Univention Bugzilla – Bug 48270
Write CLI tool to check ID-Mapping for a user (to debug file share access problems)
Last modified: 2021-05-14 16:34:50 CEST
It would be helpful in support situations if the support could point the customer to a CLI tool to run, which performs the following steps on a given server (mostly memberservers acting as file servers): * id <username> * for account in (user, group memberships) perform winbind checks * winbind checks: name -> uidnumber -> name -> sid -> name On Bug #42531 we attempted to implement something simmilar, a script answering the question "why can this user not access that file", but that's harder to get right (e.g. you need to give user & admin credentials/keys). So implementing a script to check ID-Mapping may be simpler and more focused.
Pushed two versions to toolshed/samba. I made a second version, because in contrast to samba 4.7, the new samba version is able to map the NT+AUTHORITY groups.
Ok, the tools work well in standard UCS DC Master VMs. But there seems to be two issues on Memberservers: ===================================================================== root@member:/home/arequate# ./univention-check-id-mapping-samba-4.10 arequate Checking ucr variables for id-mapping ucr get connector/s4/mapping/sid returned None ucr get connector/s4/mapping/sid_to_s4 returned None ucr get connector/s4/mapping/sid_to_ucs returned None WARNING: UCR Variables are not configured for default UCS or UCS at School Checking the id-mapping of user arequate Trying to map user-names to sids and back SUCCESS: Name -> SID -> Name was successful Trying to map sids to uids and back SUCCESS: SID -> UID -> SID was successful Checking the id-mapping of groups of user arequate failed to call wbcGidToSid: WBC_ERR_DOMAIN_NOT_FOUND Could not convert gid 4 to sid ERROR: Could not map 4 Trying to map gids to sids and back ERROR: first was 4, but after mapping is ERROR: GID -> SID -> GID was unsuccessful Trying to map sids to names and back SUCCESS: SID -> Name -> SID was successful ===================================================================== There are three points for improvement here: * The tool should exit != 0 when an error occurrs * The WBC_ERR_DOMAIN_NOT_FOUND message is strange * The UCR variable check only works on systems with S4-Connector Finally, maybe we can merge the code of both scripts into one? After that we may consider shipping it as part of univention-samba4.
This issue has been filed against UCS 4.3. UCS 4.3 is out of maintenance and many UCS components have changed in later releases. Thus, this issue is now being closed. If this issue still occurs in newer UCS versions, please use "Clone this bug" or reopen it and update the UCS version. In this case please provide detailed information on how this issue is affecting you.