samba - Jul 2021 - multiuser with simple user mapping

Eric Levy via samba <samba at lists.samba.org>
writes:
> Is it possible without Kerberos? I investigated it but found no way to
> provision a deployment in a straightforward way that is suitable for
> small networks with only a few users. There are few to no resources on
> the subject not targeted at administrators of networks of many nodes
> and users. In this case, there are only two nodes and a few users, so
> it is hoped that there is a relatively simple and easy solution.
If all the users in all the machines accessing the share in your network
share the the same UID namespace without conflicts, then in that case
you could use idsfromsid I think. With it, any *new* file created by
user bob will show up on the share as owned by a special SID that
contains the UID. And only files created with that mount options should
be listed back with bob uid.

That being said, if you have the same uid namespace on all machines for
user bob, that means you already have some sort of centralized
identication server similar to AD and are using winbind or sssd.

I realize you might not want to setup AD in your small network, but by
default all users uid start from 1000. So if you have machineA where you
created user bob (1000) and bart (1001) and machineB where you created
user james (1000) and judy (1001) and try to mount with the idsfromsid,
then files created by james on machineA will show up as owned by bob on
machineB...

I hope that clears up some confusion.

Cheers,
-- 
Aur?lien Aptel / SUSE Labs Samba Team
GPG: 1839 CB5F 9F5B FB9B AA97  8C99 03C8 A49B 521B D5D3
SUSE Software Solutions Germany GmbH, Maxfeldstr. 5, 90409 N?rnberg, DE
GF: Felix Imend?rffer, Mary Higgins, Sri Rasiah HRB 247165 (AG M?nchen)

On Thu, 2021-07-01 at 10:41 +0200, Aur?lien Aptel via samba
wrote:
> Eric Levy via samba <samba at lists.samba.org> writes:
> > Is it possible without Kerberos? I investigated it but found no way
> > to
> > provision a deployment in a straightforward way that is suitable
> > for
> > small networks with only a few users. There are few to no resources
> > on
> > the subject not targeted at administrators of networks of many
> > nodes
> > and users. In this case, there are only two nodes and a few users,
> > so
> > it is hoped that there is a relatively simple and easy solution.
> 
> If all the users in all the machines accessing the share in your
> network
> share the the same UID namespace without conflicts, then in that case
> you could use idsfromsid I think. With it, any *new* file created by
> user bob will show up on the share as owned by a special SID that
> contains the UID. And only files created with that mount options
> should
> be listed back with bob uid.
> 
> That being said, if you have the same uid namespace on all machines
> for
> user bob, that means you already have some sort of centralized
> identication server similar to AD and are using winbind or sssd.
That's the problem, he isn't, he is running Samba as a standalone
server, it would be a lot easier if he was running Samba as a Unix
domain member.

Rowland
>