On Sat, Apr 20, 2013 at 8:32 PM, Sumit Bose <<a href="mailto:sbose@redhat.com" target="_blank">sbose@redhat.com</a>> wrote: <div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> <div><div>On Fri, Apr 19, 2013 at 10:14:36PM +0200, Natxo Asenjo wrote: > # wbinfo --online-status > BUILTIN : online > IPA : online > AD : offline > > # wbinfo --domain-info ad.asenjo.nx > Name : AD > Alt_Name : ad.asenjo.nx > SID : S-1-5-21-2508008360-1834726910-79835928 > Active Directory : No > Native : No > Primary : No > > # wbinfo --domain ad.asenjo.nx -u > With this last command I would expect to see all the users I created in the > AD. > > # getent group ad_users > ad_users:*:642801446:administrator@ad.asenjo.nx > > this tellms me that the external group we created has only the AD > administrator in it, so It makes sense only this one is allowed. But I I </div></div>no, this is a wrong interpretation. The group membership for users from trusted domains is only evaluated at login time with the help of the data stored in the MS-PAC. Because group-membership resolution in an AD environment can be cumbersome, especially when it comes to forests and forest trusts, and the MS-PAC provides all memberships we decided to rely only on the MS-PAC here. As a consequence getent group only shows the users of the IPA domain and AD users who already logged in successfully. <div> </div></blockquote><div> ok, got it. </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div> > checked the SID of the mapped group: > > # ipa group-show ad_users_external > Group name: ad_users_external > Description: AD users external map > Member of groups: ad_users > External member: S-1-5-21-2508008360-1834726910-79835928-513 > > And it is the AD\Domain Users sid, I checked it on the windows host because > wbinfo shows me no info: > > [root@kdc ~]# wbinfo -n "AD\Domain Users" > failed to call wbcLookupName: WBC_ERR_DOMAIN_NOT_FOUND > Could not lookup name AD\Domain Users > [root@kdc ~]# wbinfo -s S-1-5-21-2508008360-1834726910-79835928-513 > failed to call wbcLookupSid: WBC_ERR_DOMAIN_NOT_FOUND > Could not lookup sid S-1-5-21-2508008360-1834726910-79835928-513 > [root@kdc ~]# wbinfo -s S-1-5-21-2508008360-1834726910-79835928-513 -d > ad.asenjo.nx > failed to call wbcLookupSid: WBC_ERR_DOMAIN_NOT_FOUND > Could not lookup sid S-1-5-21-2508008360-1834726910-79835928-513 </div>looks like winbind has some issues connecting to the AD server. Did you change any firewall setting that might cause the issue here? </blockquote><div> With the firewalls (both at the linux host and at the windows host) enabled I can login as AD\administrator user from the same windows host I cannot ssh to as a normal 'domain user' . So the firewall does not seem the issue at hand. My iptables rules: # iptables -L -n Chain INPUT (policy ACCEPT) target prot opt source destination ACCEPT all -- <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> state RELATED,ESTABLISHED ACCEPT icmp -- <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> ACCEPT all -- <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> ACCEPT tcp -- <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> state NEW tcp dpt:22 ACCEPT tcp -- <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> multiport dports 80,443,389,636,88,464,53,138,139,445 state NEW,ESTABLISHED ACCEPT udp -- <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> multiport dports 88,464,53,123,138,139,389,445 state NEW,ESTABLISHED REJECT all -- <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> reject-with icmp-host-prohibited Chain FORWARD (policy ACCEPT) target prot opt source destination REJECT all -- <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> reject-with icmp-host-prohibited </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> More details might be available in the winbind logs. </blockquote><div> What logs exactly would you like to see? ls -l /var/log/samba/log.winbindd* -rw-r--r--. 1 root root 10854 Apr 19 21:49 /var/log/samba/log.winbindd -rw-r--r--. 1 root root 0 Apr 19 15:02 /var/log/samba/log.winbindd-dc-connect -rw-r--r--. 1 root root 28532 Apr 19 21:51 /var/log/samba/log.winbindd-idmap -rw-r--r--. 1 root root 133 Apr 19 21:45 /var/log/samba/log.winbindd-locator How can I get more debugging info from winbind? -- Thanks, natxo </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> bye, Sumit <div> > > So how can I get the rest of the users in the group mapped? > > TIA, > > -- > groet, > natxo </div>> _______________________________________________ > Freeipa-users mailing list > <a href="mailto:Freeipa-users@redhat.com" target="_blank">Freeipa-users@redhat.com</a> > <a href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a> </blockquote></div>