I want to map the NT Group Domain Users to a different UNIX group than users on my Samba 4.7.6 Active Directory Domain Controller, but when I try to do this, it fails as follows:

> net groupmap modify ntgroup='Domain Users' unixgroup='share' type=domain
Could not update group database

I read that you might now do this with winbind, so I tried, but then I get the following error.

> wbinfo --set-gid-mapping=1000,S-1-5-21-...-513
failed to call wbcSetGidMapping: WBC_ERR_NOT_IMPLEMENTED
Could not create or modify gid to sid mapping

What is the proper way to manage NT to UNIX group mapping in Samba 4?

EDIT: On the Samba mailing list I found someone with a similar problem, so maybe I could work around it by modifying the internal LDAP server directly? Something like:

ldbadd /var/lib/samba/private/sam.ldb.d/metadata.tdb ...

Unfortunately I have no experience with LDAP, so I don't know how to supply it with a valid LDIF file for my use case.

EDIT2: Thanks to a blogpost about Samba 4 user and group management in LDAP, I managed to edit the UNIX group that the NT group maps to:

> ldbedit -e nano -H /var/lib/samba/private/idmap.ldb '(objectSid=S-1-5-21-1580746459-3543417057-3597883204-513)'

> wbinfo --group-info='Domain Users'
AD.EXAMPLE\domain users:x:100:

> net groupmap list ntgroup='Domain Users'
Domain Users (S-1-5-21-1580746459-3543417057-3597883204-513) -> share

So the right group is now being reported by net groupmap, but wbinfo still reports the old value, so it probably does not get its data from that database. I am not sure how important wbinfo reporting the right group is for my use case, but I will see if I can change that as well before using this as my answer and marking it solved.


From what I have been able to piece together it seems that there is no tool available in Samba 4 that allows you to configure this properly, other than editing the built-in LDAP server directly.

The net tool does not seem to work well with the built-in LDAP server, only some operations are successful, e.g. listing the group mappings and granting rights work, but listing members of a group or modifying the group mappings does not work (as seen in my question).

To modify the mapping I ran the following commands as root. First we have to retrieve the SID of Domain Users, because it will be unique for each provisioning of the Samba server.

root> net groupmap list ntgroup='Domain Users'
Domain Users (S-1-5-21-1580746459-3543417057-3597883204-513) -> users

Then we update the built-in LDAP server's record for the SID by updating xidNumber: 100 with the intended UNIX GID:

root> ldbedit -e nano -H /var/lib/samba/private/idmap.ldb '(objectSid=S-1-5-21-1580746459-3543417057-3597883204-513)'
# 0 adds  1 modifies  0 deletes

Let's say you changed it to the GID 250 of the UNIX group called share, then calling net groupmap will result in the group reported back being share:

root> net groupmap list ntgroup='Domain Users'
Domain Users (S-1-5-21-1580746459-3543417057-3597883204-513) -> share

However wbinfo of winbindd will still report the old GID:

root> wbinfo --group-info='Domain Users'
AD.EXAMPLE\domain users:x:100:

So we have to invalidate the cache entry for Domain Users. After some experimentation I managed to do so by asking it to lookup the updated GID:

root> wbinfo --gid-info 250
AD.EXAMPLE\domain users:x:250:

Which is then also reported back correctly by --group-info:

root> wbinfo --group-info='Domain Users'
AD.EXAMPLE\domain users:x:250:

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.