search for: id_type_gid

...> I get: > > Importing groups > Could not add group name=Domain Admins ((68, "samldb: Account name > (sAMAccountName) 'Domain Admins' already in use!")) > Could not modify AD idmap entry for > sid=S-1-5-21-2777655458-4002997014-749295002-1006, id=0, > type=ID_TYPE_GID ((32, "Base-DN > '<SID=S-1-5-21-2777655458-4002997014-749295002-1006>' not found")) > Could not add posix attrs for AD entry for > sid=S-1-5-21-2777655458-4002997014-749295002-1006, ((32, "Base-DN > '<SID=S-1-5-21-2777655458-4002997014-749295002-1006&...

Am 2016-12-01 um 15:41 schrieb Rowland Penny via samba: > Have you altered /etc/resolv.conf, on the DC, to use its own ip as the > first nameserver ? That change seems to have fixed it! I added that now to network config for the VM. klist ok now step by step ;-) thanks

> I feel I can tell you this without breaking any confidences, the OP sent me their idmap.ldb and the problem boiled down to these three DNs>> CN=S-1-5-32-545> CN=S-1-5-32-544> CN=S-1-5-32-546> > The classicupgrade seems to set these to 'ID_TYPE_GID' instead of 'ID_TYPE_BOTH'.>> RowlandI can confirm this. After changing 'ID_TYPE_GID' to 'ID_TYPE_BOTH' on these three CN= winbind works well. So there is no errors. Also Louis' script works well;) > This was hard to decipher, but I think I understand it&gt...

...((68, 'Entry CN=Domain Admins,CN=Users,DC=ifa,DC=hawaii,DC=edu already exists')) WARNING 2019-05-13 15:09:56,729 pid:25284 /usr/local/samba/lib64/python2.7/site-packages/samba/upgrade.py #161: Could not modify AD idmap entry for sid=S-1-5-21-280721883-191778108-123917971-512, id=512, type=ID_TYPE_GID ((32, "Base-DN '<SID=S-1-5-21-280721883-191778108-123917971-512>' not found")) WARNING 2019-05-13 15:09:56,730 pid:25284 /usr/local/samba/lib64/python2.7/site-packages/samba/upgrade.py #130: Could not add posix attrs for AD entry for sid=S-1-5-21-280721883-191778108-1239179...

...t; Importing groups >> Could not add group name=Domain Admins ((68, "samldb: Account name >> (sAMAccountName) 'Domain Admins' already in use!")) >> Could not modify AD idmap entry for >> sid=S-1-5-21-2777655458-4002997014-749295002-1006, id=0, >> type=ID_TYPE_GID ((32, "Base-DN >> '<SID=S-1-5-21-2777655458-4002997014-749295002-1006>' not found")) >> Could not add posix attrs for AD entry for >> sid=S-1-5-21-2777655458-4002997014-749295002-1006, ((32, "Base-DN >> '<SID=S-1-5-21-2777655458-4002997014...

...ldbsearch -H /var/lib/samba/private/idmap.ldb objectsid=S-1-5-21-4155694911-3186826046-1573605777-513 # record 1 dn: CN=S-1-5-21-4155694911-3186826046-1573605777-513 cn: S-1-5-21-4155694911-3186826046-1573605777-513 objectClass: sidMap objectSid: S-1-5-21-4155694911-3186826046-1573605777-513 type: ID_TYPE_GID xidNumber: 985 distinguishedName: CN=S-1-5-21-4155694911-3186826046-1573605777-513 [root at site-ad ~]# ldbsearch -H /var/lib/samba/private/sam.ldb objectsid=S-1-5-21-4155694911-3186826046-1573605777-513 |grep gidNumber (returns nothing) >> >> And the same check for "Domain Admin...

...>> Could not add group name=Domain Admins ((68, "samldb: Account name > >> (sAMAccountName) 'Domain Admins' already in use!")) > >> Could not modify AD idmap entry for > >> sid=S-1-5-21-2777655458-4002997014-749295002-1006, id=0, > >> type=ID_TYPE_GID ((32, "Base-DN > >> '<SID=S-1-5-21-2777655458-4002997014-749295002-1006>' not found")) > >> Could not add posix attrs for AD entry for > >> sid=S-1-5-21-2777655458-4002997014-749295002-1006, ((32, "Base-DN > >> '<SID=S-1-5-21-2...

Am 2016-12-09 um 11:11 schrieb Stefan G. Weichinger via samba: > Could not add group name=Domain Admins ((68, "samldb: Account name > (sAMAccountName) 'Domain Admins' already in use!")) I think this is my problem (on the old host/pdc): # net groupmap list Domain Admins (S-1-5-21-2777655458-4002997014-749295002-1006) -> root Domain Guests

...rom Samba 3): wbinfo --sid-to-uid=S-1-5-32-544 failed to call wbcSidToUid: WBC_ERR_DOMAIN_NOT_FOUND Could not convert sid S-1-5-32-544 to uid ldbsearch -H /var/lib/samba/private/idmap.ldb | grep S-1-5-32-544 -A2 dn: CN=S-1-5-32-544 cn: S-1-5-32-544 objectClass: sidMap objectSid: S-1-5-32-544 type: ID_TYPE_GID xidNumber: 15538 distinguishedName: CN=S-1-5-32-544 Testing lab domain (provisioned from scratch): wbinfo --sid-to-uid=S-1-5-32-544 3000003 ldbsearch -H /usr/local/samba/private/idmap.ldb | grep S-1-5-32-544 -A2 dn: CN=S-1-5-32-544 cn: S-1-5-32-544 objectClass: sidMap objectSid: S-1-5-32-544 type...

...st not where you expect it ;-) If you examine 'idmap.ldb' on a DC, you should find something like this: dn: CN=S-1-5-21-1768301897-3342589593-1064908849-513 cn: S-1-5-21-1768301897-3342589593-1064908849-513 objectClass: sidMap objectSid: S-1-5-21-1768301897-3342589593-1064908849-513 type: ID_TYPE_GID xidNumber: 100 distinguishedName: CN=S-1-5-21-1768301897-3342589593-1064908849-513 The '513' is the RID for Domain Users and the xidNumber maps it to to the local 'users' group. > > I can then conclude that my intention to use local users of the linux > server without h...

...id=S-1-5-21-4155694911-3186826046-1573605777-513 >> # record 1 >> dn: CN=S-1-5-21-4155694911-3186826046-1573605777-513 >> cn: S-1-5-21-4155694911-3186826046-1573605777-513 >> objectClass: sidMap >> objectSid: S-1-5-21-4155694911-3186826046-1573605777-513 >> type: ID_TYPE_GID >> xidNumber: 985 >> distinguishedName: CN=S-1-5-21-4155694911-3186826046-1573605777-513 > > An 'xidNumber' is NOT a 'uidNumber' or 'gidNumber' > > Who changed the 'xidNumber' value from a number in the '3000000' range to '985...

...ote:> > I feel I can tell you this without breaking any confidences, the OP> sent me their idmap.ldb and the problem boiled down to these three> DNs>> CN=S-1-5-32-545> CN=S-1-5-32-544> CN=S-1-5-32-546> > The> DNs>> classicupgrade> seems to set these to 'ID_TYPE_GID' instead of 'ID_TYPE_BOTH'.>>> RowlandI can confirm this. After changing 'ID_TYPE_GID' to> 'ID_TYPE_BOTH' on these three CN= winbind works well. > So there is no errors. Also Louis' script works well;)> > This was hard to decipher, but I think I...

I do think its a classic upgrade from 3.x to 4.x that causes this. And the samba 3 was a samba with smbldap-tools or configured with something like : net groupmap add ntgroup="Domain Admins" unixgroup=domadm rid=512 type=d ( as shown here https://www.samba.org/samba/docs/man/Samba-HOWTO-Collection/groupmapping.html ) > -----Oorspronkelijk bericht----- > Van: samba

...ap database, Ignoring: [Errno 2] No such file or directory Importing groups Could not add group name=Domain Admins ((68, "samldb: Account name (sAMAccountName) 'Domain Admins' already in use!")) Could not modify AD idmap entry for sid=S-1-5-21-XXXXXXXXXXXXXXXXXX-1057, id=502, type=ID_TYPE_GID ((32, "Base-DN '<SID=S-1-5-21-XXXXXXXXXXXXXXXXXX-1057>' not found")) Could not add posix attrs for AD entry for sid=S-1-5-21-XXXXXXXXXXXXXXXXXX-1057, ((32, "Base-DN '<SID=S-1-5-21-XXXXXXXXXXXXXXXXXX-1057>' not found")) Could not add group name=Domain...

...dmap.ldb' on a DC, you should find something like this: >> >> dn: CN=S-1-5-21-1768301897-3342589593-1064908849-513 >> cn: S-1-5-21-1768301897-3342589593-1064908849-513 >> objectClass: sidMap >> objectSid: S-1-5-21-1768301897-3342589593-1064908849-513 >> type: ID_TYPE_GID >> xidNumber: 100 >> distinguishedName: CN=S-1-5-21-1768301897-3342589593-1064908849-513 >> >> The '513' is the RID for Domain Users and the xidNumber maps it to to >> the local 'users' group. >> >> > >> > I can then conclude tha...

...tandard Samba DC using the idmap backend (the default), if you look in idmap.ldb, you should find something ike this: dn: CN=S-1-5-21-627072207-2265849604-124128874-513 cn: S-1-5-21-627072207-2265849604-124128874-513 objectClass: sidMap objectSid: S-1-5-21-627072207-2265849604-124128874-513 type: ID_TYPE_GID xidNumber: 100 distinguishedName: CN=S-1-5-21-627072207-2265849604-124128874-513 Which clearly shows that Domain Users (the RID 513) is mapped to the Unix ID (xidNumber) 100 If you check /etc/group on the DC you will find this: grep '100' /etc/group users:x:100:<LIST_OF_LOCAL_USERS&g...

...section "[sysvol]" Adding groups Importing groups Could not add group name=Domain Users ((68, "samldb: Account name (sAMAccountName) 'Domain Users' already in use!")) Could not modify AD idmap entry for sid=S-1-5-21-3580906303-2510493029-2036897744-1018, id=500, type=ID_TYPE_GID ((32, "Base-DN '<SID=S-1-5-21-3580906303-2510493029-2036897744-1018>' not found")) Could not add posix attrs for AD entry for sid=S-1-5-21-3580906303-2510493029-2036897744-1018, ((32, "Base-DN '<SID=S-1-5-21-3580906303-2510493029-2036897744-1018>' not fou...

...] No such file or directory Adding groups Importing groups Could not add group name=Print Operators ((68, "samldb: Account name (sAMAccountName) 'Print Operators' already in use!")) Could not modify AD idmap entry for sid=S-1-5-21-1832519723-2688400599-3493754984-550, id=449, type=ID_TYPE_GID ((32, "Base-DN '<SID=S-1-5-21-1832519723-2688400599-3493754984-550>' not found")) Could not add posix attrs for AD entry for sid=S-1-5-21-1832519723-2688400599-3493754984-550, ((32, "Base-DN '<SID=S-1-5-21-1832519723-2688400599-3493754984-550>' not found&q...

I have succesfully migrated our users (~3900) from our Samba 3 DC/OpenLDAP, complete with passwords. I have some 300 + groups that I'm trying to get migrated to our Samba 4 AD. I can create the groups, but it looks from the domain-member's side that groups don't work as I expect them to. - Not all groups seems to be visible by using 'getent group'. It looks like groups

...> > ) > > I feel I can tell you this without breaking any confidences, > the OP sent me their idmap.ldb and the problem boiled down to > these three DNs > > CN=S-1-5-32-545 > CN=S-1-5-32-544 > CN=S-1-5-32-546 > > The classicupgrade seems to set these to 'ID_TYPE_GID' > instead of 'ID_TYPE_BOTH'. > > Rowland > > > -- > To unsubscribe from this list go to the following URL and read the > instructions: https://lists.samba.org/mailman/options/samba >