Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am trying to get the uid and gid mapping I have set in active directory to copy from there to my already existing Ubuntu boxes that I am adding to a Windows 2008 Domain Controller. We are trying to get all machines joined, and since the machines already have these mappings form OpenLDAP, getting them to copy is very important. I am using Samba4, Winbind, Ubuntu 12.04.

smb.conf:

[global]
security = ads
realm = DOMAIN.NET
password server = dc01.domain.net
workgroup = DOMAIN
#idmap uid = 1000-99999
#idmap gid = 1000-99999
idmap config *:backend = tdb
idmap config *:range = 70001-80000
idmap config DOMAIN:backend = ad
idmap config DOMAIN:range = 500-40000
winbind nss info = rfc2307
winbind separator = +
winbind enum users = no
winbind enum groups = no
winbind use default domain = yes
template homedir = /home/%U
template shell = /bin/bash
client use spnego = yes
domain master = no

krb5.conf:

[logging]
    default = FILE:/var/log/krb5.log
[libdefaults]
    allow_weak_crypto = true
    ticket_lifetime = 24000
    default_realm = DOMAIN.NET
    default_tkt_enctypes = rc4-hmac
    default_tgs_enctypes = rc4-hmac
[realms]
    DOMAIN.NET = {
        kdc = DC01.DOMAIN.NET
        admin_server = DC01.DOMAIN.NET
        default_domain = DOMAIN
}
[domain_realm]
    .domain.net = DOMAIN.NET
    domain.net = DOMAIN.NET

nsswitch.conf

# pre_auth-client-config # passwd:         compat
passwd: compat winbind
# pre_auth-client-config # group:          compat
group: compat winbind
# pre_auth-client-config # shadow:         compat
shadow: compat winbind

hosts:          files dns wins
networks:       files

protocols:      db files
services:       db files
ethers:         db files
rpc:            db files

# pre_auth-client-config # netgroup:       nis
netgroup: nis

When I add the idmap config DOMAIN:backend = ad lines, I cannot ssh into the machine with a domain account, only local. If I comment those lines out, I can SSH with domain accounts and groups are read. Both config allow me to get returns from wbinfo, in both getent only returns local accts as well. I am beyond stumped.

share|improve this question
add comment

1 Answer

up vote 1 down vote accepted

The Unix attributes have to be set on the Domain Users group for the AD users to be pulled in. Then, anyone with the Unix fields defined can be queried.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.