I have these following configurations:
Active Directory 1 = DomainA.com
AD1 Primary Group = Domain Users
AD1 Group 1 = Linux (member: DomainB\ad2testuser1)
Server joined = linux1.DomainA.com (configured Kerberos and Winbind
Samba4 from sernet)
Active Directory 2 = DomainB.com
AD2 Primary Group = Domain Users (member: DomainB\ad2testuser1)
AD2 User 1 = ad2testuser1
note:
(1) configured one way trust from DomainA.com to DomainB.com
/etc/samba/smb.conf:
--------------------
workgroup = DOMAINA
password server = DC1.DOMAINA.COM
realm = DOMAINA.COM
security = ads
template homedir = /home/%U
template shell = /bin/bash
winbind use default domain = false
winbind offline logon = false
winbind refresh tickets = yes
idmap config * : range = 16777216-33554431
encrypt passwords = true
winbind expand groups = 10
--------------------
/etc/krb5.conf:
--------------------
[logging]
default = FILE:/var/log/krb5libs.log
admin_server = FILE:/var/log/kadmind.log
[libdefaults]
default_realm = DOMAINA.COM
dns_lookup_realm = true
dns_lookup_kdc = true
ticket_lifetime = 24h
forwardable = yes
[realms]
DOMAINA.COM = {
kdc = DC1.DOMAINA.COM:88
kdc = DC2.DOMAINA.COM:88
kdc = DC1.DOMAINA.COM
admin_server = DC1.DOMAINA.COM:749
admin_server = DC2.DOMAINA.COM:749
default_domain = DOMAINA.COM
kdc = DC1.DOMAINA.COM
}
[domain_realm]
.domaina.com = DOMAINA.COM
domaina.com = DOMAINA.COM
[appdefaults]
pam = {
degbug = false
ticket_lifetime = 36000
renew_lifetime = 36000
forwardable = true
krb4_convert = false
}
--------------------
/etc/nsswitch.conf:
--------------------
passwd: files winbind
shadow: files winbind
group: files winbind
--------------------
/etc/pam.d/system-auth-ac:
--------------------
auth sufficient pam_krb5.so use_first_pass
auth sufficient pam_winbind.so use_first_pass
account required pam_unix.so broken_shadow
account [default=bad success=ok user_unknown=ignore] pam_krb5.so
account [default=bad success=ok user_unknown=ignore]
pam_winbind.so
password sufficient pam_winbind.so use_authtok
session required pam_unix.so
session optional pam_krb5.so
--------------------
Question:
On server linux1.DomainA.com, when I issue the command "id" stated below,
it returns with wrong group membership which the group Linux on DomainA is
not visible.
$ id "DOMAINB\ad2testuser1"
uid=xxxxxxx(DOMAINB\ad2testuser1) gid=xxxxxxx(DOMAINB\domain users)
groups=xxxxxxx(DOMAINB\domain users)
$ wbinfo --group-info "DomainA\linux"
DOMAINA\linux:x:xxxxxxxx:DOMAINB\ad2testuser1
I tried to restart the winbind service and do the id command again but it
is still the same result.
I would appreciate if anyone could shed me some lights on:
(1) how to let "id" command reflect the correct group membership.
(2) how can I make Winbind to reflect the group membership automatically
once there is changes have been made in Active Directory.