0

I added a RedHat 7 machine to AD with winbind.

[root@redhat7 ~]# net ads info
LDAP server: <ldap_server_ip>
LDAP server name: <ldapservername>.<domain>.com
Realm: <DOMAIN>
Bind Path: dc=dc,dc=DOMAIN,dc=COM
LDAP port: 389
Server time: Wed, 25 Dec 2019 15:13:56 +03
KDC server: <kdc_ip>
Server time offset: 0
Last machine account password change: Wed, 25 Dec 2019 10:17:39 +03

[root@redhat7 ~]# net ads testjoin
Join is OK.

[root@redhat7 ~]# wbinfo -u
user1
user2
...

But when I tried "id user1" command:

[root@redhat7 ~]# id user1
id: user1: no such user

Why I cannot see the user info and how can I fix that issue? Because of this problem I cannot login to the server also.

Edit: wbinfo output:

# wbinfo -S S-1-5-21-......-....-... (myuser sid)
failed to call wbcSidToUid: WBC_ERR_DOMAIN_NOT_FOUND
Could not convert sid S-1-5-21-.....-.....-...... to uid
1

Let me guess, whilst you are using winbind, you are also using sssd. If you are, you should also be aware that you cannot use sssd with Samba >= 4.8.0. If this was Debian, I would suggest installing 'libnss-winbind libpam-winbind libpam-krb5', but as this is red hat, not sure, but I think they call then 'winbind-clients'

It might help if you posted your [global] part of your smb.conf

5
  • it was redhat. we solved the problem actually, i'll add the solution. But for knowledge, I don't use sssd. The problem was about sid and gid mapping and we flush the config and regenerate the id maps with a command. I'll share the command asap. Thank you. – Arda Güven Dec 31 '19 at 8:34
  • 1
    Sounds like you ran 'net cache flush' but I cannot think what command you used to 'regenerate' the id maps, as these are set by the 'idmap config' lines in smb.conf, I still think it would be a good idea if you posted your smb.conf. – Rowland Penny Dec 31 '19 at 11:13
  • I answered the question. You can check. It was about id mapping. I don't know what is the problem but the solution is below. – Arda Güven Jan 2 '20 at 6:47
  • Those idmap config lines, whilst correct are also wrong ;-) – Rowland Penny Jan 2 '20 at 9:05
  • The (*) default domain is meant for the Well Known SIDs and anything outside the domain, you should add lines for DOMAIN as well, see here: wiki.samba.org/index.php/Setting_up_Samba_as_a_Domain_Member – Rowland Penny Jan 2 '20 at 9:12
0

Mapping does not work correctly. We should remove trivia db and mapping files with below commands:

#service winbind stop
#service smb stop
#net cache flush
#rm -f /var/lib/samba/*.tdb
#rm -f /var/lib/samba/group_mapping.ldb
#systemctl start winbind
#systemctl start smb

Here it is my smb.conf, idmap lines:

idmap config * : backend = tdb
idmap config * : range = 10000 - 20000

After that winbind will can check id from Active Directory.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.