0

I have an AD server running on server 2019. I just setup a linux box and configured samba for some reason i can't get getent group "domain admins" to show anything. if i do getent passwd Administrator it does work, and wbinfo -u or wbinfo --domain-groups works fine as well.

SMB.CONF

[global]
        server role = MEMBER SERVER
        security = ADS
        realm = TESTLAB.COM
        workgroup = TESTLAB
        dedicated keytab file = /etc/krb5.keytab
        kerberos method = secrets and keytab
        server string = Samba 4 %h
        log file = /var/log/samba/%m.log
        log level = 5
        idmap config * : backend = tdb
        idmap config * : range = 10000-20000
        idmap config TESTLAB : backend = rid
        idmap config TESTLAB : range = 30000-40000
        idmap config TESTLAB : backend = ad
        password server = adsrv1.testlab.com
        encrypt passwords = yes
        winbind refresh tickets = yes
        winbind offline logon = yes
        winbind enum users = yes
        winbind enum groups = yes
        winbind nested groups = yes
        winbind expand groups = 4
        winbind use default domain = yes
        #winbind normalize name = yes
        os level = 20
        domain master = no
        local master = yes
        preferred master = no
        map to guest = bad user
        host msdfs = no
        netbios name = smbsrv
        client min protocol = SMB2
        client max protocol = SMB3
        client ldap sasl wrapping = plain
        hosts allow = 10.0.0.0/16
        unix extensions = no
        reset on zero vc = yes
        veto files = /.bash_logout/.bash_profile/.bash_history/.bashrc/
        hide unreadable = yes
        acl group control = yes
        acl map full control = true
        ea support = yes
        vfs objects = acl_xattr
        store dos attributes = yes
        #dos flemode = yes
        dos filetimes = yes
        enable privileges = yes
        restrict anonymous = 2
        strict allocate = yes
        guest ok = no
        load printers = no
        printing = bsd
        printcap name = /dev/null
        disable spoolss = yes
        username map = /etc/samba/user.map
        template shell = /bin/bash
        template homedir = /home/TESTLAB/%U
[Data]
        comment = "User Data"
        path = /mnt/data
        create mask = 0770
        browseable = yes
        writable = yes
        valid users = @"Domain Admins" @"Domain Users"
        write list = @"Domain Admins" @"Domain Users"

NSSWITCH.CONF

passwd:         compat files winbind sss
group:          compat files windind sss
shadow:         compat files sss
gshadow:        files

hosts:          files dns mdns4_minimal [NOTFOUND=return] mdns4
networks:       files

protocols:      db files
services:       db files sss
ethers:         db files
rpc:            db files

netgroup:       nis sss
sudoers:        files sss

KRB5.conf

[libdefaults]
        default_realm = testlab.com
        dns_lookup_realm = false
        dns_lookup_kdc = true

# The following krb5.conf variables are only for MIT Kerberos.
        kdc_timesync = 1
        ccache_type = 4
        forwardable = true
        proxiable = true

# The following libdefaults parameters are only for Heimdal Kerberos.
        fcc-mit-ticketflags = true

[realms]
        testlab.com = {
                kdc = adsrv1.testlab.com
                admin_server = adsrv1.testlab.com
        }
        ATHENA.MIT.EDU = {
                kdc = kerberos.mit.edu
                kdc = kerberos-1.mit.edu
                kdc = kerberos-2.mit.edu:88
                admin_server = kerberos.mit.edu
                default_domain = mit.edu
        }
        ZONE.MIT.EDU = {
                kdc = casio.mit.edu
                kdc = seiko.mit.edu
                admin_server = casio.mit.edu
        }
        CSAIL.MIT.EDU = {
                admin_server = kerberos.csail.mit.edu
                default_domain = csail.mit.edu
        }
        IHTFP.ORG = {
                kdc = kerberos.ihtfp.org
                admin_server = kerberos.ihtfp.org
        }
        1TS.ORG = {
                kdc = kerberos.1ts.org
                admin_server = kerberos.1ts.org
        }
        ANDREW.CMU.EDU = {
                admin_server = kerberos.andrew.cmu.edu
                default_domain = andrew.cmu.edu
        }
        CS.CMU.EDU = {
                kdc = kerberos-1.srv.cs.cmu.edu
                kdc = kerberos-2.srv.cs.cmu.edu
                kdc = kerberos-3.srv.cs.cmu.edu
                admin_server = kerberos.cs.cmu.edu
        }
        DEMENTIA.ORG = {
                kdc = kerberos.dementix.org
                kdc = kerberos2.dementix.org
                admin_server = kerberos.dementix.org
        }
        stanford.edu = {
                kdc = krb5auth1.stanford.edu
                kdc = krb5auth2.stanford.edu
                kdc = krb5auth3.stanford.edu
                master_kdc = krb5auth1.stanford.edu
                admin_server = krb5-admin.stanford.edu
                default_domain = stanford.edu
        }
        UTORONTO.CA = {
                kdc = kerberos1.utoronto.ca
                kdc = kerberos2.utoronto.ca
                kdc = kerberos3.utoronto.ca
                admin_server = kerberos1.utoronto.ca
                default_domain = utoronto.ca
        }

[domain_realm]
        .mit.edu = ATHENA.MIT.EDU
        mit.edu = ATHENA.MIT.EDU
        .media.mit.edu = MEDIA-LAB.MIT.EDU
        media.mit.edu = MEDIA-LAB.MIT.EDU
        .csail.mit.edu = CSAIL.MIT.EDU
        csail.mit.edu = CSAIL.MIT.EDU
        .whoi.edu = ATHENA.MIT.EDU
        whoi.edu = ATHENA.MIT.EDU
        .stanford.edu = stanford.edu
        .slac.stanford.edu = SLAC.STANFORD.EDU
        .toronto.edu = UTORONTO.CA
        .utoronto.ca = UTORONTO.CA
        .testlab.com = TESTLAB.COM

SSSD.CONF

[sssd]
config_file_version = 2
services = nss, pam
domains = TESTLAB
# SSSD will not start if you do not configure any domains.
# Add new domain configurations as [domain/<NAME>] sections, and
# then add the list of domains (in the order you want them to be
# queried) to the "domains" attribute below and uncomment it.
; domains = LDAP

[nss]

[pam]

# Example LDAP domain
[TESTLAB.COM/LDAP]
id_provider = ldap
auth_provider = ldap
# ldap_schema can be set to "rfc2307", which stores group member names in the
# "memberuid" attribute, or to "rfc2307bis", which stores group member DNs in
# the "member" attribute. If you do not know this value, ask your LDAP
# administrator.
ldap_schema = rfc2307
ldap_uri = ldap://ldap.testlab.com
ldap_search_base = dc=testlab,dc=com
# Note that enabling enumeration will have a moderate performance impact.
# Consequently, the default value for enumeration is FALSE.
# Refer to the sssd.conf man page for full details.
enumerate = true
# Allow offline logins by locally storing password hashes (default: false).
cache_credentials = true

# An example Active Directory domain. Please note that this configuration
# works for AD 2003R2 and AD 2008, because they use pretty much RFC2307bis
# compliant attribute names. To support UNIX clients with AD 2003 or older,
# you must install Microsoft Services For Unix and map LDAP attributes onto
# msSFU30* attribute names.
[domain/TESTLAB]
id_provider = ldap
auth_provider = krb5
chpass_provider = krb5

ldap_uri = ldap://ldap.testlab.com
ldap_search_base = dc=testlab,dc=com
ldap_schema = rfc2307bis
ldap_sasl_mech = GSSAPI
ldap_user_object_class = user
ldap_group_object_class = group
ldap_user_home_directory = unixHomeDirectory
ldap_user_principal = userPrincipalName
ldap_account_expire_policy = ad
ldap_force_upper_case_realm = true

krb5_server = 10.0.0.10
krb5_realm = TESTLAB.COM
0

First thing to try is to correct the typo for group resolution in your nsswitch.conf file.

group:          compat files windind sss

...should be...

group:          compat files winbind sss
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.