samba - Nov 2021 - force user gives access denied unless SAM entry?

On Tue, 2021-11-16 at 10:06 -0800, Kip Kennedy via samba
wrote:
> Anyone else seeing this behavior:
> 
> Server is Samba 4.13.5, standalone under Debian 11. One service
> "share" with one valid user "alice" different from the
force user
> "bob". The user alice is a Debian user and has an entry in SAM
(added
> via smbpasswd). The user bob is a Debian user but does not have an
> smb login or SAM entry. The user bob is the file system owner of the
> shared directory with owner write access. The directory does not have
> group write access or world access (750). Local writes to the
> directory as bob succeed.
> 
> Client is Windows 10 with a mapped drive, connecting successfully as
> alice.
> 
> When I try to save a file from Windows I get an access denied error.
> I turned logging up to 5 and noticed an error that USER_bob was being
> looked up in some sort of passdb SAM database. Not sure why this is
> the case, isn't "force user" only used for file system
checks? If I
> add bob via smbpasswd, everything works. It also continues to work if
> the disabled flag is set on the bob account via pdbedit.
> 
> Note if trying to replicate: adding group write access to the
> directory also allows the write to succeed. Maybe successful group or
> world attempts to write the file mask this user lookup issue.
The user must be authenticated before it gets anywhere near the share
and with your setup if the user is authenticated and is allowed
read/write access to the share everything will be saved as your 'forced
user'
However, 'bob' will never be allowed access by Samba (not unless guest
access is set up correctly) because Samba hasn't got a clue who
'bob'
is.

Rowland

> The user must be authenticated before it gets anywhere near the share
> and with your setup if the user is authenticated and is allowed
> read/write access to the share everything will be saved as your 'forced
> user'
> However, 'bob' will never be allowed access by Samba (not unless
guest
> access is set up correctly) because Samba hasn't got a clue who
'bob'
> is.
Sorry if it wasn't clear, I am authenticating and connecting fine as 
'alice'. I can then change directories and list files without error 
(file system reading as 'bob'). Only when I try and write do I receive 
an Access Denied (file system writing as 'bob').

Why should 'bob' need Samba authentication? As I read it, force user is 
used only for Linux file permissions. Shouldn't 'bob' need only
exist as
a local Linux account?

The log is showing an error about a SID / SAM lookup for 'bob'. Unless 
force user is also attempting to force SID mappings shouldn't the 
connected 'alice' be used for those SID lookups, not 'bob'? If I
add
'bob' to the SAM - even as a disabled account - the write will succeed.