samba - Nov 2021 - force user gives access denied unless SAM entry?

> The user must be authenticated before it gets anywhere near the share
> and with your setup if the user is authenticated and is allowed
> read/write access to the share everything will be saved as your 'forced
> user'
> However, 'bob' will never be allowed access by Samba (not unless
guest
> access is set up correctly) because Samba hasn't got a clue who
'bob'
> is.
Sorry if it wasn't clear, I am authenticating and connecting fine as 
'alice'. I can then change directories and list files without error 
(file system reading as 'bob'). Only when I try and write do I receive 
an Access Denied (file system writing as 'bob').

Why should 'bob' need Samba authentication? As I read it, force user is 
used only for Linux file permissions. Shouldn't 'bob' need only
exist as
a local Linux account?

The log is showing an error about a SID / SAM lookup for 'bob'. Unless 
force user is also attempting to force SID mappings shouldn't the 
connected 'alice' be used for those SID lookups, not 'bob'? If I
add
'bob' to the SAM - even as a disabled account - the write will succeed.

On Tue, 2021-11-16 at 13:56 -0800, Kip Kennedy via samba
wrote:
> > The user must be authenticated before it gets anywhere near the
> > share
> > and with your setup if the user is authenticated and is allowed
> > read/write access to the share everything will be saved as your
> > 'forced
> > user'
> > However, 'bob' will never be allowed access by Samba (not
unless
> > guest
> > access is set up correctly) because Samba hasn't got a clue who
> > 'bob'
> > is.
> 
> Sorry if it wasn't clear, I am authenticating and connecting fine as 
> 'alice'. I can then change directories and list files without error
> (file system reading as 'bob'). Only when I try and write do I
> receive 
> an Access Denied (file system writing as 'bob').
> 
> Why should 'bob' need Samba authentication? As I read it, force
user
> is 
> used only for Linux file permissions. Shouldn't 'bob' need only
exist
> as 
> a local Linux account?
> 
> The log is showing an error about a SID / SAM lookup for 'bob'.
> Unless 
> force user is also attempting to force SID mappings shouldn't the 
> connected 'alice' be used for those SID lookups, not 'bob'?
If I add
> 'bob' to the SAM - even as a disabled account - the write will
> succeed.
I think it might help if you post the smb.conf from your standalone
server.

If 'bob' is unknown to Samba, then the user 'bob' cannot connect
to the
share via Samba (unless 'map to guest = bad user' is set in [global]
and 'guest ok = yes' or 'public = yes' is set in the share.

The user must be authenticated by Samba (either as a Samba user, or by
being a 'guest' user as described above. All of this authentication
happens before the connecting user is allowed near the share.

If you read 'man smb.conf', under 'force user', it says this:

This user name only gets used once a connection is established.
Thus clients still need to connect as a valid user and supply a valid
password.

Rowland