search for: domain_b

Hi Gaiseric, "wbinfo -u" does not show the DOMAIN_B users. "wbinfo -n DOMAIN_B+someuser" works and show the SID of the users, also from Domain_B. "wbinfo -i DOMAIN_B+someuser" does not work. It only works for users of Domain_A. For User of Domain_B, it says: failed to call wbcGetpwnam: WBC_ERR_DOMAIN_NOT_FOUND Could not get i...

...---------------------------------------------------------------------------------------------- winbind enum users = Yes winbind enum groups = Yes winbind use default domain = no winbind trusted domains only = no # The "idmap domains" has been deprecated in 3.4 # idmap domains = DOMAIN_A DOMAIN_B DOMAIN_C # Next two lines restored in 3.4 - but prob don't need idmap uid = 30000-59999 idmap gid = 30000-59999 idmap config DOMAIN_A:backend = ldap idmap config DOMAIN_A:readonly = no idmap config DOMAIN_A:default=no idmap config DOMAIN_A:ldap_base_dn = ou=domain_a,ou=idmap,o=mydomain.com...

...will add or update idmap entries in LDAP. 2. Samba 3.4 can read some of the idmap entries from LDAP. Domain_A is Windows 2003 in mixed-mode. Samba 3.0.x is able to populate idmap allocation entries in ldap. Samba 3.4 when running "getent passwd" can see the users from that domain. Domain_B is a Windows 2003 Native domain. Samba 3.4 can not handle those entries. If I manually create the entry in ldap, it does get added to gencache.tdb with the uid (e.g. 4000.) e.g. --------------------------------------------------------------------------------- key(61) = "IDMAP/SID2UID/S-1...

...een each of these sites. When I establish a trust from one of the satellite locations it appears to work ... *net rpc trustdom establish domain_A* Could not connect to server A Trust to domain DOMAIN_A established but from the central location I get the error message *net rpc trustdom establish domain_B* Could not connect to server B [2005/09/14 11:14:21, 0] utils/net_rpc.c:rpc_trustdom_establish(4917) Couldn't verify trusting domain account. Error was NT_STATUS_UNSUCCESSFUL I found I can duplicate the above error message if I type in an incorrect password on one of the satellite computers (...

...mp; B), as we can set up ACLs for every domain on it. > > The only trouble we encoutner is that every monday morning, it seems > that this samba4 server looses the approbation from AD server. > > Using smbclient we encounter this error: > > > [SambaServer]:~#wbinfo -a "DOMAIN_B+myuser" > Enter DOMAIN_B+myuser's password: > plaintext password authentication failed > Could not authenticate user DOMAIN_B+myuser with plaintext password > Enter DOMAIN_B+myuser's password: > challenge/response password authentication failed > error code was NT_STA...

Hi, Here is our smb.conf. Please note that this server uses nss resolution for DOMAIN_B users and idmap_ldap backend to resolve DOMAIN_A users. Trusted relationship between works well for other services between those two domains. Only samba4 fileserver needs to rejoin DOMAIN_A domain (AD 2008 server) every week. #======================= Global Settings ==========================...

...p to connect to the AD DC ????? >> Not at all. If it was the case the machine would have never be joined to DOMAIN_A Joining this machine to the 2008 domain (via net ads join..) succeed whitout any problem. About ldap connector we just thought winbind would use it towards ldap server for DOMAIN_B (Samba 3.5 domain) uid/gid resolution. We actually use nss to resolve those uid/gid > > Can I suggest you read 'man smb.conf', 'man idmap_rid' 'man idmap_ad', > 'man idmap_nss' and finally this: > > https://wiki.samba.org/index.php/Setting_up_Samba_as...

Hi Gaiseric, I have tried that, also in different variations. But the users and groups of DOMAIN_B keep invisible. Below the smb.conf in the meantime state. By the way: kinit works with both, users aof DOM_A and Users of DOM_B. [global] workgroup = DOM_A server string = Samba %v log file = /var/log/samba/log.%m max log size = 50 password server = *...

...Not at all. If it was the case the machine would have never be >> joined to DOMAIN_A >> Joining this machine to the 2008 domain (via net ads join..) succeed >> whitout any problem. >> About ldap connector we just thought winbind would use it towards >> ldap server for DOMAIN_B (Samba 3.5 domain) uid/gid resolution. >> We actually use nss to resolve those uid/gid > It doesn't and idmap_nss is used to ensure that a local Unix is mapped > to an AD user, the only problem with your setup is, you cannot have a > user with the same name in AD and /etc/passwd...

On Wed, 16 Aug 2017 09:05:32 +0200 Julien TEHERY via samba <samba at lists.samba.org> wrote: > Hi, > > > Here is our smb.conf. > > Please note that this server uses nss resolution for DOMAIN_B users > and idmap_ldap backend to resolve DOMAIN_A users. > > Trusted relationship between works well for other services between > those two domains. Only samba4 fileserver needs to rejoin DOMAIN_A > domain (AD 2008 server) every week. > > #======================= Global Sett...

...;> -DomainAPDC and DomainBPDC has winbind in nsswitch >> -wbinfo all works. >> -"getent group" and "getent passwd" shows ldap entries of local domain >> and winbind entries of the remote domain. >> -However I still cannot map the home directory of the Domain_B_user >> when I log into Domain_B on Domain_A_XP computer. >> - smbclient //domain_A_PDC/shared -U domain_B/domain_B_user is working. >> >> The command I run on the command prompt (which will work) if I am >> Domain_A_user into Domain_A on Domain_A_XP_computer is &quo...

...; maybe you can give it a try... > > https://bugzilla.samba.org/show_bug.cgi?id=13543 > As Andrew has said, this will not work and why you would want this escapes me ? if it did work, you could end up with a user called 'fred' from DOMAIN_A and a user called 'fred' from DOMAIN_B, so which user would be the one used, the one from DOMAIN_A, or the one from DOMAIN_B, or both ? Rowland

...t; > >> Not at all. If it was the case the machine would have never be > joined to DOMAIN_A > Joining this machine to the 2008 domain (via net ads join..) succeed > whitout any problem. > About ldap connector we just thought winbind would use it towards > ldap server for DOMAIN_B (Samba 3.5 domain) uid/gid resolution. > We actually use nss to resolve those uid/gid It doesn't and idmap_nss is used to ensure that a local Unix is mapped to an AD user, the only problem with your setup is, you cannot have a user with the same name in AD and /etc/passwd. > > >...

Hi Gaiseric, both packages have been provided as RPM and installed by yum. We didn´t have to compile. "wbinfo -i" shows the correct uidnumber for users of DOMAIN_A, but nothing for users auf the trusted Domain DOMAIN_B. We have another server running Centos 6 and Samba 4.4.4. It shows the same problem: Only users and groups of DOMAIN_A are available. The settings: ldap server require strong auth = no => this makes no change. client ldap sasl wrapping = plain => If I set this, "wbinfo -g&...

...e a uid=root you see. Now "net use x: /home" by the Dom B user (grade2 in this case) on the Domain_A_machine still does not work. The /var/log/samba/Dom_A_machine from the Domain_A_PDC will be sent separately as I don want to post it on the lists. The /var/log/samba/Domain_A_PDC from Domain_B_PDC will be sent to you too. My view on the logs --------------------- I believe by reading it, it will hold the key why it did not work. I believe during authentication, Domain_A_PDC got the information of Domain_B_user from Domain_B_PDC properly. But it cannot find Domain_B\Domain_B_user in...

Hi Igor, I got stuck now. I did my best. I got stuck at the winbind which I suspected is the reason why the domainA_computer cannot map the domain_B user's home directory. 1. What are the settings of your winbind? 2. Do you use only "winbind" in your libnss_ldap or use "ldap" as well? 3. My winbind works with :- (For both sides) wbinfo -t wbinfo -p wbinfo -u wbinfo -g getent passwd (For DomainA) "getent group&qu...

...Gaiseric, >> >> both packages have been provided as RPM and installed by yum. We >> didn´t have to >> compile. >> >> >> "wbinfo -i" shows the correct uidnumber for users of DOMAIN_A, but >> nothing for >> users auf the trusted Domain DOMAIN_B. >> >> >> We have another server running Centos 6 and Samba 4.4.4. It shows the >> same >> problem: Only users and groups of DOMAIN_A are available. >> >> >> The settings: >> >> ldap server require strong auth = no => this makes no ch...

Dear list, when I connect to a samba AD member server from a windows 10 client not joined to the domain, it appears that I always have to connect as DOMAIN\USER. Is it possible to configure samba such that it always interprets the USER part as being the account name of the one domain that is configured, and to discard the DOMAIN part supplied by the client? This may be a dumb question, but thanks

...f via samba wrote: > > > Hi Gaiseric, > > both packages have been provided as RPM and installed by yum. We didn´t have to > compile. > > > > "wbinfo -i" shows the correct uidnumber for users of DOMAIN_A, but nothing for > users auf the trusted Domain DOMAIN_B. > > > > We have another server running Centos 6 and Samba 4.4.4. It shows the same > problem: Only users and groups of DOMAIN_A are available. > > > > The settings: > > ldap server require strong auth = no => this makes no change. > > client ldap sa...

...in controller for the trusted domain: 'wbinfo --sequence' shows the trusted domain disconnected. Debugging winbindd does show following errors: wbinfo --sequence => [..] bind_rpc_pipe: transfer syntax differs rpc_pipe_bind: check_bind_response failed. [..] Could not open a connection to DOMAIN_B for \PIPE\samr (NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND) wbinfo -g => get_sam_group_entries: could not enumerate domain groups! Error: NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND Though winbind couldn't find a Domain Controller, checking Password secrets using 'winbind -a' works without a...