> > sssd-libwbclient does not implement all functions.
That's reason why it is not
> > a default; and just an alternative.
>
> hmm, then I wonder why my samba stopped working just from moving from samba 3.6.25
to 4.2.11/14
> Maybe some bug in samba/my smb.conf ?
The newer versions of Samba removed some fallback code e.g. to fix the
Badlock (
http://badlock.org/) issue. The means newer versions of Samba
require that winbind is running in more and more use cases. In some
cases SSSD's version of libwbclient might be sufficient in some cases
(see below) it is not.
>
>
> Not impl. all functions makes it hard to know when to use sssd's libwbclient,
> how to figure out when sssd's libwbclient is good enough?
Yes and to make is worse as mentioned above there are more and more use
cases where Samba requires that winbind is running. If you have to run
winbind, e.g. if you needed to proxy NTLM authentication to a AD DC, you
of course have to use Samba's version of libwbclient. To make sure the
SID to POSIX ID mapping is consistent on the system SSSD 1.14 also
provides an idmapping plugin for winbind (see man idmap_sss for
details). With this plugin winbind will ask SSSD to do the mapping.
I agree that this is currently quite confusing. But we are working with
the Samba team to make this easier in the future. Since winbind has to
run in more and more cases we will concentrate in making is easy and
consistent to run winbind and SSSD in parallel. This is why I'm
currently not actively adding new features to SSSD's version of
libwbclient.
So I can confirm that samba >=4.2.x needs winbind to be up and running to work with
native libwbclient.
If using sssd's libwbclient one do not need winbind.
Now I am torn which method to use. I would like to see sssd separate from samba.
A server with samba exporting some dirs should be no different from a non samba computer
w.r.t identity mapping. The sssd config and nsswitch.conf should be the same in both
cases.
Will winbind let me do that ?
We are using a modern Windows AD here for all users with UID/GID defined in Windows AD.
Jocke
>
> HTH
>
> bye,
> Sumit
>