Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a Redhat ES 6 server that's successfully joined to a domain via Winbind (i.e. I can login to the Redhat server using domain credentials with no issues).

What I'm looking to do at this point is configure Winbind to automatically add users to a local group based on their domain group. So, for example, say my username on the domain is "DOMAIN\coledot" and I'm a member of the domain group "Arbitrary Group". In my /etc/group file on the Redhat machine, I have the local group "testgrp" defined:

testgrp:x:10506:

If my understanding of the Samba/Winbind groupmap documentation is correct, I should be able to map the local group "testgrp" to the domain group "Arbitrary Group" by using the net groupmap command:

net groupmap add ntgroup="Arbitrary Group" unixgroup=testgrp type=d

Running net groupmap list confirms the mapping is created:

root@host # net groupmap list  
[...]  
Arbitrary Group (S-x-x-xx-xxxxxxxxxx-xxxxxxxxx-xxxxxxxxx-xxxx) -> testgrp

However, when I run the groups command, even though my user shows up as part of the "Arbitrary Group" group, "testgrp" is nowhere to be found.

My question is twofold:
1) Is my understanding of net groupmap correct?
2) How can I accomplish my original task (map domain user to local group via domain group)?

share|improve this question

1 Answer 1

AFAIK this mapping from SMB groups to Linux groups is done on the domain controller, only. Member servers do this automatically (either globally by LDAP or locally different by idmap).

I just tried to add a winbind user to a local group via usermod. This failed. Perhaps user are managed either completely by files or completely by winbind (referring to nsswitch.conf) but not by both simultaneously.

If this works then you could get the group members via "getent group" and add them to a local group. This could be done regularly (if you don't have access to the DC) and would leave just the time between account creation on the DC and the first access to the member server (if this access is before the next regular check) problematic.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.