On Fri, 2004-07-16 at 22:53, Craig White wrote: > On Fri, 2004-07-16 at 13:39, abebe lsslp wrote: > > > > I couldn't find any hint that leads me to believe the > > ldap doesn't work, but you might see something I > > don't. you will find the whole 'slapd.log' file here: > > http://150.208.105.24/smbldap-pdc/. (there are also > > log files for the xp machine. ('winxp.log.html' is log > > level 10 and 'winxp_log.html' is log level 3). Log > > level 10 doesn't really tell me anything log level 3 > > doesn't. > ---- > SID's don't match... > > dn: uid=Administrator,ou=Users,dc=wbcoll,dc=edu > <snip> > sambaPrimaryGroupSID: S-1-5-21-952094410-1508517273-1204454084-512 > sambaSID: S-1-5-21-952094410-1508517273-1204454084-2996 > > pdbedit -Lv testuser1 > <snip> > User SID: S-1-5-21-1414736517-1990894286-2385622597-3000 > Primary Group SID: S-1-5-21-1414736517-1990894286-2385622597-513 > > Who knows which SID is in smbldap_conf and which SID is in > dn=SambaDomainName,dc=wbcoll,dc=edu > > This should be one of the first things you check. > > Also - just for a point of reference (not that what I do is at all correct or even > recommended by the many people that know way more than I do), I set the primary > posix gid for all users to a posix labeled group and my /etc/samba/smbusers looks > like this: > # cat /etc/samba/smbusers > # Unix_name = SMB_name1 SMB_name2 ... > root = Administrator administrator admin > nobody = guest pcguest smbguest > > I hope this helps. ---- I went back and checked some more things - to further amplify what I see happening is that your smbldap isn't working at all.
The sambaSamAccount objects weren't added at all to your testuser1. Neither the objectclass nor any of the typical samba objects showed up at the bottom of your slapcat listing for testuser1 - they did appear for the other groups and users - which I presume were derived from your efforts to rpc net vampire. Since they appear when you enter the pdbedit -Lv testuser1, they are apparently getting supplied from somewhere or something but not from the testuser1 object in LDAP where it certainly needs to be. Clearly the SID in dn: sambaDomainName=AGUILAS,dc=wbcoll,dc=edu doesn't match other SID's (and curiously doesn't match that supplied in pdbedit -Lv testuser1). And then who knows what you're gonna get when you net getlocalsid? Also - when you net rpc vampire, you get posix Groups such as 'Domain Users' which don't work all that well for posix stuff because of the case, spaces, etc. While these will work fine for samba, I would strongly recommend that users be assigned to posix labeled groups such as 'users' - typically gidnumber 100 on a Red Hat system or similar or change the cn of those groups to be posix-like since the 'displayName' 'sambaGroupMapping' 'sambaSID' and 'sambaGroupType' objects are what Windows sees. Craig -- To unsubscribe from this list go to the following URL and read the instructions: http://lists.samba.org/mailman/listinfo/samba