How to rename a user in samba4 domain?

Question

How can I change a login of a user in samba4 based domain?

I've tried reading the samba-tool man page, but it does not seem to show anything that i could use.

Answer 1

Assuming we use Ubuntu and Samba 4 is configured as a DC (Active Directory Domain Controller) and we want to change the user with name Old User and login olduser. To just rename a users login name, we can use samba-tool:

test-smb:~# samba-tool user edit olduser

This will open an editor showing the content of the LDAP entry. Change the attributes sAMAccountName and userPrincipalName, save and exit. You may also want to rename any existing home directory of the user.

We can also edit the LDAP entry directly without using the samba-tool but with the ldb-tools.

Install ldb-tools:

apt install ldb-tools

Now we can use the ldb-tools (ldbadd, ldbdel, ldbedit, ldbmodify, ldbrename, ldbsearch) to search or modify the LDAP database directly.

Locate the Samba LDAP database:

If you installed an Ubuntu packaged version of samba, this file should be found at /var/lib/samba/private/sam.ldb.

Let's first have a look at that user in the LDAP database:

Search the database:

We use ldbsearch for that with the following syntax:

ldbsearch -H <database-file> <ldap-filter>

With the <ldap-filter> we can specify an expression to filter the entries returned by the search. We can for example use sAMAccountName=olduser to filter based on the login name attribute or CN=Old User to filter based on the CN (Common Name) attribute:

test-smb:~# ldbsearch -H /var/lib/samba/private/sam.ldb 'CN=Old User'
# record 1
dn: CN=Old User,CN=Users,DC=test-smb,DC=example,DC=com
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: user
cn: Old User
sn: User
givenName: Old
instanceType: 4
whenCreated: 20180904091809.0Z
whenChanged: 20180904091809.0Z
displayName: Old User
uSNCreated: 3841
name: Old User
objectGUID: 038979ea-107d-4c97-85bf-76d1f2326608
badPwdCount: 0
codePage: 0
countryCode: 0
badPasswordTime: 0
lastLogoff: 0
lastLogon: 0
primaryGroupID: 513
objectSid: S-1-5-21-3075026989-1808589244-366107480-1105
accountExpires: 9223372036854775807
logonCount: 0
sAMAccountName: olduser
sAMAccountType: 805306368
userPrincipalName: [email protected]
objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=test-smb,DC=phys,DC=et
 hz,DC=ch
mail: [email protected]
loginShell: /bin/bash
pwdLastSet: 131805262894707270
userAccountControl: 512
uSNChanged: 3844
distinguishedName: CN=Old User,CN=Users,DC=test-smb,DC=example,DC=com

...

Change the login name attributes

Create a text file (rename-login.ldif) with the following contents:

dn: CN=Old User,CN=Users,DC=test-smb,DC=phys,DC=ethz,DC=ch
changetype: modify
replace: sAMAccountName
sAMAccountName: newuser
-
replace: userPrincipalName
userPrincipalName: [email protected]

This will modify the attributes sAMAccountName and userPrincipalName:

test-smb:~# ldbmodify -H /var/lib/samba/private/sam.ldb rename-login.ldif
Modified 1 records successfully

Rename the LDAP entry by renaming the RDN (Relative Distinguished Name)

It looks like renaming an LDAP entry is not possible using the samba-tool and we have to use ldb-tools:

test-smb:~# ldbrename -H /var/lib/samba/private/sam.ldb 'CN=Old User,CN=Users,DC=test-smb,DC=example,DC=com' 'CN=New User,CN=Users,DC=test-smb,DC=example,DC=com'
Renamed 1 record

This will also change the attributes cn and name, but not some other attributes, still containing the old user name as shown by the next search:

test-smb:~# ldbsearch -H /var/lib/samba/private/sam.ldb 'CN=New User'
# record 1
dn: CN=New User,CN=Users,DC=test-smb,DC=example,DC=com
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: user
sn: User
givenName: Old
instanceType: 4
whenCreated: 20180904091809.0Z
displayName: Old User
uSNCreated: 3841
objectGUID: 038979ea-107d-4c97-85bf-76d1f2326608
badPwdCount: 0
codePage: 0
countryCode: 0
badPasswordTime: 0
lastLogoff: 0
primaryGroupID: 513
objectSid: S-1-5-21-3075026989-1808589244-366107480-1105
accountExpires: 9223372036854775807
sAMAccountType: 805306368
objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=test-smb,DC=phys,DC=et
 hz,DC=ch
mail: [email protected]
loginShell: /bin/bash
pwdLastSet: 131805262894707270
userAccountControl: 512
lastLogonTimestamp: 131805264616461980
sAMAccountName: newuser
userPrincipalName: [email protected]
lastLogon: 131805271152497360
logonCount: 12
cn: New User
name: New User
whenChanged: 20180904100228.0Z
uSNChanged: 3847
distinguishedName: CN=New User,CN=Users,DC=test-smb,DC=example,DC=com

Modify the remaining attributes

To also change some other attributes, like for example givenName, displayName or mail, we can use:

samba-tool user edit newuser

and edit the user interactively or use another ldbmodify as follows:

Create a text file (rename-other-attrs.ldif) with the following contents:

dn: CN=New User,CN=Users,DC=test-smb,DC=phys,DC=ethz,DC=ch
changetype: modify
replace: givenName
givenName: New
-
replace: displayName
displayName: New User
-
replace: mail
mail: [email protected]

Modify the LDAP entry::

test-smb:~# ldbmodify -H /var/lib/samba/private/sam.ldb rename-other-attrs.ldif
Modified 1 records successfully

Answer 2

One can also try the obvious:

/ # samba-tool user rename  --help
Usage: samba-tool user rename <username> [options]

Rename a user and related attributes.

This command allows to set the user's name related attributes. The user's
CN will be renamed automatically.
The user's new CN will be made up by combining the given-name, initials
and surname. A dot ('.') will be appended to the initials automatically
if required.
Use the --force-new-cn option to specify the new CN manually and the
--reset-cn option to reset this change.

Use an empty attribute value to remove the specified attribute.

The username specified on the command is the sAMAccountName.

The command may be run locally from the root userid or another authorized
userid.

The -H or --URL= option can be used to execute the command against a remote
server.

Example1:
samba-tool user rename johndoe --surname='Bloggs'

Example1 shows how to change the surname of a user 'johndoe' to 'Bloggs' on
the local server. The user's CN will be renamed automatically, based on
the given name, initials and surname.

Example2:
samba-tool user rename johndoe --force-new-cn='John Bloggs (Sales)' \
    --surname=Bloggs -H ldap://samba.samdom.example.com -U administrator

Example2 shows how to rename the CN of a user 'johndoe' to 'John Bloggs
(Sales)'.
Additionally the surname ('sn' attribute) is set to 'Bloggs'.
The -H parameter is used to specify the remote target server.

I'm posting this because with Active Directory there are many definitions of "login" (i.e. one may use userPrincipalName, and there are other options too, e.g. app I'm working on allows users to login with just their CN)