[Samba] using winbind to map existing unix to AD users
On our campus, we have an AD forest. Our particular department has a number of samba servers that authenticate to one tree of that AD forest. All of our users have accounts in LDAP for unix and AD for windows. We don't want/need winbind for authentication. However, we would like the ability of setting ACLs on the samba server from windows clients. So, I assume I need a mapping of unix uid to AD SID. It seems winbind is the solution for this, however it seems to want to generate the uids rather than using getpwent to look that up. Is there something simple that I'm overlooking? Otherwise, I'm considering using idmap_ldap and pre-filling that ldap directory base with the mappings myself. :-( Perhaps setup winbind with anon bind or something so that it _can't_ add anything itself; just look things up. I also saw one can use a 'net' command to pre-fill gid-sid mappings. That might be nice/easy too, but I don't see anything similar for uid-sid mappings. thank you Tom Lieuallen Oregon State University -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/options/samba
Re: [Samba] using winbind to map existing unix to AD users
On Tuesday 24 February 2009 09:23:57 Tom Lieuallen wrote: It seems winbind is the solution for this, however it seems to want to generate the uids rather than using getpwent to look that up. There are a few different plugins winbind can use to perform the uid-sid mapping. By default samba uses the tdb mapper which, as you describe, will generate uid maps on the fly. In my environment we have uid/gid info populated in active directory so our samba server is able to use the idmap_ad or idmap_adex modules to lookup uid info from ad. Depending on your environment you may be able to use the idmap_nss or idmap_ldap modules. See the idmap man pages on http://us6.samba.org/samba/docs/man/manpages-3/ Christian McHugh Northern Arizona University -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/options/samba
Re: [Samba] using winbind to map existing unix to AD users
Christian McHugh wrote: On Tuesday 24 February 2009 09:23:57 Tom Lieuallen wrote: It seems winbind is the solution for this, however it seems to want to generate the uids rather than using getpwent to look that up. There are a few different plugins winbind can use to perform the uid-sid mapping. By default samba uses the tdb mapper which, as you describe, will generate uid maps on the fly. In my environment we have uid/gid info populated in active directory so our samba server is able to use the idmap_ad or idmap_adex modules to lookup uid info from ad. Depending on your environment you may be able to use the idmap_nss or idmap_ldap modules. See the idmap man pages on http://us6.samba.org/samba/docs/man/manpages-3/ Christian McHugh Northern Arizona University I looked at idmap_ldap and idmap_ad, but from the documentation, it seemed that those were just used by winbindd as a central storage mechanism for the mapping. It would obviously use that for looking up maps that it had already defined, however it isn't clear to me how or if that fits in with an existing LDAP or AD account repository. While one would assume those modules would be pretty similar, the little documentation is different. The AD one mentions some schema, but the LDAP doc does not. The AD one says it is read-only, but there is no mention of that with LDAP. The docs make no mention of looking up existing (unix) UIDs. It sounds like winbind still uses the configurable range of available UIDs to generate its own mapping (which it would refer to in the future). Until I see some details, I'm going to assume this will be containerized in LDAP in its own area and not merged in with existing entries. Plus, I still don't see anything to lead me to believe that it will do a getpwent to lookup a UID before randomly choosing a uid from the available range. thanks Tom Lieuallen -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/options/samba
Re: [Samba] using winbind to map existing unix to AD users
On Tue, Feb 24, 2009 at 9:23 AM, Tom Lieuallen t...@engr.orst.edu wrote: On our campus, we have an AD forest. Our particular department has a number of samba servers that authenticate to one tree of that AD forest. All of our users have accounts in LDAP for unix and AD for windows. We don't want/need winbind for authentication. However, we would like the ability of setting ACLs on the samba server from windows clients. So, I assume I need a mapping of unix uid to AD SID. It seems winbind is the solution for this, however it seems to want to generate the uids rather than using getpwent to look that up. Is there something simple that I'm overlooking? May be you can use idmap backend = rid to use RID of the user SID to generate the UID and GID? http://www.samba.org/samba/docs/man/Samba-HOWTO-Collection/idmapper.html#id2599635 HTH, -Kums -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/options/samba
Re: [Samba] using winbind to map existing unix to AD users
Andrew Chaplin wrote: idmap backend = nss It took me a while to figure that one out and I only got it after someone posted something on this list that was somewhat related. I'm using it with 3.0.33 included in Solaris 10 and it works like a charm for win clients. OSX clients are a different story due to issues with Finder. This appears to be the right answer for our situation. It didn't work for me with samba 3.3.0, but it did with 3.3.1. thank you Tom Lieuallen -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/options/samba
