samba - Mar 2023 - Fwd: samba-gpupdate nsswitch error

On 14/03/2023 10:16, Kees van Vloten via samba wrote:
>>
> I use rfc2307 and I remember I had to assign uid/gid to computer objects 
> at one point to get rid of different but also similar kind of errors 
> (check ml 14-04-2022), these were the messages:
> 
> smbd[15370]: [2022/04/14 14:32:56.556685, ?0] 
> ../../source3/auth/auth_util.c:1928(check_account)
> smbd[15370]: ? check_account: Failed to convert SID 
> S-1-5-21-3042323961-424325435-1432587418-1234 to a UID 
> (dom_user[SAMDOM\computer01$])
> 
> 
> 
> 
That is a different message, Samba was trying to map a SID to a uid and 
failed because there wasn't a uid to map it to, adding a uidNumber 
attribute fixed that.
What I am saying is, if getent can find a uid or gid, it will return it, 
but there doesn't seem to be code to map a SID to return the uid to 
getent. If you think about it, why would there be code to do this, SID's 
are Windows things and until fairly recently, there was no reason for a 
Unix computer to be a user, in fact, is there a reason now, do GPO's 
require this ?

Rowland

Hi everyone.

Am 14. M?rz 2023 11:25:48 MEZ schrieb Rowland Penny via samba <samba at
lists.samba.org>:
>That is a different message, Samba was trying to map a SID to a uid and
failed because there wasn't a uid to map it to, adding a uidNumber attribute
fixed that.
>What I am saying is, if getent can find a uid or gid, it will return it, but
there doesn't seem to be code to map a SID to return the uid to getent. If
you think about it, why would there be code to do this, SID's are Windows
things and until fairly recently, there was no reason for a Unix computer to be
a user, in fact, is there a reason now, do GPO's require this ?
Yes. For access to sysvol a computer needs a uid. A DC does this even if the
computer does not have a uid set (AD ID backend).


Regards