On Fri, 12 Nov 2004, schmieder, holger wrote:

> Hallo all,
>
> i got the following problem an hope someone knows a solution for that
>
> -Installed: 2 Samba server, both with OpenLDAP, replicated by slurpd.
> -Managing of objects through LAM
> -localSID's and domain SID are all the same.
>
> On the first server the domain ist ready an working. The SambaDomainName ist
> stored in the ou=domains,dc=xxx,dc=intra.
> (SambaDomainName=DOM01,ou=domains,dc=xxx,dc=intra)
>
> After typing in "smbpasswd -w xxx" on second server, a new domain was
> created in LDAP with the DN=SambaDomainName=DOM01,dc=xxx,dc=intra
>


actually Samba does do a search in the subtree value supplied in "ldap
suffix" before creating any new values for domain entries. perhaps
permissions on ou=domains subtree are too tight for samba to "see" it.

> I believe because of that, some things for example usrmgr.exe won't work
> corectly.
>
> Can someone tell me how to tell smbpasswd to use an existing domain with the
> SID stored in ou=domains ?
>


There presently is no way to do it as there is no specific suffix value
option for that. Samba will always create the domain entry in "ldap
suffix" if you do not create the domain entry yourself. I've just created
the entry myself in the DIT prior to starting any new samba servers and
that has worked fine for me. It may seem inconvenient, but you only have
to do it once - I can live with that ;-)

Again make sure your permission on subtree values are not too restrictive.
Also a log level 10 will help you determine what requests Samba is making
against the DIT.

I've included a snippet of indexes and permissions that I've glom'ed from
Samba How-To and LDAP-System Admin. and various google-ing's for OpenLDAP
2.2.x (which is what my permissions are based on)

My machines are in the ou=people section as there is still controversy
over whether machines whould be separated or not and it was easier to just
"lump" them.


index objectClass eq
index cn pres,eq,sub
index sn pres,eq,sub
index mail pres,eq,sub
index uid pres,eq,sub
index memberUid eq
index uidNumber eq
index gidNumber eq
index sambaSID eq
index sambaDomainName eq
index sambaPrimaryGroupSID eq
index default sub,eq

access to dn.subtree="ou=hvccdir,dc=domain,dc=edu"
by domain=".*\.domain\.edu" read
by anonymous read
by dn="cn=root,dc=domain,dc=edu" write
by * none

access to dn.subtree="ou=People,dc=domain,dc=edu" attrs=userPassword
by self write
by dn="cn=root,dc=domain,dc=edu" write
by * auth

access to dn.subtree="ou=People,dc=domain,dc=edu" attrs=sambaLMPassword,sambaNTPassword
by dn="cn=root,dc=domain,dc=edu" write
by * none

access to dn.subtree="ou=People,dc=domain,dc=edu"
by dn="cn=root,dc=domain,dc=edu" write
by * read

access to dn.subtree="ou=Groups,dc=domain,dc=edu"
by dn="cn=root,dc=domain,dc=edu" write
by * read

access to dn.subtree="ou=Idmap,dc=domain,dc=edu"
by dn="cn=root,dc=domain,dc=edu" write
by * read

access to dn.subtree="ou=Domains,dc=domain,dc=edu"
by dn="cn=root,dc=domain,dc=edu" write
by * read

access to dn.subtree="dc=domain,dc=edu"
by dn="cn=root,dc=domain,dc=edu" write
by * read



> Thanks for every good idea.
>
> Holger
>
>



Best of luck to you!