search for: unixid

...e like.. 10 packages, and then notice that glibc, and gcc needs upgrading too and I'd just land in rpm dependency hell) >> milhouse:/etc # smbadduser mr:test > smbadduser -a mrtest.... > mrtest must be a user on the system... milhouse:/etc # smbadduser -a mr:test ERROR: Must use unixid:ntid like -> zak:zakharoffm No such map passwd.byname. Reason: Request arguments bad ERROR: mr Not in passwd database SKIPPING... I do assume that you meant smbadduser -a unixid:ntid And also: the user `mr' in this case is a user on the system (I can log in as this user without a problem)

...:) > > hehe, I'm glad to hear that, that's for sure ;) > > > >ooops... i read to fast, sorry... > >i never used the smbadduser command. > >the script smbadduser in my system (i have debian) just add a line in the > >usermap file so you cap 'map' a unixid (local user) as a ntid (an alias or > >mapped user) checking if exist a user in the localmachine matching the > >unixid or if there is already a user mapped in smbpasswd with it. > > >I can suggest to find the usermap file and check if it is included in the > >smb.config...

Seems that each system is making up it own id's. Both the centos and fedora systems have the same idmap settings. idmap uid = 3000000-4000000 idmap gid = 3000000-4000000 samba 3.5.5 winbind and nss on fedora 13 workstation uid=3000000(jonnt) gid=3000004(domain users) groups=3000004(domain users),3000005(domain admins),3000006(denied rodc password replication

...; >>altogether), but I can't understand why sometimes the ID mapping comes > >>from the rfc2307 attributes and then later on not. > >I don't understand that yet. > >As explained in my previous mail, what can happen is that > >a user first (before given a rfc unixID) gets its uid from the > >idmap.ldb, but as soon as there is a unixid in the rfc > >attributes in his ldap object, that should always be used. > > > >This is a per-user thing. > > > >It is not surpsising that an externally configured sssd > >(configured to...

...ackend = tdb And, yes the smb.conf manpage does say this: These are suitable for use in the default idmap configuration. and refer to tdb,tdb2 and ldap. I wouldn't use any of these on a Unix domain member, because the manpage also says this: these create mappings of their own using internal unixid counters and store the mappings in a database. This means there is no way to ensure that users and groups will get the same ID on different Unix domain members. Rowland

...view of things (which is another story > altogether), but I can't understand why sometimes the ID mapping comes > from the rfc2307 attributes and then later on not. I don't understand that yet. As explained in my previous mail, what can happen is that a user first (before given a rfc unixID) gets its uid from the idmap.ldb, but as soon as there is a unixid in the rfc attributes in his ldap object, that should always be used. This is a per-user thing. It is not surpsising that an externally configured sssd (configured to use rfc in a ad, and hence behaving more like a domain member)...

...is another story >> altogether), but I can't understand why sometimes the ID mapping comes >> from the rfc2307 attributes and then later on not. > I don't understand that yet. > As explained in my previous mail, what can happen is that > a user first (before given a rfc unixID) gets its uid from the > idmap.ldb, but as soon as there is a unixid in the rfc > attributes in his ldap object, that should always be used. > > This is a per-user thing. > > It is not surpsising that an externally configured sssd > (configured to use rfc in a ad, and hence beh...

...ther), but I can't understand why sometimes the ID mapping comes >>> >from the rfc2307 attributes and then later on not. >>> I don't understand that yet. >>> As explained in my previous mail, what can happen is that >>> a user first (before given a rfc unixID) gets its uid from the >>> idmap.ldb, but as soon as there is a unixid in the rfc >>> attributes in his ldap object, that should always be used. >>> >>> This is a per-user thing. >>> >>> It is not surpsising that an externally configured sssd &g...

...23:51, 10] lib/username.c:user_in_list(525) user_in_list: checking user |o'brienta| against |obrienta| [2004/06/01 16:23:51, 5] auth/auth_util.c:make_user_info_map(216) make_user_info_map: Mapping user [XX]\[o'brienta] from workstation [workstation] The entry in the users.map file is: unixid = o'brienta so it should map. I've tried enclosing the Windows name in double quotes, but that didn't help. This worked in 2.2.2 on Solaris 8, but we're now running 3.0.2a on Solaris 8 doing domain authentication. There are no local Samba accounts. I've applied the changes t...

...lto:michael.auleta@boeing.com] > I think I've narrowed down my problem, but I still don't know > where to fix it. It appears that scanning the > users.map file strips out the apostrophes and the Windows ID > never matches: > The entry in the users.map file is: > > unixid = o'brienta > > so it should map. I've tried enclosing the Windows name in > double quotes, but that didn't help. What happens if you escape the apostrophe with a backslash, like this: unixid = o\'brienta

...lto:michael.auleta@boeing.com] > I think I've narrowed down my problem, but I still don't know > where to fix it. It appears that scanning the > users.map file strips out the apostrophes and the Windows ID > never matches: > The entry in the users.map file is: > > unixid = o'brienta > > so it should map. I've tried enclosing the Windows name in > double quotes, but that didn't help. What happens if you escape the apostrophe with a backslash, like this: unixid = o\'brienta

...655975-2769631473-500 to uid With other accounts I don't see that error. In the log.winbindd (log level = 10) on the member I see this: [2017/11/14 20:14:36.631151, 1, pid=2654, effective(0, 0), real(0, 0), class=rpc_parse] ../librpc/ndr/ndr.c:471(ndr_print_function_debug) wbint_Sids2UnixIDs: struct wbint_Sids2UnixIDs out: struct wbint_Sids2UnixIDs ids : * ids: struct wbint_TransIDArray num_ids : 0x00000001 (1) ids: ARRAY(1) ids: struct...

...-- this is > >how it works by design. > > > > On the DC the users & groups get xidNumbers from idmap.ldb, but if they are > given uidNumbers and gidNumbers, these will be used instead. As far as I am > aware, it has always worked like this. Possibly. The current sid_to_unixid code works like this: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ if config has "idmap_ldb:use rfc2307 = true": if sam.ldb contains rfc uid/gid in AD object: use it # fall through if idmap.ldb contains mapping use it else: create new mapping in idmap.ldb use it ~~~~~~...

...ge is written to log.smbd. If I try to logon with user koch and correct password, then again the above error message is written to log.smbd. So I'm sure the new fileserver validates the password against the AD-DC. But after having validated the password the new fileserver cannot determine what unixid should be used for user NAV\koch. Consequently? "getent passwd koch"? shows empty output on the new fileserver. I have tried all idmap backends with all combinations of "idmap config NAV:something"-parameters and my final conclusion is: Instead of trying more and more idmap pa...

On 2015-11-07 at 12:37 +0000, Rowland Penny wrote: > On 07/11/15 11:31, Jonathan Hunter wrote: > >On 7 November 2015 at 10:11, Rowland Penny <rowlandpenny241155 at gmail.com> wrote: > >>Is it possible that sssd is failing? > >>What do you have in /etc/nsswitch? > ># cat /etc/nsswitch.conf | egrep "(passwd|group)" > >passwd: files sss >

...; > > These are suitable for use in the default idmap configuration. > > > > and refer to tdb,tdb2 and ldap. I wouldn't use any of these on a > > Unix domain member, because the manpage also says this: > > > > these create mappings of their own using internal unixid counters > > and store the mappings in a database. > > > > This means there is no way to ensure that users and groups will get > > the same ID on different Unix domain members. > > I'm the first to agree that using tdb for the DOMAIN domain is not > ideal. Howe...

...With other accounts I don't see that error. > > In the log.winbindd (log level = 10) on the member I see this: > > [2017/11/14 20:14:36.631151, 1, pid=2654, effective(0, 0), real(0, > 0), class=rpc_parse] ../librpc/ndr/ndr.c:471(ndr_print_function_debug) > wbint_Sids2UnixIDs: struct wbint_Sids2UnixIDs > out: struct wbint_Sids2UnixIDs > ids : * > ids: struct wbint_TransIDArray > num_ids : 0x00000001 (1) > ids: ARRAY(1) >...

...(525) > user_in_list: checking user |o'brienta| against |obrienta| > [2004/06/01 16:23:51, 5] auth/auth_util.c:make_user_info_map(216) > make_user_info_map: Mapping user [XX]\[o'brienta] from workstation > [workstation] > > The entry in the users.map file is: > > unixid = o'brienta > > so it should map. I've tried enclosing the Windows name in double quotes, > but that didn't help. > > This worked in 2.2.2 on Solaris 8, but we're now running 3.0.2a on Solaris > 8 doing domain authentication. > There are no local Samba accounts...

On both Samba 4.5.1 member server and Samba 3.6.25 member server I tried the following command wbinfo –set-uid-mapping=35049,S-1-5-21-xx-xx-xxx-xxx this should have created a mapping entry consistent with the one on the domain controller for a trusted user But I got the following error failed to call wbcSetUidMapping: WBC_ERR_NOT_IMPLEMENTED As far as I can tell from network

...ss=winbind] ../source3/winbindd/winbindd_ads.c:61(ads_cached_connection_reuse) Current tickets expire in 35972 seconds (at 1420487480, time is now 1420451508) [2015/01/05 10:51:48.579085, 10, pid=18923, effective(0, 0), real(0, 0), class=idmap] ../source3/winbindd/idmap_ad.c:452(idmap_ad_sids_to_unixids) Filter: [(&(|(sAMAccountType=805306368)(sAMAccountType=805306369)(sAMAccountType=805306370)(sAMAccountType=268435456)(sAMAccountType=536870912))(|(objectSid=\01\05\00\00\00\00\00\05\15\00\00\00\AD\A7\D8\C3\A75a\80a<\EF\1A\80\04\00\00)))] [2015/01/05 10:51:48.579963, 5, pid=18923, effec...