On Wed, 2022-07-27 at 14:58 -0400, Luc Lalonde via samba
wrote:> Hello,
>
> I can't seem to get a user's secondary groups to show up...
>
> Here are the pertinent lines in my configuration:
>
> ### /etc/nsswitch.conf ###
>
> passwd: files winbind
> shadow: files
> group: files winbind
> initgroups: files
> hosts: files dns
> ####################
>
> ### /etc/samba/smb.conf ###
>
> idmap config *:backend = tdb
> idmap config *:range = 200-999
> idmap config EXAMPLE:backend = ad
> idmap config EXAMPLE:schema_mode = rfc2307
> idmap config EXAMPLE:range = 1000-999999
> idmap config EXAMPLE : read only = yes
Where did you get that line from ? I do not recognise it in relation to
the 'ad idmap backend.
> idmap config EXAMPLE : unix_nss_info = yes
> idmap config EXAMPLE : unix_primary_group = yes
> winbind nss info = rfc2307
You do not use that with the 'ad' idmap backend, it is set in the
'idmap config' lines.
> winbind use default domain = yes
> winbind expand groups = 3
Try a different number, I use '2' and it works for myself.
> winbind refresh tickets = Yes
> winbind enum groups = Yes
> winbind enum users = Yes
You do not need those 'enum' lines, it will work without them.
>
> #####################
>
> Here's what I get:
>
> [llalonde at moe5 ~]$ id
> uid=12690(llalonde) gid=7006(foo) groups=7006(foo)
> [llalonde at moe5 ~]$ getent group admingroup
> admingroup:x:8000:llalonde,sccmadmin
>
> On another Linux client using SSSD, here's what I get:
>
> uid=12690(llalonde) gid=7006(foo) groups=7006(foo),8000(admingroup)
>
> What am I missing? I think that this is the last missing detail
> before
> I drop SSSD.
Does 'Domain Users' have a gidNumber ?
Do all your users have a uidNumber & gidNumber ?
Do all your groups have a gidNumber ?
Are all these numbers inside the 1000-999999 range ?
Rowland