samba AD DC. Windows behaviour is for a group to be able 
to own files. Unix has no such concept, but it is possible for a user & 
a group to have the same name, this is not possible on Windows.

We need more info to diagnose this problem.

Rowland

Hello,

My system is merely a Samba AD member (not a Samba DC).
The system is a CentOS:

# cat /etc/centos-release
CentOS Linux release 8.2.2004 (Core)

and we are running the following Samba version:

# smbd --version
Version 4.11.2

There's no sssd running, we use only winbindd for id mapping, below my 
smb.conf:

[global]
security = ads
realm = HYPERFILE.LOCAL
workgroup = HYPERFILE
netbios name = HF-1
log file = /hyperfile/gluster-cache/logs/winbindd/1/log.%I
idmap config * : backend = tdb
idmap config * : range = 3000-7999
idmap config HYPERFILE : backend = rid
idmap config HYPERFILE : range = 10000-999999
log level = 5
max log size = 10000
winbind refresh tickets = Yes
winbind offline logon = true
vfs objects = acl_xattr
map acl inherit = Yes
store dos attributes = Yes
dedicated keytab file = /hyperfile/winbindd/1/keytabs/krb5.keytab
kerberos method = secrets and keytab
winbind enum groups = yes
winbind enum users = yes
client signing = yes
client use spnego = yes
template shell = /bin/bash
template homedir = /home/%U

Thanks
Andrea


On 10/29/2020 1:07 PM, Rowland penny via samba wrote:
> On 29/10/2020 11:56, Andrew Walker wrote:
>>
>>
>> Several of the idmap backends (including idmap_rid) in samba support 
>> id_type_both (the ID is both a user and a group). This is ultimately 
>> needed for accurately producing Windows-style behavior regarding 
>> permissions (where a group can be the owner of a file). Without 
>> knowing the details of the ACL module, the best path forward would be 
>> for you to figure out how to maintain windows-like behavior.
>
> The only place that I have found id_type_both to be used, is in 
> idmap.ldb on a Samba AD DC. Windows behaviour is for a group to be 
> able to own files. Unix has no such concept, but it is possible for a 
> user & a group to have the same name, this is not possible on Windows.
>
> We need more info to diagnose this problem.
>
> Rowland
>
>
>

On Thu, Oct 29, 2020 at 8:07 AM Rowland penny via samba <
samba at lists.samba.org> wrote:
> On 29/10/2020 11:56, Andrew Walker wrote:
> >
> >
> > Several of the idmap backends (including idmap_rid) in samba support
> > id_type_both (the ID is both a user and a group). This is ultimately
> > needed for accurately producing Windows-style behavior regarding
> > permissions (where a group can be the owner of a file). Without
> > knowing the details of the ACL module, the best path forward would be
> > for you to figure out how to maintain windows-like behavior.
>
> The only place that I have found id_type_both to be used, is in
> idmap.ldb on a Samba AD DC.
RID also does this. You can see in the sid<->id mapping functions in
source3/winbindd/idmap_rid.c.

Andrea, you can look at the common nfsv4 code (source3/modules/nfs4_acls.c)
to see how ID_TYPE_BOTH is dealt with there (for instance
nfs4_acl_add_sec_ace()). Can you perhaps give more details about your ACL
modules (or a link to the source)?

Am 10/29/20 um 1:07 PM schrieb Rowland penny via samba:
> On 29/10/2020 11:56, Andrew Walker wrote:
>> Several of the idmap backends (including idmap_rid) in samba support
>> id_type_both (the ID is both a user and a group). This is ultimately
>> needed for accurately producing Windows-style behavior regarding
>> permissions (where a group can be the owner of a file). Without
>> knowing the details of the ACL module, the best path forward would be
>> for you to figure out how to maintain windows-like behavior.
> 
> The only place that I have found id_type_both to be used, is in
> idmap.ldb on a Samba AD DC.
it's also supported by a bunch of idmap modules including rid and
autorid, but not ad ...
> Windows behaviour is for a group to be able
> to own files.
...for exactly the same reason (plus others like supporting SID history).

-slow

-- 
Ralph Boehme, Samba Team                https://samba.org/
Samba Developer, SerNet GmbH   https://sernet.de/en/samba/
GPG-Fingerprint   FAE2C6088A24252051C559E4AA1E9B7126399E46

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL:
<http://lists.samba.org/pipermail/samba/attachments/20201029/099583b7/signature.sig>