On Fri, Jan 27, 2017 at 11:15:40AM -0000, [email protected] wrote: > > On Wed, Jan 25, 2017 at 10:54:17PM -0000, smfrench(a)gmail.com wrote: > > > > It is sufficient in install sssd-libwbclient and make sure it is used > > instead of Samba's libwbclient, use the alternatives command to check > > this. > > > > I applied this hint on Arch Linux running smbd version 4.5.2 and and sssd > 1.14.2. Users are now correctly displayed (user@domain). The real drawback as > for many other distributions is, that each time libwbclient is updated, we > have to manually fix the library links.
Yes it is unfortunate that libwbclient is a real library and a configurable plugin. In Fedora the alternatives tool is used to manage this which works but is imo not an elegant solution. Btw, please note that in the log run might be necessary to run winbind and use Samba's libwbclient due to limitations in SSSD and increased security level in AD. E.g. only winbind can manage the Secure Channel connection to a AD DC. To make sure winbind and SSSD will use the same ID-SID mapping we added an idmap plugin for winbind which will ask SSSD for the mapping, see man idmap_sss for details. > > But there is an even worse issue, when using sssd instead of winbind on a > Samba domain server. Samba (smbd) stores ACLs of its shares in a database > (share_info.tdb). In the example below you see the content of a test share > 'fixedtest' (fixed as we applied Sumit's hint). > REVISION:1 > CONTROL:SR|DI|DP > OWNER:Unix User\root > GROUP:Unix Group\root > ACL:Unix Group\domain [email protected]:ALLOWED/OI|CI|I/FULL > ACL:Everyone:ALLOWED/OI|CI|I/READ > ACL:Unix User\root:ALLOWED/I/FULL > ACL:Creator Owner:ALLOWED/OI|CI|IO|I/FULL > ACL:Unix Group\root:ALLOWED/I/FULL > ACL:Creator Group:ALLOWED/OI|CI|IO|I/FULL > > On a Windows 7 client, the permissions look like this: > Path : Microsoft.PowerShell.Core\FileSystem::\\server01\adminshare\fixedtest > Owner : O:S-1-22-1-0 > Group : G:S-1-22-2-0 > Access : S-1-22-2-512 Allow FullControl > Everyone Allow ReadAndExecute, Synchronize > S-1-22-1-0 Allow FullControl > CREATOR OWNER Allow FullControl > S-1-22-2-0 Allow FullControl > CREATOR GROUP Allow FullControl > The GUI displays the SIDs as domain [email protected] (Unix Group\domain > [email protected]) and root (Unix User\root). The domain administrator, who > created the folder is mapped to root by a smbd user map. > > With these ACLs other users, that belong to group 'Domain Admins' have full > access to this folder. > However, when we replace from a Windows 7 client the above ACL by the > following one: > Path : Microsoft.PowerShell.Core\FileSystem::\\server01\adminshare\fixedtest > Owner : O:S-1-22-1-0 > Group : G:S-1-22-2-0 > Access : SAMDOM\Domain Admins Allow FullControl > SAMDOM\Domain Users Allow ReadAndExecute, Synchronize > SAMDOM\Department Allow Modify, Synchronize > > only the domain administrator has still access. All other users, that belong > to the Domain Admins group get access denied. > > The resulting Samba share database has following ACL: > REVISION:1 > CONTROL:SR|PD|SI|DI|DP > OWNER:Unix User\root > GROUP:Unix Group\root > ACL:S-1-5-21-1961322486-2366424275-2351687912-512:ALLOWED/OI|CI/FULL > ACL:S-1-5-21-1961322486-2366424275-2351687912-513:ALLOWED/OI|CI/READ > ACL:S-1-5-21-1961322486-2366424275-2351687912-1116:ALLOWED/OI|CI/CHANGE > > and getfacl on server01 shows: > # file: fixedtest > # owner: root > # group: root > user::rwx > user:root:rwx > group::rwx > group:root:rwx > group:domain\[email protected]:rwx > mask::rwx > other::r-x > default:user::rwx > default:user:root:rwx > default:group::rwx > default:group:root:rwx > default:group:domain\[email protected]:rwx > default:mask::rwx > default:other::r-x > > For us it looks like that if smbd uses libwbclient provided by sssd the > domain is ow correctly added, but smbd is not able to correctly map SIDs to > domain groups or users to store in its share ACL DB. > > What's still wrong here? I think you have to inspect the Samba logs to see why some ACLs get lost and why access is denied. While reading your description my first idea was https://fedorahosted.org/sssd/ticket/3028 but this is already fixed in sssd-1.14.2. bye, Sumit > > Btw. getent group domain\ admins correctly prints domain > [email protected]:*:512:[email protected],[email protected] > _______________________________________________ > sssd-users mailing list -- [email protected] > To unsubscribe send an email to [email protected] _______________________________________________ sssd-users mailing list -- [email protected] To unsubscribe send an email to [email protected]
