samba - Feb 2023 - idmap ad question

On 13/02/2023 18:54, Vaughan, Robert J via samba wrote:
> 
> nsswitch.conf has 'files winbind' for the passwd, shadow and group
lines
Remove it from the shadow line, it should not be there.
> 
> What does it mean 'winbind links set up'?
It refers to the links that connect winbind to nsswitch
> 
> OS is Red Hat 7.  Any idea in those packages if I might be missing
something?
>>Been sometime since I used a red-based distro, but I think you need to 
>>install samba-winbind-clients
>>You could try reading this:
>>https://urldefense.com/v3/__https://wiki.samba.org/index.php/Configuring_Winbindd_on_a_Samba_AD_DC*Libnss_winbind_Links__;Iw!!BlOwZnr7TA!iiqx5WSIlcMww6aLe_SmEGJxYgFTcFHG2hXQAQvreE2rgU4-Z3-GEUohBUxWSEM9nr9bL45WjVuZvWjh$
>>It might help to understand the links.
Yeah the link is correctly setup, since it is not compiled Samba 

Ok, I found in this link ..

https://wiki.samba.org/index.php/Troubleshooting_Samba_Domain_Members#getent_not_Finding_Domain_Users_and_Groups

I had to change these lines to 'Yes' ..

        winbind enum groups = Yes
        winbind enum users = Yes

Now, it works, but it's really slow (and I think I have heard you saying not
to enable this before)

Robert Vaughan

----------------------------------------------------------------------
This is an e-mail from General Dynamics Land Systems. It is for the intended
recipient only and may contain confidential and privileged information.  No one
else may read, print, store, copy, forward or act in reliance on it or its
attachments.  If you are not the intended recipient, please return this message
to the sender and delete the message and any attachments from your computer.
Your cooperation is appreciated.

On 13/02/2023 19:42, Vaughan, Robert J via samba wrote:
> Yeah the link is correctly setup, since it is not compiled Samba
> 
> Ok, I found in this link ..
> 
>
https://wiki.samba.org/index.php/Troubleshooting_Samba_Domain_Members#getent_not_Finding_Domain_Users_and_Groups
> 
> I had to change these lines to 'Yes' ..
> 
>          winbind enum groups = Yes
>          winbind enum users = Yes
> 
> Now, it works, but it's really slow (and I think I have heard you
saying not to enable this before)
Ah, I think light dawns

Were you running 'getent passwd' rather than 'getent passwd
AUSERNAME' ?

To get all the users shown, you need 'winbind enum users = yes', but it 
isn't required and, as you have found out, it just slows things down.

Rowland