[Samba] wbinfo -i -> failed to call wbcGetpwnam: WBC_ERR_DOMAIN_NOT_FOUND

[Jeff Dickens]

Created a new thread because I screwed up and top-posted.


So I am still stuck. For reference here is the smb.conf on the member
server:

***@florence:~# more /etc/samba/smb.conf
[global]

netbios name = FLORENCE
security = ADS
workgroup = IOL
realm = IOL.SEAMANPAPER.COM <http://iol.seamanpaper.com/>

log file = /var/log/samba/%m.log
log level = 1

dedicated keytab file = /etc/krb5.keytab
kerberos method = secrets and keytab
winbind refresh tickets = yes

winbind trusted domains only = no
winbind use default domain = yes
winbind enum users = yes
winbind enum groups = yes

# idmap config used for your domain.
# Choose one of the following backends fitting to your
# requirements and add the corresponding configuration.
# idmap config ad
# - idmap config rid
# - idmap config autorid
idmap config *:backend = tdb
idmap config *:range = 2000-9999
idmap config IOL:backend = ad
idmap config IOL:schema_mode = rfc2307
idmap config IOL:range = 1000000-9999999

winbind nss info = rfc2307


[home]
path=/home/
read only = No


I increased the range because it seems like the DC is using IDs above
1,000,000. This is on the DC:

***@athens:~# wbinfo -u
administrator
test1
krbtgt
guest
***@athens:~# wbinfo -i administrator
administrator:*:0:100::/home/IOL/administrator:/bin/false
***@athens:~# wbinfo -i test1
test1:*:3000019:100:Test One:/home/IOL/test1:/bin/false
***@athens:~#


And on the member server:

***@florence:~# wbinfo -u
administrator
test1
krbtgt
guest
***@florence:~# wbinfo -i administrator
failed to call wbcGetpwnam: WBC_ERR_DOMAIN_NOT_FOUND
Could not get info for user administrator
***@florence:~# wbinfo -i test1
failed to call wbcGetpwnam: WBC_ERR_DOMAIN_NOT_FOUND
Could not get info for user test1
***@florence:~#

Also:

***@florence:~# wbinfo -n test1
S-1-5-21-870066441-3049097475-1009130827-1105 SID_USER (1)
***@florence:~# wbinfo -n administrator
S-1-5-21-870066441-3049097475-1009130827-500 SID_USER (1)

Thought it might have something to do with the fact that the Kerberos user
tools were not installed -but I set them up and no change.

***@florence:~# kinit ***@IOL.SEAMANPAPER.COM
Password for ***@IOL.SEAMANPAPER.COM:
***@florence:~# klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: ***@IOL.SEAMANPAPER.COM

Valid starting Expires Service principal
11/17/2015 17:20:51 11/18/2015 03:20:51 krbtgt/
***@IOL.SEAMANPAPER.COM
renew until 11/18/2015 17:19:59
***@florence:~# wbinfo -i test1
failed to call wbcGetpwnam: WBC_ERR_DOMAIN_NOT_FOUND
Could not get info for user test1
***@florence:~# !smbc
smbcontrol all reload-config
***@florence:~# wbinfo -i test1
failed to call wbcGetpwnam: WBC_ERR_DOMAIN_NOT_FOUND
Could not get info for user test1
***@florence:~#

I found a note about a missing link to libnss_winbind.so.2.. fixed that and
no difference.

So it can list the users but not get the IDs... So it seems to have some
kind of authentication issue.

I've been all through the wiki and can't find anything else that seems
relevant.

[Michael Adam]

Hi Jeff,

Post by Jeff Dickens
Created a new thread because I screwed up and top-posted.
So I am still stuck. For reference here is the smb.conf on the member
[global]
netbios name = FLORENCE
security = ADS
workgroup = IOL
realm = IOL.SEAMANPAPER.COM <http://iol.seamanpaper.com/>
log file = /var/log/samba/%m.log
log level = 1
dedicated keytab file = /etc/krb5.keytab
kerberos method = secrets and keytab
winbind refresh tickets = yes
winbind trusted domains only = no
winbind use default domain = yes
winbind enum users = yes
winbind enum groups = yes
# idmap config used for your domain.
# Choose one of the following backends fitting to your
# requirements and add the corresponding configuration.
# idmap config ad
# - idmap config rid
# - idmap config autorid
idmap config *:backend = tdb
idmap config *:range = 2000-9999
idmap config IOL:backend = ad
idmap config IOL:schema_mode = rfc2307
idmap config IOL:range = 1000000-9999999
winbind nss info = rfc2307
[home]
path=/home/
read only = No
I increased the range because it seems like the DC is using IDs above
administrator
test1
krbtgt
guest
administrator:*:0:100::/home/IOL/administrator:/bin/false
test1:*:3000019:100:Test One:/home/IOL/test1:/bin/false
administrator
test1
krbtgt
guest
failed to call wbcGetpwnam: WBC_ERR_DOMAIN_NOT_FOUND
Could not get info for user administrator
failed to call wbcGetpwnam: WBC_ERR_DOMAIN_NOT_FOUND
Could not get info for user test1
S-1-5-21-870066441-3049097475-1009130827-1105 SID_USER (1)
S-1-5-21-870066441-3049097475-1009130827-500 SID_USER (1)
Thought it might have something to do with the fact that the Kerberos user
tools were not installed -but I set them up and no change.

That should be irrelevant.

Post by Jeff Dickens
failed to call wbcGetpwnam: WBC_ERR_DOMAIN_NOT_FOUND
Could not get info for user test1
I found a note about a missing link to libnss_winbind.so.2.. fixed that and
no difference.

That should not make a difference for wbinfo either.

Post by Jeff Dickens
So it can list the users but not get the IDs... So it seems to have some
kind of authentication issue.

So it is important to understand that you have not
been testing just ID-Mapping but nsswitch-level integration.

With 'wbinfo -i test1' you test the functionality that would be
used by 'getent passwd test1' through nsswitch. These are highly
aggtregate commands that do a lot of different calls.

To understand if id-mapping is the problem, you can use wbinfo
like this:

# wbinfo -n test1
S-1-5-21-870066441-3049097475-1009130827-1105 SID_USER (1)
# net cache flush
# wbinfo -S S-1-5-21-870066441-3049097475-1009130827-1105

(or wbinfo --sid-to-uid FOO)

and check the result. If this fails, you should look into
/var/log/samba/log.winbindd-idmap for clues.
Note that 'net cache flush' will make sure that the idmap
request is not answered from the cache but winbindd will
go out to the server.
You may want to increase samba's debug level and redo the
test if there is no clue in there.

Cheers - Michael

[Andrey Repin]

Greetings, Jeff Dickens!

Post by Jeff Dickens
Created a new thread because I screwed up and top-posted.
So I am still stuck. For reference here is the smb.conf on the member
[global]
netbios name = FLORENCE
security = ADS
workgroup = IOL
realm = IOL.SEAMANPAPER.COM <http://iol.seamanpaper.com/>
log file = /var/log/samba/%m.log
log level = 1
dedicated keytab file = /etc/krb5.keytab
kerberos method = secrets and keytab
winbind refresh tickets = yes
winbind trusted domains only = no
winbind use default domain = yes
winbind enum users = yes
winbind enum groups = yes
# idmap config used for your domain.
# Choose one of the following backends fitting to your
# requirements and add the corresponding configuration.
# idmap config ad
# - idmap config rid
# - idmap config autorid
idmap config *:backend = tdb
idmap config *:range = 2000-9999
idmap config IOL:backend = ad
idmap config IOL:schema_mode = rfc2307
idmap config IOL:range = 1000000-9999999

Here's the part of the problem. It appears to me the NSS link was first set up
with range under 3kk. With builtin and local UID/GID's going over 3kk.
With changing the range post factum, you've threaded on the reserved range.

Post by Jeff Dickens
winbind nss info = rfc2307
[home]
path=/home/
read only = No
I increased the range because it seems like the DC is using IDs above
1,000,000.

You should use the same range the domain was provisioned with. Or NSS
initialized with.
If you are migrating the domain from Samba3, it may become rather complicated
to figure out the right range.

Post by Jeff Dickens
administrator
test1
krbtgt
guest
administrator:*:0:100::/home/IOL/administrator:/bin/false
test1:*:3000019:100:Test One:/home/IOL/test1:/bin/false

Note the artificially low UID and GID numbers. That doesn't look like the NSS
is in play.

Also, to the your previous example of 'wbinfo -i "domain users"'...

# wbinfo --group-info 'domain users'
domain users:x:513:

(The point being, 'domain users' is not a user, and -i only looking for users.)
--
With best regards,
Andrey Repin
Sunday, November 22, 2015 12:49:57

Sorry for my terrible english...

[Rowland Penny]

Post by Andrey Repin
Greetings, Jeff Dickens!

Post by Jeff Dickens
Created a new thread because I screwed up and top-posted.
So I am still stuck. For reference here is the smb.conf on the member
[global]
netbios name = FLORENCE
security = ADS
workgroup = IOL
realm = IOL.SEAMANPAPER.COM <http://iol.seamanpaper.com/>
log file = /var/log/samba/%m.log
log level = 1
dedicated keytab file = /etc/krb5.keytab
kerberos method = secrets and keytab
winbind refresh tickets = yes
winbind trusted domains only = no
winbind use default domain = yes
winbind enum users = yes
winbind enum groups = yes
# idmap config used for your domain.
# Choose one of the following backends fitting to your
# requirements and add the corresponding configuration.
# idmap config ad
# - idmap config rid
# - idmap config autorid
idmap config *:backend = tdb
idmap config *:range = 2000-9999
idmap config IOL:backend = ad
idmap config IOL:schema_mode = rfc2307
idmap config IOL:range = 1000000-9999999

Here's the part of the problem. It appears to me the NSS link was first set up
with range under 3kk. With builtin and local UID/GID's going over 3kk.
With changing the range post factum, you've threaded on the reserved range.

Post by Jeff Dickens
winbind nss info = rfc2307
[home]
path=/home/
read only = No
I increased the range because it seems like the DC is using IDs above
1,000,000.

You should use the same range the domain was provisioned with. Or NSS
initialized with.
If you are migrating the domain from Samba3, it may become rather complicated
to figure out the right range.

Post by Jeff Dickens
administrator
test1
krbtgt
guest
administrator:*:0:100::/home/IOL/administrator:/bin/false
test1:*:3000019:100:Test One:/home/IOL/test1:/bin/false

Note the artificially low UID and GID numbers. That doesn't look like the NSS
is in play.

This is on the DC, unless 'Domain Users' is given a gidNumber this is
what you get and also winbind will *not* work on a domain member.

Post by Andrey Repin
Also, to the your previous example of 'wbinfo -i "domain users"'...
# wbinfo --group-info 'domain users'
(The point being, 'domain users' is not a user, and -i only looking for users.)

You need to give 'Domain Users' a gidNumber if you want to use the
winbind 'ad' backend on a domain member.

Rowland