<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;font-family:Calibri,Arial,Helvetica,sans-serif;" dir="ltr">
<p>Hi Mathieu,</p>
<p><br>
</p>
<p>Thank you for pointing me to these bugs that I hadn't found during my previous searches.</p>
<p>From what I've understood, the changes introduced in response to upstream bug 12155 are likely to be related with the issue.</p>
<p><br>
</p>
<p>Indeed, the configuration with which I was able to reproduce the bug contains those lines:</p>
<p> <span>idmap uid = 10000-20000</span></p>
<p><span> idmap gid = 10000-20000</span></p>
<p><br>
<span></span></p>
<p>But the UID and GID returned by getent for the domain accounts are all greater than 100000:</p>
<p></p>
<div>administrator:*:100500:100513:Administrator:/data/administrator:/bin/false<br>
testusr:*:101103:100513:testusr:/data/testusr:/bin/false<br>
krbtgt:*:100502:100513:krbtgt:/data/krbtgt:/bin/false<br>
guest:*:100501:100514:Guest:/data/guest:/bin/false</div>
<p></p>
<p><br>
</p>
<p>Therefore, it may cause the computed UID value to fail the boundary check that was introduced in the
<span>_wbint_Sids2UnixIDs</span> function.</p>
<p><br>
</p>
<p>What I don't explain is that the mapping of a domain account to a local UID seems to works correctly (which is what _wbint_Sids2UnixIDs do), it is the reverse operation that fails.</p>
<p><br>
</p>
<p>I've upgraded the lab to <span>4.5.2+dfsg-2</span> that has been released to testing since, and I've noticed a very different behavior: the mapped UID and GID now falls within the range defined by the
<span>idmap uid </span>and <span>idmap gid directives. It seems that some change introduced in <span>4.5.2+dfsg-2</span> has solved this problem:</span></p>
<p><span><span><br>
</span></span></p>
<p><span><span>root@v-smb-fs:~# getent passwd</span><br>
</span></p>
<p><span></p>
<div>administrator:*:10000:10004:Administrator:/data/administrator:/bin/false<br>
testusr:*:10001:10004:testusr:/data/testusr:/bin/false<br>
krbtgt:*:10002:10004:krbtgt:/data/krbtgt:/bin/false<br>
guest:*:10003:10005:Guest:/data/guest:/bin/false<br>
</div>
<br>
</span>
<p></p>
<p><span></p>
<div>root@v-smb-fs:~# wbinfo --user-info=testusr<br>
testusr:*:10001:10004:testusr:/data/testusr:/bin/false<br>
<br>
root@v-smb-fs:~# wbinfo --uid-info=10001<br>
testusr:*:10001:10004:testusr:/data/testusr:/bin/false<br>
</div>
<br>
</span>Thank you for your help,
<p></p>
<p><br>
</p>
<p>Best regards,</p>
<p><br>
</p>
<p>Stephane<br>
</p>
<br>
<div style="color: rgb(0, 0, 0);">
<div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="x_divRplyFwdMsg" dir="ltr"><font style="font-size:11pt" color="#000000" face="Calibri, sans-serif"><b>De :</b> Mathieu Parent <math.parent@gmail.com><br>
<b>Envoyé :</b> dimanche 1 janvier 2017 17:36<br>
<b>À :</b> stephane; 848935@bugs.debian.org<br>
<b>Objet :</b> Re: [Pkg-samba-maint] Bug#848935: libnss-winbind: winbind authentication and wbinfo --uid-info no longer work after uprading to 4.5.2+dfsg-1</font>
<div> </div>
</div>
</div>
<font size="2"><span style="font-size:10pt;">
<div class="PlainText">Control: tag -1 + upstream<br>
<br>
2016-12-21 0:25 GMT+01:00 stephane <ps67.dbg@outlook.com>:<br>
> Package: libnss-winbind<br>
> Version: 2:4.5.2+dfsg-1<br>
> Severity: important<br>
><br>
> Dear maintener,<br>
<br>
Hi,<br>
<br>
> I'm encountering the following problem since the upgrade of the libnss-winbind, winbind and samba packages from<br>
> 4.4.7+dfsg-1 to 4.5.2+dfsg-1: users can no longer access network shares<br>
> on a file server joined (as a member) to a samba-ad-dc based domain.<br>
><br>
> After further troubleshooting, it appears that the local UID and GID<br>
> numbers fails to be mapped to the domain accounts.<br>
<br>
<br>
Thanks for your complete bug report.<br>
<br>
It's hard to me to come to a conclusion, but it looks like:<br>
<a href="https://bugzilla.samba.org/show_bug.cgi?id=12410" id="LPlnk962964" previewremoved="true">
https://bugzilla.samba.org/show_bug.cgi?id=12410</a><br>
and the corresponding change:<br>
<a href="https://bugzilla.samba.org/show_bug.cgi?id=12155" id="LPlnk788856" previewremoved="true">
https://bugzilla.samba.org/show_bug.cgi?id=12155</a>
<div id="LPBorder_GT_14834002961130.028893343607690913" style="margin-bottom: 20px; overflow: auto; width: 100%; text-indent: 0px;">
<table id="LPContainer_14834002961110.004938651671535066" style="width: 90%; background-color: rgb(255, 255, 255); position: relative; overflow: auto; padding-top: 20px; padding-bottom: 20px; margin-top: 20px; border-top: 1px dotted rgb(200, 200, 200); border-bottom: 1px dotted rgb(200, 200, 200);" cellspacing="0">
<tbody>
<tr style="border-spacing: 0px;" valign="top">
<td id="TextCell_14834002961120.9157359186423029" style="vertical-align: top; position: relative; padding: 0px; display: table-cell;" colspan="2">
<div id="LPRemovePreviewContainer_14834002961120.5812761154855628"></div>
<div id="LPTitle_14834002961120.31271615094266925" style="top: 0px; color: rgb(0, 120, 215); font-weight: 400; font-size: 21px; font-family: "wf_segoe-ui_light","Segoe UI Light","Segoe WP Light","Segoe UI","Segoe WP",Tahoma,Arial,sans-serif; line-height: 21px;">
<a id="LPUrlAnchor_14834002961120.14373736098392853" style="text-decoration: none;" href="https://bugzilla.samba.org/show_bug.cgi?id=12155" target="_blank">Bug 12155 – Some idmap backends don't perform range checks ...</a></div>
<div id="LPMetadata_14834002961130.6024853475942853" style="margin: 10px 0px 16px; color: rgb(102, 102, 102); font-weight: 400; font-family: "wf_segoe-ui_normal","Segoe UI","Segoe WP",Tahoma,Arial,sans-serif; font-size: 14px; line-height: 14px;">
bugzilla.samba.org</div>
<div id="LPDescription_14834002961130.3373714308489042" style="display: block; color: rgb(102, 102, 102); font-weight: 400; font-family: "wf_segoe-ui_normal","Segoe UI","Segoe WP",Tahoma,Arial,sans-serif; font-size: 14px; line-height: 20px; max-height: 100px; overflow: hidden;">
The Samba-Bugzilla – Bug 12155. Some idmap backends don't perform range checks for the result of sids_to_xids. Last modified: 2016-12-19 18:38:28 UTC</div>
</td>
</tr>
</tbody>
</table>
</div>
<br>
<br>
Regards<br>
<br>
-- <br>
Mathieu<br>
</div>
</span></font></div>
</div>
</body>
</html>