samba - Feb 2025 - Reported group membership is different between domain member and Samba ADC

On Fri, 14 Feb 2025 12:14:18 -0500
"John R. Graham via samba" <samba at lists.samba.org> wrote:
> On 2/14/25 11:22, Rowland Penny via samba wrote:
> > Well yes, you can do it that way, but there is an easier way.
> > There is a group in AD called 'Domain Admins'
> > Add any AD users that you want to be domain administrators to that
> > group, then, using visudo add this line to the sudo config:
> >
> > %SAMDOM\\domain\ admins ALL=(ALL:ALL) ALL
> >
> > Where 'SAMDOM' is your NetBIOS domain name.
> >
> > Check that your users are members of Domain Admins, you can do this
> > with 'getent group domain\ admins'
> >
> > Now when they log in your domain administrators will be able to use
> > sudo.
> >
> > For extra brownie points, you could store the sudo rules in AD ;-)
> >
> > Rowland
> >
> As it turns out, I still have the same issue:
> 
>  ??? dc1 ~ # samba-tool group addmembers "Domain Admins" jgraham
>  ??? Added members to group Domain Admins
>  ??? dc1 ~ # net cache flush
>  ??? dc1 ~ # samba-tool group listmembers 'domain admins'
>  ??? jgraham
>  ??? Administrator
> 
> And yet:
> 
>  ??? dc1 ~ # id HOME\\jgraham
>  ??? uid=11105(SAMDOM\jgraham) gid=10513(SAMDOM\domain users) 
> groups=10513(SAMDOM\domain users),3000020,3000006(BUILTIN\users)
> 
> and also, logged in as me instead of root:
> 
>  ??? SAMDOM\jgraham at dc1 ~ $ getent group domain\ admins
>  ??? SAMDOM\domain admins:x:3000000:
> 
> So, for an undiagnosed reason, the effective domain membership does
> not include "domain admins" either.
> 
> - John
OK, I will diagnose it ;-)

open a terminal on the DC, enter 'man smb.conf', press enter and then
go to 'winbind expand groups', read that, it will explain why you are
not getting any group members.

Rowland

On 2/14/25 15:01, Rowland Penny via samba wrote:
> On Fri, 14 Feb 2025 12:14:18 -0500
> "John R. Graham via samba"<samba at lists.samba.org> wrote:
> On 2/14/25 11:22, Rowland Penny via samba wrote:
>> So, for an undiagnosed reason, the effective domain membership does
>> not include "domain admins" either.
>>
>> - John
> OK, I will diagnose it ;-)
>
> open a terminal on the DC, enter 'man smb.conf', press enter and
then
> go to 'winbind expand groups', read that, it will explain why you
are
> not getting any group members.
>
> Rowland
Ah. Thank you! On my domain controller "getent" now behaves as you 
predicted:

 ??? dc1 ~ # getent group 'SAMDOM\domain admins'
 ??? SAMDOM\domain admins:x:3000000:SAMDOM\administrator,SAMDOM\jgraham
 ??? dc1 ~ # getent group SAMDOM\\wheel
 ??? SAMDOM\wheel:x:11120:SAMDOM\jgraham

and "su -" now works but "sudo su -" is still broken on my
domain
controller; both work on my domain members. Interestingly, "id" still 
doesn't report correct group membership on the DC but does on domain 
members. I'll look into what's different at the API level and report
back.

- John