samba - Jun 2023 - PAM Offline Authentication in Ubuntu 22.04

On 28/06/2023 10:32, Marco Gaiarin via samba wrote:
> 
> I reply to myself.
> 
>>> "idmap config LNFFVG : unix_nss_info = no" in smb.conf ?
>> Tried, but nothing changed. My current [global] section is:
> 
> Bingo! If i set:
>>          idmap config lnffvg : unix_nss_info = no
> AND
>>          idmap config lnffvg : unix_primary_group = no
> 
> Things start to work; 
I didn't try turning the last one off, but at least you are getting 
somewhere :-)
> i mean 'start' because effectively a disconnection of
> the laptop basic nss survive (eg, i can do 'id gaio' and i get some
output),
> but still if i lock the screen, i cannot login back anymore (due to
> timeouts, i suppose; it is a bit hard to debug a disconnected laptop...
;-).
> 
> I've also reboot, and in logon screen GDM say me that i'm logging
in with a
> cached credential (wow!), but after 15 minutes i was still logging in,
> screen saver start and so i was back to login screen.
When you say 'back to login screen', do you mean that you cannot just 
click the screen, enter your password and close the screensaver ? From 
what you posted, it sounds like you are taken right back to the intial 
login screen.
> 
> 
> This lead to me to the considerations:
> 
> 1) winbind offline logon work only in 'rid' mode, or at least does
NOT work
>   in rfc2307 mode.
I would suggest that 'does not work fully in rfc2307 mode' is nearer the
truth. It sounds like the ID's are being pulled from the cache, but it 
is falling over trying to get the homedir, shell etc.
> 
> 2) i think this is a bug...
It certainly sounds that way. Can you please open a bug report.

Rowland

Mandi! Rowland Penny via samba
  In chel di` si favelave...
> I didn't try turning the last one off, but at least you are getting 
> somewhere :-)
With very little steps... ;-)

> When you say 'back to login screen', do you mean that you cannot
just
> click the screen, enter your password and close the screensaver ? From 
> what you posted, it sounds like you are taken right back to the intial 
> login screen.
I've done some more test; before if i shut off the wireless, winbind stop
immediately responding.

Now, it worked for some minutes, then stop responding and seems behave badly
as my first test (eg, loooooon gelay for everything, machine totally
unusable, ...).

So still it is not a solution....

> I would suggest that 'does not work fully in rfc2307 mode' is
nearer the
> truth. It sounds like the ID's are being pulled from the cache, but it 
> is falling over trying to get the homedir, shell etc.
Look at my other post: i can have a domain in rfc2307 and a client in rid,
if i don't need direct POSIX communication between (eg, NFS for example)?

> It certainly sounds that way. Can you please open a bug report.
	https://bugzilla.samba.org/show_bug.cgi?id=15405


Thanks.

-- 
  Qualche saggio scriveva che l'unico sistema economico funzionante
  gli pareva il libero mercato in cui il governo tiene la pistola puntata
  alla tempia delle corporations.  Peccato che il governo sia pi? solito
  offrire modiche quantit? di vaselina al consumatore, occasionalmente...
						(Emanuele Pucciarelli)