Craig White wrote:
In fact, you should do something like this (that's what I did, if you read the thread):On Mon, 2004-07-19 at 19:34, Josà Ildefonso Camargo Tolosa wrote:
---http://samba.idealx.org/smbldap-howto.fr.html as you recommended. I have one big question, which one do I put in '/etc/ldap.conf'
nss_base_passwd dc=wbcoll,dc=edu?one nss_base_shadow dc=wbcoll,dc=edu?one nss_base_group ou=Groups,dc=wbcoll,dc=edu?one
or
nss_base_passwd ou=Users,dc=wbcoll,dc=edu?one nss_base_shadow ou=Users,dc=wbcoll,dc=edu?one nss_base_group ou=Groups,dc=wbcoll,dc=edu?one
Neither, use this:
nss_base_passwd dc=wbcoll,dc=edu?sub nss_base_shadow dc=wbcoll,dc=edu?sub nss_base_group ou=Groups,dc=wbcoll,dc=edu?one
Look at the sub, it tells the system to descend to all the sub-objects it may have.
It is pertinent to consider that this suggestion waives any efficiency
for ease of use as it will tell all user lookups to search the entire
LDAP tree.
nss_base_passwd ou=Accounts,dc=wbcoll,dc=edu?sub nss_base_shadow ou=Accounts,dc=wbcoll,dc=edu?sub nss_base_group ou=Groups,dc=wbcoll,dc=edu?one
And under ou=Accounts,dc=wbcoll,dc=edu, you create another ou:
ou=People,ou=Accounts,dc=wbcoll,dc=edu here you place user accounts, and put this in the smb.conf for users
ou=Computers,ou=Accounts,dc=wbcoll,dc=edu and here you place computers accounts.
Off course, you can call Accounts whatever you want to call it: samba, domains, I don't know.
I already told him to use his second choice as that is most efficient. I
recognize that your option would permit the option of trying to use a
separate organizational unit for Computers but this guy is endlessly
confused, and simple is clearly better for his purposes, without
considering the impact of excessive searching of the LDAP db.
If you only have the ldap for samba, there will not be any problem.
It will also allow you to create others ou to futher organize your users (you can't ask someone to have, let's say, 900 users in just one ou). This would also allow you to delegate the administration of a group of users to another person, without giving him access to the whole directory.
I was endlessly confused myself when I started with this, I read many different howtos, all of them saying different things. And I have been a samba user for more than two years, I just started to use it with ldap about five months ago.
Craig
Ildefonso Camargo
-- To unsubscribe from this list go to the following URL and read the instructions: http://lists.samba.org/mailman/listinfo/samba
