X-Recipient:	archive-cygwin AT delorie DOT com
DKIM-Filter:	OpenDKIM Filter v2.11.0 sourceware.org CF0D53858006
DKIM-Signature:	v=1; a=rsa-sha256; c=relaxed/relaxed; d=cygwin.com;
	s=default; t=1642421115;
	bh=dl47kr0ExdiRvd5wCFNbYTX1AiuT7xPj5CgOKahdBL4=;
	h=Date:From:To:Subject:References:In-Reply-To:List-Id:
	List-Unsubscribe:List-Archive:List-Post:List-Help:List-Subscribe:
	Reply-To:From;
	b=jN9kjPynCgd+aYpqdYkBfeUwV3kCoh2/QuVi5fwIaJmu2/FwggmuI1oXk8VLn1SNA
	qBKMcP5KFmwpS68pQq4rWQxnmzrF7WevQy5xEQj05X5k/hRrAS8uAtu1YLqCBeDiK6
	oj0AhiInw7YKzyoGDZa9WFvjdfTk9emQqauLDOmg=
X-Original-To:	cygwin AT cygwin DOT com
Delivered-To:	cygwin AT cygwin DOT com
DMARC-Filter:	OpenDMARC Filter v1.4.1 sourceware.org 5505C3858417
Authentication-Results:	sourceware.org;
	dmarc=fail (p=none dis=none) header.from=cygwin.com
Authentication-Results:	sourceware.org; spf=fail smtp.mailfrom=cygwin.com
Date:	Mon, 17 Jan 2022 13:04:43 +0100
From:	Corinna Vinschen <corinna-cygwin AT cygwin DOT com>
To:	cygwin AT cygwin DOT com
Subject:	Re: Help with standalone samba SID-uid mapping
Message-ID:	<YeVbW7iqmn6LfDb9@calimero.vinschen.de>
Mail-Followup-To:	cygwin AT cygwin DOT com
References:	<064846E1-8D6D-41D2-97D9-4C3793502CEE AT house DOT org>
	<YeFKleBRwCZcikxb AT calimero DOT vinschen DOT de>
	<7BA06F03-FCFA-492E-898F-F423F03E15F6 AT house DOT org>
MIME-Version:	1.0
In-Reply-To:	<7BA06F03-FCFA-492E-898F-F423F03E15F6@house.org>
X-Provags-ID:	V03:K1:97wKykA5j9wH6/ge+1PV1Im8Pp9k7fcHVR8gkDxUFZhrFeLtiWf
	PRtnPyrHPplYufcUNoNKNEDk2i1ntksiv6ZcommyKD5kOuJ0wZ5g0p5loxMY5mB5hkzpYwf
	YpitjKi5Ao3a8rMqTxW0nHC4a94wTq4CaUWg7Z0PzUkL7pcTMonfJEVG1k0Es6QUzGIaDAl
	Ert8NyWDegVUUkdGXUPfA==
X-UI-Out-Filterresults:	notjunk:1;V03:K0:z+CLzukjlrQ=:ays8ozphFEGOAZMWae9ydP
	kNIGZtxmAUJEYBHbhscZDiqEiXLvzrTHOqyHYnr8FF4fYIyofJzyVUh1jwPXTxVzhW2fvChyZ
	A33W1yAi2vT4kxbs9dMy8VoG2NBujx1X/VfSPWcSgDx04iZkajhPc2Mqvtz8jyurq++6OYxdc
	R9a36ZoEba/eNHUxREZ5qyXEkDs49/O4cz4lPH90fYekOR2laNx5YT+JFIrOwd6TKr9WEzNNU
	z/U0MqVPwi9DfgVCHu8VPICUZR2B63u6dozKTcr9jxoyB+6dGTxDWfFH1sXwx0QVNfE3pf8s+
	9aoIf8uzMKu2oiRk1BuZcTJZQI+iF2mlqw32z4CI5uMOnd8bNoDQwibiIFhrD00TAMQdxRqzT
	m+tMSNeUfpA0UKxt9ysoFRLzG6SOYSxcNZ3IVsPXTHCBRflEPPuNM5yY32Vi5e8/egsAqPd0W
	nuVupRqLQ9Mo7rPPaW3wizhZ3oxpNHRXwvCt0Kh7ZHMmxvt/JlNnEw2AkFTPHilGaAqQ9RY72
	wUd8pbSrcPx+1d1YZW8qWWJ7XQWI+FQgCgC7quCyqOz6uUI86DD+k6GvXU+Nmc8TFGtDqK1/A
	HpFRVdDaP7jN8DfVXTWB5dP/8yjsTIbPp7+mvScjNdRyRDCHi2dYMgAXtz8mDl2//MmOzYdje
	CqxmfUEEDDE8f7rXZ2ffyetE4rORwounznEKTk1hr7H407GHCQYQYMWMeKnurxLE7qQEC6z07
	8XPyWSny3cuvkk+Z
X-Spam-Status:	No, score=-95.8 required=5.0 tests=BAYES_00,
	GOOD_FROM_CORINNA_CYGWIN, KAM_DMARC_NONE, KAM_DMARC_STATUS, RCVD_IN_MSPIKE_H4,
	RCVD_IN_MSPIKE_WL, SPF_FAIL, SPF_HELO_NONE,
	TXREP autolearn=ham autolearn_force=no version=3.4.4
X-Spam-Checker-Version:	SpamAssassin 3.4.4 (2020-01-24) on
	server2.sourceware.org
X-BeenThere:	cygwin AT cygwin DOT com
X-Mailman-Version:	2.1.29
List-Id:	General Cygwin discussions and problem reports <cygwin.cygwin.com>
List-Unsubscribe:	<https://cygwin.com/mailman/options/cygwin>,
	<mailto:cygwin-request AT cygwin DOT com?subject=unsubscribe>
List-Archive:	<https://cygwin.com/pipermail/cygwin/>
List-Post:	<mailto:cygwin AT cygwin DOT com>
List-Help:	<mailto:cygwin-request AT cygwin DOT com?subject=help>
List-Subscribe:	<https://cygwin.com/mailman/listinfo/cygwin>,
	<mailto:cygwin-request AT cygwin DOT com?subject=subscribe>
Reply-To:	cygwin AT cygwin DOT com
Errors-To:	cygwin-bounces+archive-cygwin=delorie DOT com AT cygwin DOT com
Sender:	"Cygwin" <cygwin-bounces+archive-cygwin=delorie DOT com AT cygwin DOT com>

On Jan 14 11:57, Chris Roehrig wrote:
> On Fri Jan 14 2022, at 2:04 AM, Corinna Vinschen <corinna-cygwin AT cygwin DOT com> wrote:
> > These look like your standard Windows SIDs, so they are your SIDs for
> > users cristina and croehrig on Windows.  They should show up as such in
> > ls -l output, unless the SID is actuall wrong, e. g., they map to your
> > accounts on another machine or something like that.
> 
> No those are the SIDs supplied by the Samba server (see below for my local Windows SIDs).   Here they are directly on the Linux machine:
> housesrv[11]% smbcacls --numeric //housesrv/Users croehrig
> Enter WORKGROUP\croehrig's password: 
> REVISION:1
> CONTROL:0x9004
> OWNER:S-1-5-21-751087815-2087572193-42305691-1000
> GROUP:S-1-22-2-601
> ACL:S-1-5-21-751087815-2087572193-42305691-1000:0/0x0/0x001f01ff
> ACL:S-1-22-2-601:0/0x0/0x001200a9
> ACL:S-1-1-0:0/0x0/0x001200a9
> 
> (I think that Samba now uses a more complex IDMAP algorithm than when
> the Cygwin document above was written and now provides a full domain
> component to its SIDs.)

That may be so, but in my installation, Samba reports the Unix User ID
as owner, i. e.

  $ icacls \\\\server\\corinna\\foo
  \\server\corinna\foo S-1-22-1-500:(R,W,D,WDAC,WO)
                       S-1-22-2-11125:(R)
                       Everyone:(R)

and that's with Samba 4.15.3.  I'm doing the mapping via the AD
uidNumber and gidNumber fields.  I'm using this setup for so long that I
don't remember if I ever saw a "normal", Windows-like SID for the user
returned by Samba.  I never ran winbindd, up until Samba 4.15.3, which
was the first one forcing me to do so when using AD support.

> I just added those SIDs to  /etc/passwd and /etc/groups (double
> entries now) and it now works for the user, but (oddly) not the group:
> 
> tyto[6]% ls -l //housesrv/Users/				## NB: this is a UNC path to the samba share
> total 0
> drwxr-xr-x 1 cristina Unix_Group+603 0 Jan 12 16:06 cristina
> drwxr-xr-x 1 croehrig Unix_Group+601 0 Jan 14 09:18 croehrig
> [...]
> tyto[10]% cat /etc/group
> croehrig:S-1-22-2-601:601:
> cristina:S-1-22-2-603:603:
> croehrig:S-1-5-21-1290748074-662758565-4273641972-1006:601:
> cristina:S-1-5-21-1290748074-662758565-4273641972-1008:603:

Hmm, that's weird.  I just tried this myself.  First I created a stock
/etc/group file with all local and AD accounts.  Next I changed
/etc/nsswitch.conf:

  - group: db
  + group: files

Exit/restart Cygwin. `ls -l' now prints

  -rw-r--r-- 1 corinna Unknown+Group 13342 Jan 17 10:46 //calimero/corinna/foo

Now I add this line to /etc/group:

  mygroup:S-1-22-2-11125:11125:

Exit/restart Cygwin.  Now `ls -l' prints

  -rw-r--r-- 1 corinna mygroup 13342 Jan 17 10:46 //calimero/corinna/foo

So it works, apparently.  Did you set `group: db' in /etc/nsswitch.conf,
by any chance?


Corinna

-- 
Problem reports:      https://cygwin.com/problems.html
FAQ:                  https://cygwin.com/faq/
Documentation:        https://cygwin.com/docs.html
Unsubscribe info:     https://cygwin.com/ml/#unsubscribe-simple

- Raw text -