Groupmapping does not work for AD groups

Question

We have an ActiveDirectory where we get our users from. So authentication on the linux machine works over pam.

We managed this part to work so far, but we need all users to be part of the local group "users". This works as far as I understand with group mapping.

My SIDs are:

SID for local machine MYSERVER is: S-1-5-21-1487948860-3705201071-3703638889  
SID for domain MYDOMAIN is: S-1-5-21-1960408961-115176313-682003330

I created the group mapping with:

myserver:~# net groupmap add ntgroup="Domain Users" rid=513 unixgroup=users

The groupmapping looks like this:

myserver:~# net groupmap list -v

Domain Users
        SID       : S-1-5-21-1487948860-3705201071-3703638889-513
        Unix gid  : 100
        Unix group: users
        Group type: Domain Group
        Comment   : Domain Unix group
Administrators
        SID       : S-1-5-32-544
        Unix gid  : 10029
        Unix group: BUILTIN\administrators
        Group type: Local Group
        Comment   :
Users
        SID       : S-1-5-32-545
        Unix gid  : 12929
        Unix group: BUILTIN\users
        Group type: Local Group
        Comment   :

But when I login as an AD user I am not in the group users. All AD groups are shown correct and also the groups "BUILTIN\users" and "BUILTIN\administrator" are shown but no group "users"

I also tried

myserver:~# net groupmap delete ntgroup="Domain Users"
myserver:~# net groupmap delete ntgroup="Users"
myserver:~# net groupmap add ntgroup="Users" rid=545 unixgroup=users

But this seem to have no effect (smbd restart, winbindd restart executed). The user is still in the group "BUILTIN\users" and has no entry for "users"

I think I missed some important configuration step but don't know what this could be. Any help is highly appreciated!

We use samba version 3.6.3 on a SLES 11 kernel 3.0.76

==EDIT== 07.04.2016 15:34

I tried to map two non standard groups. AD group is grp_production, local linux group should be games

myserver:~# net groupmap add ntgroup="grp_production" rid=20443 unixgroup=games

Result is

myserver:~# net groupmap list -v
..
grp_production (S-1-5-21-1960408961-115176313-682003330-20443) -> games
..

Then I login as a user (member of the AD group grp_production) on the linux machine.

myserver:~# groups | grep games

No games group to find :-(

==EDIT 08.04.2016 07:39==
The only error I found in the logs was in /var/log/samba/log.winbindd-idmap

[2016/04/07 13:54:25.146170,  1] ../librpc/ndr/ndr.c:284(ndr_print_function_debug)
       wbint_Sid2Gid: struct wbint_Sid2Gid
          in: struct wbint_Sid2Gid
              dom_name                 : NULL
              sid                      : *
                  sid                      : S-1-5-21-1960408961-115176313-682003330-28693
[2016/04/07 13:54:25.146221, 10] winbindd/idmap_util.c:234(idmap_sid_to_gid)
  idmap_sid_to_gid: sid = [S-1-5-21-1960408961-115176313-682003330-28693], domain = ''
[2016/04/07 13:54:25.146247, 10] winbindd/idmap.c:507(idmap_backends_sid_to_unixid)
  idmap_backends_sid_to_unixid: domain = '', sid = [S-1-5-21-1960408961-115176313-682003330-28693]
[2016/04/07 13:54:25.146267, 10] winbindd/idmap.c:376(idmap_find_domain)
  idmap_find_domain called for domain ''
[2016/04/07 13:54:25.146290,  1] winbindd/idmap.c:209(idmap_init_domain)
  invalid range '100' specified for domain '*'
[2016/04/07 13:54:25.146308, 10] winbindd/idmap_util.c:260(idmap_sid_to_gid)
  idmap_backends_sid_to_unixid failed: NT_STATUS_NONE_MAPPED
[2016/04/07 13:54:25.146330, 10] lib/gencache.c:183(gencache_set_data_blob)
  Adding cache entry with key = IDMAP/SID2GID/S-1-5-21-1960408961-115176313-682003330-28693 and timeout = Thu Apr  7 13:56:25 2016

I 'grepped' all log for "games" and "grp_production" with no result.

Answer 1

They are well know sids for builtin groups - but I think they can be offset if there is a domain trust, that is where there are 2 or more BUILTIN/users

can you verify the the sid for the AD group in Powershell

Get-ADGroup -Identity users | select sid

see if there are any issues with listing users on the samba server

net usersidlist

one other thing is - is the users group already mapped to something?

net groupmap list

if the group is already mapped to something then you don't pass the rid value, rid is used to 'add' group, drop the rid if you are just 'modifying'

 net groupmap modify ntgroup='Domain Users' unixgroup='users'

Answer 2

Your net groupmap add command added the local machine's SID prefix to your RID, so it actually mapped the "Domain Users" group of your local machine which makes no sense.

Either tell the net command that your RID refers to the domain by specifying the appropriate type option:

net groupmap add ntgroup="Domain Users" rid=513 type=domain unixgroup=users

or specify the full SID:

net groupmap add ntgroup="Domain Users" sid=S-1-5-21-1960408961-115176313-513 unixgroup=users

You may have to delete the erroneous mapping first.