On Mon, Sep 12, 2016 at 09:01:23AM +0000, Joakim Tjernlund wrote:
On Mon, 2016-09-12 at 10:27 +0200, Lukas Slebodnik wrote:
> On (12/09/16 08:08), Joakim Tjernlund wrote:
> >
> > On Mon, 2016-09-12 at 09:41 +0200, Sumit Bose wrote:
> > >
> > > On Fri, Sep 09, 2016 at 07:07:58PM +0000, Joakim Tjernlund wrote:
> > > >
> > > >
> > > > On Fri, 2016-09-09 at 20:53 +0200, Lukas Slebodnik wrote:
> > > > >
> > > > >
> > > > > On (09/09/16 18:35), Joakim Tjernlund wrote:
> > > > > >
> > > > > >
> > > > > >
> > > > > > On Fri, 2016-09-09 at 19:40 +0200, Lukas Slebodnik wrote:
> > > > > > >
> > > > > > >
> > > > > > >
> > > > > > > On (09/09/16 16:25), Sumit Bose wrote:
> > > > > > > >
> > > > > > > >
> > > > > > > >
> > > > > > > >
> > > > > > > > On Fri, Sep 09, 2016 at 02:00:53PM +0000, Joakim
Tjernlund wrote:
> > > > > > > > >
> > > > > > > > >
> > > > > > > > >
> > > > > > > > >
> > > > > > > > > On Fri, 2016-09-09 at 14:48 +0200, Sumit
Bose wrote:
> > > > > > > > > >
> > > > > > > > > >
> > > > > > > > > >
> > > > > > > > > >
> > > > > > > > > > On Fri, Sep 09, 2016 at 11:46:27AM
+0000, Joakim Tjernlund wrote:
> > > > > > > > > > >
> > > > > > > > > > >
> > > > > > > > > > >
> > > > > > > > > > >
> > > > > > > > > > >
> > > > > > > > > > > Trying to bring up samba with
sssd-13.4 and for some reason samba fails
> > > > > > > > > > > to lookup users: From smb.log I
have:
> > > > > > > > > > >
> > > > > > > > > > >
> > > > > > > > > > >
> > > > > > > > > > >
> > > > > > > > > > > On older systems I have samba
3.6.25 and sssd 1.12.5 and there samba works fine.
> > > > > > > > > > > Is there som change I have missed
when upgrading to newer samba sssd?
> > > > > > > > > >
> > > > > > > > > > Are you using SSSD's version of
libwbclient to help samba to map SID to
> > > > > > > > >
> > > > > > > > > hmm, I got both (/usr/lib64/libwbclient.so.0
and /usr/lib64/sssd/modules/libwbclient.so)
> > > > > > > > > and wbinfo -n 'TRAN_01\jocke'
reports:
> > > > > > > > > wbinfo -n 'TRAN_01\jocke'
> > > > > > > > > could not obtain winbind interface details:
WBC_ERR_WINBIND_NOT_AVAILABLE
> > > > > > > > > could not obtain winbind separator!
> > > > > > > > > failed to call wbcLookupName:
WBC_ERR_WINBIND_NOT_AVAILABLE
> > > > > > > > > Could not lookup name TRAN_01\jocke
> > > > > > > > >
> > > > > > > > > I guess the problem is that samba uses its
own libwbclient.so and winbind
> > > > > > > > > is not configured?
> > > > > > > >
> > > > > > > > iirc you are using gentoo. In Fedora/RHEL is is
possible to switch
> > > > > > > > those two libraries with the alternatives
command.
> > > > > > > >
> > > > > > > > To make at least wbinfo try to use SSSD's
version you can try calling it
> > > > > > > > as:
> > > > > > > >
> > > > > > > > LD_LIBRARY_PATH=/usr/lib64/sssd/modules wbinfo
-n 'TRAN_01\jocke'
> > > > > > > >
> > > > > > > > as long as wbinfo is not complied with rpath or
similar it should pick
> > > > > > > > /usr/lib64/sssd/modules/libwbclient.so.0 instead
of
> > > > > > > > /usr/lib64/libwbclient.so.0. If there is no
> > > > > > > > /usr/lib64/sssd/modules/libwbclient.so.0 you
should add it as a softlink
> > > > > > > > to /usr/lib64/sssd/modules/libwbclient.so. I
would also expect that
> > > > > > > > there are link with ends with a version number
like 11 or 12.
> > > > > > > >
> > > > > > > and samba 4.5 has libwbclient.so.0.13
> > > > > > >
> > > > > > > [root@host ~]# rpm -qf
/usr/lib64/samba/wbclient/libwbclient.so.0.13
> > > > > > > libwbclient-4.5.0-0.0.rc1.fc26.x86_64
> > > > > > and lives in its own package. Is this new from samba >=
4.5 ?
> > > > > >
> > > > > Yes,
> > > > > I cannot see it in official announcement (2 days old :-)
> > > > >
https://lists.samba.org/archive/samba-technical/2016-September/116033.html
> > > > > but samba 4.4.5 has just a libwbclient.so.0.12
> > > > >
> > > > > But if you asked about packaging then
> > > > > the libwbclient (from samba) and sssd-libwbclient are separate
packages
> > > > > on fedora since I remember :-)
> > > > >
> > > >
> > > > I see, now the 1000 $ question, is sssd able to use libwbclient from
samba too?
> > >
> > > It does not have to. libwbclient is an interface for Samba components to
> > > get data from winbind. The SSSD version of libwbclient implements some
> > > parts to the interface to allow the Samba components to get SID, name,
> > > POSIX ID mapping data from SSSD instead of winbind. So SSSD provides the
> > > interface but does not use it.
> > >
> >
> > I guess that would be somewhat unusual case and not really needed.
> > To summarize, in Fedora, the libwbclient libs from samba resp. sssd are
installed
> > under non standard search paths, are separate pkgs and there is a
"script"(alternatives)
> > that selects between the two by creating a symlink in /usr/lib{,64,32} to
either
> > samba's libwbclient or sssd's libwbclient. Is that correct?
> >
> > Have you considered a more direct way? That is, if sssd's libwbclient is
built/installed
> > it always takes over(eliminaiting the need for an alternatives script? Or just
require
> > that only one of libwbclient pkgs can be installed at the same time?
> >
> sssd-libwbclient does not implement all functions. That's reason why it is not
> a default; and just an alternative.
hmm, then I wonder why my samba stopped working just from moving from samba 3.6.25 to
4.2.11/14
Maybe some bug in samba/my smb.conf ?
The newer versions of Samba removed some fallback code e.g. to fix the
Badlock (
http://badlock.org/) issue. The means newer versions of Samba
require that winbind is running in more and more use cases. In some
cases SSSD's version of libwbclient might be sufficient in some cases
(see below) it is not.
Not impl. all functions makes it hard to know when to use sssd's libwbclient,
how to figure out when sssd's libwbclient is good enough?
Yes and to make is worse as mentioned above there are more and more use
cases where Samba requires that winbind is running. If you have to run
winbind, e.g. if you needed to proxy NTLM authentication to a AD DC, you
of course have to use Samba's version of libwbclient. To make sure the
SID to POSIX ID mapping is consistent on the system SSSD 1.14 also
provides an idmapping plugin for winbind (see man idmap_sss for
details). With this plugin winbind will ask SSSD to do the mapping.
I agree that this is currently quite confusing. But we are working with
the Samba team to make this easier in the future. Since winbind has to
run in more and more cases we will concentrate in making is easy and
consistent to run winbind and SSSD in parallel. This is why I'm
currently not actively adding new features to SSSD's version of
libwbclient.
HTH
bye,
Sumit
>
> >
> > >
> > > Is there a configure option to sssd which builds libwbclient or is it
always built?
> > >
> > Yes, it is.
> > --with-libwbclient Whether to build SSSD implementation of libwbclient
> > [yes]
> > And as you can see default is yes.
>
> Gentoo does not use this option so it is just plain luck it is built, thanks.
>
> Jocke
> _______________________________________________
> sssd-users mailing list
> sssd-users(a)lists.fedorahosted.org
>
https://lists.fedorahosted.org/admin/lists/sssd-users@lists.fedorahosted.org