Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

After upgrade Ubuntu version to 12.04, an error happens, when I want to create a new user through Samba (which is connected to the ldap server):

$ pdbedit -af "New User" newuser

Error message:

ldapsam_create_user: Unable to allocate a new user id: bailing out!
Failed to add entry for user newuser.

My samba configuration: smb.conf

    netbios aliases = ATOM
    workgroup = WORKGROUP
    server string = %h server (Samba, Ubuntu)
    wins support = no
    dns proxy = no
    interfaces = eth0 eth2
    log file = /var/log/samba/log.%m
    max log size = 1000
    syslog only = no
    syslog = 1
    panic action = /usr/share/samba/panic-action %d
    security = user
    encrypt passwords = true
    passdb backend = ldapsam:ldapi:///
    ldapsam:trusted = yes
    ldapsam:editposix = yes
    ldap admin dn = cn=root,dc=example,dc=com
    ldap delete dn = yes
    ldap group suffix = ou=groups
    ldap machine suffix = ou=computers
    ldap user suffix = ou=people
    ldap suffix = dc=example,dc=com
    ldap idmap suffix = ou=idmap
    idmap backend = ldap:ldapi:///
    idmap uid = 10000-20000
    idmap gid = 10000-20000
    template homedir = /srv/home/%u
    template shell = /bin/bash
    ldap ssl = Off
    ldap password sync = yes
    map to guest = bad user
    load printers = yes
    usershare allow guests = yes

    comment = Home Directories
    browseable = no
    path = %H/Z:
    read only = no
    valid users = %S

So would you please tell me what is the error, and how can I solve the problem to create a new user via samba?


I have also recently changed the user accessing ldap (here is root) and password (with smbpasswd -w PASSWORD)


Because I don't have enough points to post my answer, put it here:

Since idmap syntax has been changed in version 3.6 , the old idmap lines in smb.conf should be replaced by new syntax, i.e:

### Old idmap syntax (pre 3.0.25):
# ldap idmap suffix = ou=idmap
# idmap backend = ldap:ldapi:///
# idmap uid = 10000-20000
# idmap gid = 10000-20000

### New idmap syntax (post 3.0.25):
idmap config * : backend = ldap
idmap config * : range = 10000-20000
idmap config * : ldap_url = ldapi:///
idmap config * : ldap_base_dn = ou=idmap,dc=example,dc=com
idmap config * : ldap_user_dn = cn=root,dc=example,dc=com

The secret for the ldap_user_dn has to be set with

$ net idmap secret '*' password
share|improve this question

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.