Re: [Samba] Re: NT/ADS and UNIX user convergence using Samba

[Paul Gienger]

I just set up your situation on a couple of test boxes.  You can follow 
the steps here: http://www.openldap.org/doc/admin22/quickstart.html 
start at step 8 if you've already gotten the OpenLDAP package installed 
via your distro's package management routine.  Set your domain equal to 
your windows domain name, for example, my test domain here was 
dc=active,dc=bis,dc=ae-solutions,dc=com where my windows domain was 
"ACTIVE" with a fqdn of active.bis.ae-solutions.com.  You then need to 
add one idmap object under it, I can't be much more specific than that, 
since I just found that someone hosed my ldap config on the test boxes.

news.gmane.org wrote:

Hi Steve,

I think you have two options, use winbind and bin NIS or vice versa.
If you choose to use winbind as you identified you have to worry about
   

mappings being different on individual
 

Samba servers, the only way to get around this currently is to use LDAP as
   

your idmap backend. This stores
 

the UID to SID mappings centrally for multiple Samba servers to share.
If you choose to use NIS you will have to mess around with smbpasswd and
   

net groupmap to make users and
 

groups visiable as valid accounts for Samba. Also your NTLM passwords will
   

not be sync'd to the domain but
 

Kerberos auth will work seemlessly. AFAIK
   

Thanks.  I did a little more poking around and it seems like I'm leaning
towards using winbind as my definitive authorization for this server and
removing NIS from the fileserver.  If I do this, I'll need to get LDAP up
and running to control the mapping of SID -> UID so my NT SIDs map to my NIS
UIDs for UNIX NFS clients that mount the volume(s).  I've seen several
descriptions of how to get the Samba side up (basically use the "idmap
backend" option in smb.conf), but I'm completely new to LDAP, and I haven't
found a simple description of how to set up an minimal LDAP server (probably
using OpenLDAP) on my linux box that would just contain the SID->UID
mappings.
Does anyone have a simple example configuration for OpenLDAP that they would
like to share?  You can post, or email me directly at:  [EMAIL PROTECTED]
Thanks in advance,
Steve


 

--
Paul Gienger                     Office:                701-281-1884
Applied Engineering Inc.         Cell:                  701-306-6254
Information Systems Consultant   Fax:                   701-281-1322
URL: www.ae-solutions.com        mailto:[EMAIL PROTECTED]
--
To unsubscribe from this list go to the following URL and read the
instructions:  http://lists.samba.org/mailman/listinfo/samba