samba - Dec 2022 - Problem idmap_ad

Why do you use idmap-backend ad anyway? Is there a reason not to use the 
backend rid? It's much easier to handle, you don't have to look a 
GidNumber and UidNumer you only need the RID every user has in an Active 
Directory.

Am 14.12.22 um 10:14 schrieb Balke IT via samba:
> Sorry for the spam. My mailserver got an error message after trying to send
via IPV6 four times and then switched back to IPV4. But back to the topic:
> 
> The change to rid is our temporary workaround, nevertheless the version
with idmap config DOMAIN:backend = ad gives the problems that I mentioned in my
first post, several users can use the shares and others can't without any
clue why. They have random (old) unix IDs and other users with a uidNumber
between them cannot use the share, loads of logs with loglevel 10 did not give
any hint.
> 
> So this is the version that does not give all users access to the shares:
> 
>          idmap config * : backend = tdb
>          idmap config * : range = 117000-117999
>          idmap config DOMAIN:backend = ad
>          idmap config DOMAIN:schema_mode = rfc2307
>          idmap config DOMAIN:range = 1001-116999
>          idmap config DOMAIN:unix_nss_info = no
>          idmap config DOMAIN:unix_primary_group = yes
> 
>          template shell = /bin/bash
>          template homedir = /home/%U
> 
>          kerberos method = secrets and keytab
> 
>          winbind nss info = template
>          winbind use default domain = yes
>          winbind enum users = yes
>          winbind enum groups = yes
> 
> Best Regards
> Matthias Mueller
> 
> 
>> You do not appear to be using the 'ad' idmap backend, you have
commented
>> it out.
> 
>> Also, did your finger get stuck, you asked the same question 5 times.
> 
>> Rowland
> 
-- 
Stefan Kania
Landweg 13
25693 St. Michaelisdonn


Signieren jeder E-Mail hilft Spam zu reduzieren und sch?tzt Ihre 
Privatsph?re. Ein kostenfreies Zertifikat erhalten Sie unter 
https://www.dgn.de/dgncert/index.html

On 14/12/2022 11:53, Stefan Kania via samba wrote:
> Why do you use idmap-backend ad anyway? Is there a reason not to use the 
> backend rid? It's much easier to handle, you don't have to look a 
> GidNumber and UidNumer you only need the RID every user has in an Active 
> Directory.
> 
> 
I wondered that, but he has now opened another thread where he appears 
to be using 'rid' and done what I thought was impossible, got two
ID's
for the same group.

Rowland