I don't have any documentation on my winbind setup, meaning that I've only adjusted configs for SSSD (1.9.2) and Samba (configs for these included below).

Before SSSD implemented ID mapping in a manner consistent with winbind, I had to use Identity Management for Unix on the domain controller to manually assign each user's UID (using an LDAP attribute) to the same value as the UID that windbind would generate. Later, after SSSD implemented the same ID mapping as Winbind, I removed IMU and let SSSD do its thing.

On this fileserver, PAM isn't even aware of winbind; all auth is handled by SSSD. Winbind is only used by Samba when sharing files.

[root@tic windows_pc_backups]# cat /etc/samba/smb.conf

# This file automatically generated and maintained by Puppet.
# Manual editing of this file is NOT recommended as your changes
# will be overwritten.
### Begin minimal global configuration ###
[global]
# These settings will be overwritten by puppet.
# Please make local changes to the include file
log level = 5
client ldap sasl wrapping = seal
disable netbios = yes
security = ads
server signing = mandatory
realm = DOMAIN.LOCAL
workgroup = DOMAIN
winbind separator = +
winbind enum users = Yes
winbind enum groups = Yes
winbind nested groups = Yes
winbind use default domain = yes
kerberos method = system keytab
load printers = yes
printing = bsd
include = /etc/samba/extra-settings.conf

extra-settings.conf just sets up some file shares:
# Settings for backup servers
printcap name = /dev/null
disable spoolss = yes
server string = Tic - Half Fresh
idmap backend = tdb
idmap uid = 1000000-1999999
idmap gid = 1000000-1999999
idmap config DOMAIN : backend  = ad
idmap config DOMAIN : range = 10000-50000
[backups]
path = /mnt/storage2/windows_pc_backups
read only = yes
printable = no
guest ok = no
valid users = "@DOMAIN+Domain Users"
create mask = 0775
writeable = no

And my sssd.conf:
# This file is autogenerated by Puppet.
# # Manually editing this file is NOT recommended
# # as your changes will be overwritten.
#
[sssd]
config_file_version = 2
debug_level = 0
reconnection_retries = 3
sbus_timeout = 30
services = nss, pam
domains = DOMAIN
 
[pam]
debug_level = 0
[nss]
debug_level = 0
filter_users = ...
filter_groups = ...
reconnection_retries = 3
default_shell = /bin/bash
shell_fallback = /bin/bash
[domain/DOMAIN]
debug_level = 0
ad_domain = DOMAIN.local
id_provider = ad
auth_provider = ad
chpass_provider = ad
access_provider = ad
enumerate = true
cache_credentials = true
# Will check unixHomeDirectory LDAP attribute for a value first
fallback_homedir = /home/%u
# This is necessary for IPv4 and IPv6 dynamic DNS updates
dyndns_iface = eth0
ldap_user_home_directory = unixHomeDirectory
dyndns_update = true
dyndns_update_ptr = true
ldap_schema = ad
ldap_id_mapping = true

-Chris


On Mon, Jan 27, 2014 at 12:26 PM, Rowland Penny <repenny241155@gmail.com> wrote:
On 27/01/14 17:21, Chris Hartman wrote:
For what it's worth, I use winbind + sssd as a windows fileserver and have no problems with the setup. It's true that winbind is necessary to share files but certainly SSSD can co-exist with winbind.


-Chris


Do you have to set winbind up? and if so how?


Rowland
_______________________________________________
sssd-devel mailing list
sssd-devel@lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel