search for: rf2307

On 18/06/2019 17:24, Edouard Guign? via samba wrote: > "winbind refresh tickets = yes" did not help for my case. > It always has for myself, I have never had to refresh any kerberos machine tickets manually Rowland

...sible) on every unix computer having shares o find | while read file; do echo getfacl "$file" | sed -e "s,user:olduid:,user:newuid:," | setfacl --set-file=- "$file"; done * What for user support ticket escalation :-) If your Windows AD does not use rf2307, you can switch to rid but then you'll have to perform the whole ACL change at once (since rf2307 allows me to choose UID I can perform the changes smoothly along time). Regards Le 03/08/2015 09:43, Stéphane PURNELLE a écrit : > Hi, > > A account created with samba3/ldap (created...

...ou just have to maintain the rfc2307 > attributes in another way, which you must be doing, because you want > to use them. FYI, https://blogs.technet.microsoft.com/activedirectoryua/2016/02/09/identity-management-for-unix-idmu-is-deprecated-in-windows-server/ is a useful blog post about the RF2307 attributes. Christof

Hi, A account created with samba3/ldap (created before 2014-02-20): SID: S-1-5-21-XXXXXXXXXX-XXXXXXXXX-XXXXXXXXXX-3216 UidNumber : 1108 A account created with Users and computers (samba 4 AD DC) SID: S-1-5-21-XXXXXXXXXX-XXXXXXXXX-XXXXXXXXXX-5878 uidNumber : 10023 My actual config (in file-server) : idmap config XXXXXX:backend = ad idmap config XXXXXX:schema_mode = rfc2307 idmap config

...case. >> > It always has for myself, I have never had to refresh any kerberos > machine tickets manually > Are you only ever authenticating against a Samba AD domain controller, though? Windows AD in the wild can be a pain in the ass. For example, I stop reading whenever I see RF2307 or adding POSIX attributes to Windows AD -- our AD domain admins can't (or possibly won't) accommodate this. > Rowland > > >

Hai, Im attempting not to be rude.. But.. > -----Oorspronkelijk bericht----- > > Are you only ever authenticating against a Samba AD domain controller, > though? Windows AD in the wild can be a pain in the ass. For example, > I stop reading whenever I see RF2307 or adding POSIX attributes to > Windows AD -- our AD domain admins can't (or possibly won't) accommodate this. So your admins dont know how to use RSAT, it that what your saying? Or are they just lazy.. https://www.server-world.info/en/note?os=Windows_Server_2019&p=active_direct...

Hi, In winbind, are there any plans to add the idmap_ad options "unix_primary_group" and "unix_nss_info" to the idmap_rfc2307 backend? I am using an ldap proxy to preserve the UNIX uids and gids between two domains, and it would be nice to also share the shell setting and the UNIX primary group as well.