Re: [Samba] Samba4 LDAP ACLs - access to POSIX attributes from a non-admin account

2012-12-16 Thread Rob McCorkell
Sorry for the late reply - was running it through testing in our environment. But so far it seems to be working a treat! Thanks for this, much appreciated. Rob On 15/12/12 16:42, Thomas Simmons wrote: Hello Rob, You can enable anonymous binding to AD by creating the attribute dsHeuristics

Re: [Samba] Samba4 LDAP ACLs - access to POSIX attributes from a non-admin account

2012-12-16 Thread Andrew Bartlett
On Fri, 2012-12-14 at 18:03 +, Rob McCorkell wrote: In our current testing environment, we are using nslcd to get user and group information from the Samba4 LDAP server, using the last part of objectSid as uidNumber. The configuration is designed to pull down unixHomeDirectory and

Re: [Samba] Samba4 LDAP ACLs - access to POSIX attributes from a non-admin account

2012-12-15 Thread Rob McCorkell
On 15/12/12 13:31, Achim Gottinger wrote: It might work if you give Anonymous full read Access to the cn=Users branch via AD User and Group management. How is it possible to do this from the Samba4 server? Unfortunately Windows is out of the question here, because this will be part of Karoshi

Re: [Samba] Samba4 LDAP ACLs - access to POSIX attributes from a non-admin account

2012-12-15 Thread Thomas Simmons
Hello Rob, You can enable anonymous binding to AD by creating the attribute dsHeuristics with a value of 002001001 under the DN: CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration The Microsoft instructions mention below mention using the ADSI Edit tool on Windows, but it can be

[Samba] Samba4 LDAP ACLs - access to POSIX attributes from a non-admin account

2012-12-14 Thread Rob McCorkell
In our current testing environment, we are using nslcd to get user and group information from the Samba4 LDAP server, using the last part of objectSid as uidNumber. The configuration is designed to pull down unixHomeDirectory and loginShell if they exist, but they default to standard values if

Re: [Samba] Samba4 LDAP ACLs - access to POSIX attributes from a non-admin account

2012-12-14 Thread Rob McCorkell
On the samba-technical mailing list there is this exact problem detailed, so your help is no longer needed to configure reading of unixHomeDirectory and loginShell by other users, but the question about anonymous access still stands - it would be much better for each client to have anonymous