Bug 1316899

Summary: idmap_hash module works incorrectly when used with other backend modules
Product: Red Hat Enterprise Linux 7 Reporter: Dmitry Zhukovski <dzhukous>
Component: sambaAssignee: Andreas Schneider <asn>
Status: CLOSED ERRATA QA Contact: Robin Hack <rhack>
Severity: urgent Docs Contact: Marc Muehlfeld <mmuehlfe>
Priority: urgent    
Version: 7.2CC: asn, ekeck, gdeschner, jrivera, madam, mkolaja, mmuehlfe, rhack, sbose
Target Milestone: rcKeywords: ZStream
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: samba-4.4.4-1.el7 Doc Type: Bug Fix
Doc Text:
The "idmap_hash" module now works correctly when used with other modules Previously, the "idmap_hash" module worked incorrectly when it was used together with other modules. As a consequence, user and group IDs were not mapped properly. A patch has been applied to skip already configured modules. Now, the hash module can be used as the default idmap configuration back end and IDs are resolved correctly.
Story Points: ---
Clone Of:
: 1350759 (view as bug list) Environment:
Last Closed: 2016-11-04 06:59:36 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---
Bug Depends On:    
Bug Blocks: 1350759    

Description Dmitry Zhukovski 2016-03-11 12:31:33 UTC
Description of problem:
idmap_hash module works incorrectly when used with other backend modules

Version-Release number of selected component (if applicable):
samba 4.2

How reproducible:

Mapping is configured as 
        idmap config * : range = 100000-2139999999
        idmap config * : backend = hash
        idmap config DOM002 : range = 2140000000-4290000000
        idmap config DOM002 : backend = rid

Steps to Reproduce:
1. # wbinfo -i dom001+user1 <---- dom001
dom001+user1:*:1650596368:2140000513:user1:/home/user1:/bin/ksh
# wbinfo --uid-to-sid=1650596368
S-1-5-21-126432666-1270913926-3679153413-137744
# wbinfo --sid-to-name S-1-5-21-126432666-1270913926-3679153413-137744
DOM002+user1 1  <--- dom002
2.
3.

Actual results:


Expected results:
DOM002+user1 gets id from 214 range not below

Additional info:

Comment 2 Sumit Bose 2016-03-22 10:05:19 UTC
Changing component, there is no samba4 in RHEL7 anymore only samba

Comment 11 Andreas Schneider 2016-08-03 13:50:51 UTC
In the global section add:

        idmap config * : range = 10000-20000
        idmap config * : backend = hash
        idmap config YOURDOMAIN : range = 30000-40000
        idmap config YOURDOMAIN : backend = rid

If you now get a unix ID for YOURDOMAIN, it should be from the range 30000-40000 but before fixing the issue it was in the range 10000-20000.

wbinfo -i YOURDOMAIN+user1

Comment 19 errata-xmlrpc 2016-11-04 06:59:36 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2016-2468.html