I am trying to get the uid and gid mapping I have set in active directory to copy from there to my already existing Ubuntu boxes that I am adding to a Windows 2008 Domain Controller. We are trying to get all machines joined, and since the machines already have these mappings form OpenLDAP, getting them to copy is very important. I am using Samba4, Winbind, Ubuntu 12.04.


security = ads
realm = DOMAIN.NET
password server = dc01.domain.net
workgroup = DOMAIN
#idmap uid = 1000-99999
#idmap gid = 1000-99999
idmap config *:backend = tdb
idmap config *:range = 70001-80000
idmap config DOMAIN:backend = ad
idmap config DOMAIN:range = 500-40000
winbind nss info = rfc2307
winbind separator = +
winbind enum users = no
winbind enum groups = no
winbind use default domain = yes
template homedir = /home/%U
template shell = /bin/bash
client use spnego = yes
domain master = no


    default = FILE:/var/log/krb5.log
    allow_weak_crypto = true
    ticket_lifetime = 24000
    default_realm = DOMAIN.NET
    default_tkt_enctypes = rc4-hmac
    default_tgs_enctypes = rc4-hmac
    DOMAIN.NET = {
        kdc = DC01.DOMAIN.NET
        admin_server = DC01.DOMAIN.NET
        default_domain = DOMAIN
    .domain.net = DOMAIN.NET
    domain.net = DOMAIN.NET


# pre_auth-client-config # passwd:         compat
passwd: compat winbind
# pre_auth-client-config # group:          compat
group: compat winbind
# pre_auth-client-config # shadow:         compat
shadow: compat winbind

hosts:          files dns wins
networks:       files

protocols:      db files
services:       db files
ethers:         db files
rpc:            db files

# pre_auth-client-config # netgroup:       nis
netgroup: nis

When I add the idmap config DOMAIN:backend = ad lines, I cannot ssh into the machine with a domain account, only local. If I comment those lines out, I can SSH with domain accounts and groups are read. Both config allow me to get returns from wbinfo, in both getent only returns local accts as well. I am beyond stumped.

1 Answer 1


The Unix attributes have to be set on the Domain Users group for the AD users to be pulled in. Then, anyone with the Unix fields defined can be queried.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.