I have a Redhat ES 6 server that's successfully joined to a domain via Winbind (i.e. I can login to the Redhat server using domain credentials with no issues).

What I'm looking to do at this point is configure Winbind to automatically add users to a local group based on their domain group. So, for example, say my username on the domain is "DOMAIN\coledot" and I'm a member of the domain group "Arbitrary Group". In my /etc/group file on the Redhat machine, I have the local group "testgrp" defined:


If my understanding of the Samba/Winbind groupmap documentation is correct, I should be able to map the local group "testgrp" to the domain group "Arbitrary Group" by using the net groupmap command:

net groupmap add ntgroup="Arbitrary Group" unixgroup=testgrp type=d

Running net groupmap list confirms the mapping is created:

root@host # net groupmap list  
Arbitrary Group (S-x-x-xx-xxxxxxxxxx-xxxxxxxxx-xxxxxxxxx-xxxx) -> testgrp

However, when I run the groups command, even though my user shows up as part of the "Arbitrary Group" group, "testgrp" is nowhere to be found.

My question is twofold:
1) Is my understanding of net groupmap correct?
2) How can I accomplish my original task (map domain user to local group via domain group)?


I believe you can accomplish this in the /etc/samba/smb.conf file. If your local Linux permissions are correct, you can use the "force group" string to make sure you're connecting with the correct group membership. What tends to throw people off is that the user may already be a member of the local Linux group, but as far as SMB is concerned, the group you 'connect as' from Windows is what matters here.

        writable = yes
        browsable = yes
        valid users = @somegroup
        create mask = 0775
        force create mode = 0775
        directory mask = 0775
        force group = somegroup

AFAIK this mapping from SMB groups to Linux groups is done on the domain controller, only. Member servers do this automatically (either globally by LDAP or locally different by idmap).

I just tried to add a winbind user to a local group via usermod. This failed. Perhaps user are managed either completely by files or completely by winbind (referring to nsswitch.conf) but not by both simultaneously.

If this works then you could get the group members via "getent group" and add them to a local group. This could be done regularly (if you don't have access to the DC) and would leave just the time between account creation on the DC and the first access to the member server (if this access is before the next regular check) problematic.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.