I'm having an issue with SAMBA AD authentication. What i believe is happening, is that winbind is not able to see all of the users in my AD.
I can successfully query groups and domains with
wbinfo -u and
wbinfo -g, but when a user tries to authenticate, samba doesn't see them, and grepping for then in the output of
wbinfo -u returns no results.
I have ~160k objects in AD,
wbinfo -u | wc -l returns ~28k entries.
#======================= Global Settings ===================================== [global] # Domain Authntication Settings workgroup = <my domain> server string = <Sever String> security = ads passdb backend = tdbsam realm = <mydomain.com> client use spnego = yes ldap ssl = no # logging log level = 5 max log size = 50 # logs split per machine log file = /var/log/samba/%m.log # max 50KB per log file, then rotate ; max log size = 50 # User settings username map = /etc/samba/smbusers idmap uid = 10000-20000000 idmap gid = 10000-20000000 idmap backend = ad ; template primary group = <ad group> template shell = /sbin/nologin # Winbind Settings winbind separator = + winbind enum users = Yes winbind enum groups = Yes winbind netsted groups = Yes winbind nested groups = Yes winbind use default domain = Yes #Other Globals unix charset = LOCALE server string = <my server name> load printers = no printing = cups cups options = raw ; printcap name = /etc/printcap #obtain list of printers automatically on SystemV ; printcap name = lpstat ; printing = cups #============================ Share Definitions ============================== [share] comment = <share comment> path = /srv/smb/share guest ok = yes valid users = "DOMAIN+testUser" read only = yes
Any help, or pointers in the right direction - greatly appreciated!
Let me know if you need any log or other config files.