samba - Jan 2021 - create container object type using samba-tool

On 07/01/2021 14:32, James Nord via samba wrote:
> Hi all,
>
> I can't find any way (which is either I am missing it, or it does not
> exist) to create a container type in a Samba AD setup.
This all depends on whether you mean 'OU' or 'CN'

>
> fallback is to do this with ldapmodify - but this has some issues as I am
> trying to setup a large / complex AD tree in docker to be able to use it
> for some performance testing of a product and the ldap tool needs to be
> told passwords and the domain structure rather than just have a
> relative PATH, as well as some race conditions that makes it a little flaky
> to use this approach :(
Use ldbmodify instead, this will allow you to use kerberos.

>
> Does anyone know if it is possible to do using samba native tooling?
>
> In other words, under an OU I would like some containers so I can separate
> out various types of other things like (users, contractors, groups, etc..)
If you mean you want to use 'OU', then run 'samba-tool ou
--help'

>
> or even a flag for creating users to say force create the structure
> (`samba-tool user create --userou=CN=Users,OU=My-Org luser`  fails
> unsuprisingly as as  CN=Users does not exist)
Oh yes it does ?

It is the standard container for users & groups, so you will not be able 
to use it elsewhere in AD.

Rowland

On Thu, 7 Jan 2021 at 15:03, Rowland penny via samba <samba at
lists.samba.org>
wrote:
> On 07/01/2021 14:32, James Nord via samba wrote:
> > Hi all,
> >
> > I can't find any way (which is either I am missing it, or it does
not
> > exist) to create a container type in a Samba AD setup.
>
> This all depends on whether you mean 'OU' or 'CN'
>
>
sorry I was not clear, I meant 'objectClass' == 'container'  not
'objectClass' = 'organizationalUnit', so a 'CN' in this
case.

>
> > fallback is to do this with ldapmodify - but this has some issues as I
am
> > trying to setup a large / complex AD tree in docker to be able to use
it
> > for some performance testing of a product and the ldap tool needs to
be
> > told passwords and the domain structure rather than just have a
> > relative PATH, as well as some race conditions that makes it a little
> flaky
> > to use this approach :(
>
> Use ldbmodify instead, this will allow you to use kerberos.
>
>
> >
> > Does anyone know if it is possible to do using samba native tooling?
> >
> > In other words, under an OU I would like some containers so I can
> separate
> > out various types of other things like (users, contractors, groups,
> etc..)
>
> If you mean you want to use 'OU', then run 'samba-tool ou
--help'
>
the containers are to be in the same OU, so not in this case.

>
> >
> > or even a flag for creating users to say force create the structure
> > (`samba-tool user create --userou=CN=Users,OU=My-Org luser`  fails
> > unsuprisingly as as  CN=Users does not exist)
>
> Oh yes it does ?
>
> It is the standard container for users & groups, so you will not be
able
> to use it elsewhere in AD.
>
it has been a few years since I was configuring domains but I do not recall
anything that required all users and groups to be in a single flat
hierarchy, or to have non permission bindined organisation that you needed
to use OUs, so I am not sure what you mean here?  (ie use OU if you want to
apply policies, but otherwise there is nothing to prevent this from working)

/James