LinuxQuestions.org - [SOLVED] samba AD group inconsistency

- Linux - Server (https://www.linuxquestions.org/questions/linux-server-73/)

- - samba AD group inconsistency (https://www.linuxquestions.org/questions/linux-server-73/samba-ad-group-inconsistency-4175440504/)

samba AD group inconsistency

Hi all.

I just noticed a weird problem and I have been spending couple of days to find the issues. I have centos 5.8 with samba3x-3.5 connecting to AD.

What i just noticed is that, certain users have groups that are not even assigned to them. At first I thought it was cache and tried restarting samba and winbind and it didnt work.

Code:

[root@linux-box ~]# getent group

***cut***

adm:*:608:ronie,linda

ehth:*:612:johnq

here is when i run the command id for user who is not in any group

Code:

[root@linux-box ~]# id eliza

uid=605(eliza) gid=608(adm) groups=608(adm),616(ceo),605(draft),610(ffh),617(finance),615(cph),613(sales),612(ehth),618(admh),619(hssh),607(ff),620(fin-h),604(domain users),621(hss),614(cp),601(BUILTIN+users)

as for user johnq, his group is ehth but the results looks different.

Code:

[root@linux-box ~]# id johnq

uid=616(johnq) gid=604(domain users) groups=604(domain users),616(ceo),605(draft),610(ffh),617(finance),615(cph),612(ehth),618(admh),619(hssh),607(ff),620(fin-h),621(hss),608(adm),614(cp),601(BUILTIN+users)

I have checked randomly and some of the users are correct, only some have this sort of problems. It puzzles me.

Any pointers is appreciated.

Thanks!

Is there an overlap of gid (group identifiers (numbers)) on the host in /etc/groups and the UNIX attributes of the AD groups, they need to be unique.
Is the /etc/nsswitch.conf group entry set to "group file ldap"?

Hi,

There's no overlap. However I just noticed that prior to that, users have access to multiple groups and when it was removed from AD, ldap seems to still have the cache around. Restarting samba winbind didnt do the trick. I went through samba docs and decided to add in the config

Quote:

winbind cache time = 5

Restart samba and winbind. Check the users still the same. I decided to let it run. So the next day i checked, users/groups in samba are in sync with AD. I am trying to replicate the issues and see if i could simulate the same problem again. As of now, i consider this problem as solved. :)