Having issues accessing our shares on a Samba 4.7.10 installation recently upgraded from 4.5.15 on AIX server. FYI I have no direct access or control over Samba configuration, but am trying to understand the issue and hopefully help troubleshooting.
Current situation (trying to get access to configuration file so I can detail and/or confirm this):
- security = ads
- realm = domain.ca
- password server = server1 server2
- clients are Windows 7 and Windows 10; I'm using the later
I'm told that:
- Samba 4.7 is more secure and requires users primary group to match with group in samba config file for a particular share
- for a given share to /top/down/directory, all directories must have same group
- for a given share to /top/down/directory with "valid users = @group", members of @group must have their primary group set to @group
What I'm experiencing:
- with share to /top/leaf having "valid users = @group1" & top's group = @group1 & leaf's group = @group2 & my primary group = @group1, I'm getting the Windows Security logon prompt, which never allows me in
- with share to /top/leaf having "valid users" = top's group = leaf's group = my primary group = @group1, access is granted (even without a logon prompt)
- after I reset leaf's group to @group2, I'm still allowed access; I assume some kind of Windows credential caching is happening here
The issue:
- having to update directories' group to match users' primary group is not practical nor secure in our environment
Questions:
- What should I be investigating next?
- Or more generally does any of that make sense?
ANY clue would be appreciated! :-)