Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I had setup a Samba 3 server as PDC with a passdb LDAP backend.

Server SID: S-1-5-21-3270... Domain: A

Every user has a SambaSID beginning with this Server SID. But now I try to setup a second server for some shares. This server should use the same LDAP backend because I don't want to have two LDAP backends. Otherwise I have to do modifcations (e.g. add users) twice.

Second Server SID: S-1-5-21-3797... Domain: B

But now when a user try to mount this new share I see this error in samba log: The primary group domain sid(S-1-5-21-3797....) does not match the domain sid(S-1-5-21-3270...) for xxx(S-1-5-21-3270...).

I understand the problem but what can I do to avoid to maintain two LDAP backends?

Regards, Simon

share|improve this question
up vote 1 down vote accepted

You have to think like if you were in a "real" Windows environment. In such environment, if you need to add more servers, you won't create a new domain for each of these servers. Here, it is the same.

Server A is pointing to the LDAP backend, with all the users and groups. Server is serving a domain controller.

So what you have to do is to setup your second server to be a member of the domain served by server A.

You will manage all your users and groups in one LDAP, server A as a domain controller will perform all the authentication for your users. Server B will serve your shares. And because they are both in the same domain, your users will be able to access ressources on both servers, without the need to perform Domain Trust Relationships.

This is a usual setup, even in a "real" Windows Active Directory setup : splitting the work of authentication and file services.

share|improve this answer
thank you for your detailed answer. – user2346281 Jun 13 '14 at 9:50
This is really the best way to do it but I was confused by the config of an old server which I use as template. The old config: [global] workgroup = B security = user passdb backend = ldapsam:ldap://[pdc Domain A] There aren't any trust relationships between these domains. I will use your way but can anyone tell me how this works with the old server? – user2346281 Jun 13 '14 at 9:59

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.