How can I change a login of a user in samba4 based domain?
I've tried reading the samba-tool man page, but it does not seem to show anything that i could use.
Server Fault is a question and answer site for system and network administrators. It only takes a minute to sign up.
Sign up to join this communityHow can I change a login of a user in samba4 based domain?
I've tried reading the samba-tool man page, but it does not seem to show anything that i could use.
Assuming we use Ubuntu and Samba 4 is configured as a DC (Active Directory Domain Controller) and we want to change the user with name Old User
and login olduser
. To just rename a users login name, we can use samba-tool
:
test-smb:~# samba-tool user edit olduser
This will open an editor showing the content of the LDAP entry. Change the attributes sAMAccountName
and userPrincipalName
, save and exit. You may also want to rename any existing home directory of the user.
We can also edit the LDAP entry directly without using the samba-tool
but with the ldb-tools
.
Install ldb-tools
:
apt install ldb-tools
Now we can use the ldb-tools
(ldbadd
, ldbdel
, ldbedit
, ldbmodify
, ldbrename
, ldbsearch
) to search or modify the LDAP database directly.
Locate the Samba LDAP database:
If you installed an Ubuntu packaged version of samba
, this file should be found at /var/lib/samba/private/sam.ldb
.
Let's first have a look at that user in the LDAP database:
Search the database:
We use ldbsearch
for that with the following syntax:
ldbsearch -H <database-file> <ldap-filter>
With the <ldap-filter>
we can specify an expression to filter the entries returned by the search. We can for example use sAMAccountName=olduser
to filter based on the login name attribute or CN=Old User
to filter based on the CN (Common Name) attribute:
test-smb:~# ldbsearch -H /var/lib/samba/private/sam.ldb 'CN=Old User'
# record 1
dn: CN=Old User,CN=Users,DC=test-smb,DC=example,DC=com
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: user
cn: Old User
sn: User
givenName: Old
instanceType: 4
whenCreated: 20180904091809.0Z
whenChanged: 20180904091809.0Z
displayName: Old User
uSNCreated: 3841
name: Old User
objectGUID: 038979ea-107d-4c97-85bf-76d1f2326608
badPwdCount: 0
codePage: 0
countryCode: 0
badPasswordTime: 0
lastLogoff: 0
lastLogon: 0
primaryGroupID: 513
objectSid: S-1-5-21-3075026989-1808589244-366107480-1105
accountExpires: 9223372036854775807
logonCount: 0
sAMAccountName: olduser
sAMAccountType: 805306368
userPrincipalName: olduser@test-smb.example.com
objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=test-smb,DC=phys,DC=et
hz,DC=ch
mail: olduser@test-smb.example.com
loginShell: /bin/bash
pwdLastSet: 131805262894707270
userAccountControl: 512
uSNChanged: 3844
distinguishedName: CN=Old User,CN=Users,DC=test-smb,DC=example,DC=com
...
Change the login name attributes
Create a text file (rename-login.ldif
) with the following contents:
dn: CN=Old User,CN=Users,DC=test-smb,DC=phys,DC=ethz,DC=ch
changetype: modify
replace: sAMAccountName
sAMAccountName: newuser
-
replace: userPrincipalName
userPrincipalName: newuser@test-smb.phys.ethz.ch
This will modify the attributes sAMAccountName
and userPrincipalName
:
test-smb:~# ldbmodify -H /var/lib/samba/private/sam.ldb rename-login.ldif
Modified 1 records successfully
Rename the LDAP entry by renaming the RDN (Relative Distinguished Name)
It looks like renaming an LDAP entry is not possible using the samba-tool
and we have to use ldb-tools
:
test-smb:~# ldbrename -H /var/lib/samba/private/sam.ldb 'CN=Old User,CN=Users,DC=test-smb,DC=example,DC=com' 'CN=New User,CN=Users,DC=test-smb,DC=example,DC=com'
Renamed 1 record
This will also change the attributes cn
and name
, but not some other attributes, still containing the old user name as shown by the next search:
test-smb:~# ldbsearch -H /var/lib/samba/private/sam.ldb 'CN=New User'
# record 1
dn: CN=New User,CN=Users,DC=test-smb,DC=example,DC=com
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: user
sn: User
givenName: Old
instanceType: 4
whenCreated: 20180904091809.0Z
displayName: Old User
uSNCreated: 3841
objectGUID: 038979ea-107d-4c97-85bf-76d1f2326608
badPwdCount: 0
codePage: 0
countryCode: 0
badPasswordTime: 0
lastLogoff: 0
primaryGroupID: 513
objectSid: S-1-5-21-3075026989-1808589244-366107480-1105
accountExpires: 9223372036854775807
sAMAccountType: 805306368
objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=test-smb,DC=phys,DC=et
hz,DC=ch
mail: olduser@test-smb.example.com
loginShell: /bin/bash
pwdLastSet: 131805262894707270
userAccountControl: 512
lastLogonTimestamp: 131805264616461980
sAMAccountName: newuser
userPrincipalName: newuser@test-smb.example.com
lastLogon: 131805271152497360
logonCount: 12
cn: New User
name: New User
whenChanged: 20180904100228.0Z
uSNChanged: 3847
distinguishedName: CN=New User,CN=Users,DC=test-smb,DC=example,DC=com
Modify the remaining attributes
To also change some other attributes, like for example givenName
, displayName
or mail
, we can use:
samba-tool user edit newuser
and edit the user interactively or use another ldbmodify
as follows:
Create a text file (rename-other-attrs.ldif
) with the following contents:
dn: CN=New User,CN=Users,DC=test-smb,DC=phys,DC=ethz,DC=ch
changetype: modify
replace: givenName
givenName: New
-
replace: displayName
displayName: New User
-
replace: mail
mail: newuser@test-smb.example.com
Modify the LDAP entry::
test-smb:~# ldbmodify -H /var/lib/samba/private/sam.ldb rename-other-attrs.ldif
Modified 1 records successfully
ldbedit
from the ldb-tools
to edit the entry/database interactively and make all the changes done with samba-tool user edit
or ldbmodify
. For example: ldbedit -H /var/lib/samba/private/sam.ldb 'cn=John Doe'
– rda
Sep 4 '18 at 12:58