samba 3.6, group permissions from active directory, "

Question

I'm doing zfs configuration testing, and I'm trying to join a server to our AD domain. So far as I can tell I have successfully joined the domain with SAMBA 3.6. I can query for users and groups. However when I try to assign a domain group to a folder permissions I get "illegal group name"

Also worth noting is that I'm using IDMAP_RID to ensure that GIDs and UIDs are made consistently, but this is my first time implementing it so I'm green behind the ears, same for most of the rest of this.

I'm doing this on a FreeBSD 9.0 release box btw, that is connecting to an Active Directory 2003 domain.

The command I try is:

chown root:"DOMAIN\group" folder

The group has no spaces in it. For the groups that do, how should I format that?

Anyways, I'm not having any luck searching for what I've done wrong, so if someone could help that would be great.

nsswitch.conf:

group: files winbind
group_compat: nis
hosts: files dns
networks: files
passwd: files winbind
passwd_compat: nis
shadow: files winbind
shells: files
services: compat
services_compat: nis
protocols: files
rpc: files

smb.conf:

workgroup = DOMAIN
netbios name = hostname
realm = DOMAIN.LOCAL
server string = hostname
security = ADS
allow trusted domains = No
idmap backend = idmap_rid:KPAK=100000-999999
idmap uid = 100000-999999
idmap gid = 100000-999999
template shell = /bin/bash
winbind use default domain = Yes
winbind enum users = No
winbind enum groups = No
winbind nested groups = Yes
printer admin = "Domain Admins"
create mask = 2770
directory mask = 2770
read only = no
log file = /var/log/samba/log.%m
log level = 2 winbind:3
hosts allow = internal ip ranges incl vpn ip's
dns proxy = no

Answer 1

The UNIX chmod tool only handles UNIX groups.

You have to tell samba which UNIX GIDs correspond to Windows SIDs. See the group mapping chapter in the official HOWTO.