3

Platform: RHEL 5.10

Version: Samba 3.6.6-0.136

Only on a single VM, one of my co-workers is able to log into the VM using his AD credentials without issue, whereas my account appears to have trouble locating user information:

[root@ncxxxlwb05 ~]# wbinfo -i myDom.mjplakus
XXX.mjplakus:*:16777224:16777229::/home/XXX/mjplakus:/bin/bash
[root@ncxxxlwb05 ~]# wbinfo -i myDom.jadavis6
failed to call wbcGetpwnam: WBC_ERR_DOMAIN_NOT_FOUND
Could not get info for user xxx.jadavis6

Thinking that winbind could have just cached a negative return (for instance AD wasn't available when it had to refresh its cache entry for my user account) I set both winbind cache time and idmap negative cache time to be 1 second but I got the same results. Same results with above cache values and doing net cache flush several times.

I didn't find anything in /var/log/samba/* under normal debug levels so I set debug level = 8 and this started being printed in the logs when I tried to resolve my name:

[2013/12/05 14:21:59.795061,  3] winbindd/winbindd_getpwnam.c:56(winbindd_getpwnam_send)
  getpwnam myDom.jadavis6
[2013/12/05 14:21:59.795161,  1] ../librpc/ndr/ndr.c:414(ndr_pull_error)
  ndr_pull_error(13): value out of range
[2013/12/05 14:21:59.795219,  5] winbindd/winbindd_getpwnam.c:137(winbindd_getpwnam_recv)
  Could not convert sid S-1-5-21-652622394-3291385539-1351089441-10771: NT_STATUS_INVALID_PARAMETER
[2013/12/05 14:21:59.795391,  6] winbindd/winbindd.c:869(winbind_client_request_read)
  closing socket 29, client exited

Which seems like it contains the actual problem but I don't know how to read the error and would like some guidance on this. It seems like it doesn't like the SID associated with my AD account for some reason, but I don't know why or how to work around it.

I'm present in the active directory domain referenced, but for some reason it's unable to pull only my account's information.

Bratchley
  • 16,684
  • 13
  • 64
  • 103
  • This applies to v4 of Samba, but look into it just to eliminate it: https://bugzilla.redhat.com/show_bug.cgi?id=905996 – MaKR Dec 11 '13 at 05:04

1 Answers1

0

There are BUILTIN domains on an AD server and the default "*" 'tdb' backend and range are needed to map the users not included in the other mapped domains. Not having this backend still causes a mapping error even if the user being mapped is not included in that range.

Check this link: https://access.redhat.com/solutions/338723

Srinivas
  • 1