samba - Jun 2024 - use of ‘idmap_ldb:use rfc2307 = yes’ in DCs

I tried already, feedback welcome and this is all free to use anywhere else.

http://samba.bigbird.es/doku.php?id=samba:no-need-for-use-rfc2307


LP
On Jun 20, 2024 at 10:19 +0100, samba at lists.samba.org <samba at
lists.samba.org>, wrote:
>
> We should then document 'idmap_ldb:use rfc2307'
> to say it allows the use of uidNumber & gidNumber attributes on a Samba
> AD DC.

Hello,

Why is it said that it affects only if you have fileserver on DC?

I use uid, uidNumber, unixHomeDirectory for users and gid for groups. 
This attributes are defined in samba DC.

Then I have another samba server that works as fileserver, and I have 
this in config:

 ?? idmap config * : backend = tdb
 ??? idmap config * : range = 20000-20999
 ??? idmap config NAVIDOM:backend = ad
 ??? idmap config NAVIDOM:schema_mode = rfc2307
 ??? idmap config NAVIDOM:range = 1000-9999
 ??? idmap config NAVIDOM:unix_nss_info = yes
 ??? idmap config NAVIDOM:unix_primary_group = yes
 ??? winbind use default domain = yes
 ??? winbind nss info = rfc2307

As I understand, to use it this way I need the "idmap_ldb:use rfc2307 = 
yes" on DC?

Or is there another way to directly map samba users and groups to linux 
users and groups?

Best regards,

Olaf Fr?czyk

NAVI Sp. z o.o.
Promienista 5/1
60-288 Pozna?

mobile: +48609769035
phone: +48616622881
fax: +48616622882
http://www.navi.pl

On 2024-06-20 11:22, Luis Peromarta via samba wrote:
> I tried already, feedback welcome and this is all free to use anywhere
else.
>
> http://samba.bigbird.es/doku.php?id=samba:no-need-for-use-rfc2307
>
>
> LP
> On Jun 20, 2024 at 10:19 +0100, samba at lists.samba.org <samba at
lists.samba.org>, wrote:
>> We should then document 'idmap_ldb:use rfc2307'
>> to say it allows the use of uidNumber & gidNumber attributes on a
Samba
>> AD DC.

Mandi! Luis Peromarta via samba
  In chel di` si favelave...
> I tried already, feedback welcome and this is all free to use anywhere
else.
> http://samba.bigbird.es/doku.php?id=samba:no-need-for-use-rfc2307
I add some notes.


Winbind cannot evaluate gropup membership before the 'logon' (password
check), so every (POSIX) group based policy cannot be granted; clearly there
some cache, but are not reilable and suffer from bootstrap problem (eg: you
set that 'only group G can logon to SSH: member 'a' of group G have
to logon
to the server (someway, not specifically via ssh) to have group membership
evaluated and applied).

Via rfc2307 you can evaluate, if needed, membership directly via LDAP.
Nested membershp normally is not (it is an hard task), but it is something
you can live without, at least try to.

--