Administrace komentářů

# /etc/nsswitch.conf
passwd:		compat winbind
shadow:		compat
group:		compat winbind

hosts:		files dns wins
networks:	files

services:	files
protocols:	files
rpc:		files
ethers:		files
netmasks:	files
netgroup:	files
publickey:	files

bootparams:	files
automount:	files nis
aliases:	files

Ano winbindd běží: wbinfo -u vypíše všechny uživatele z AD

Když dám do smb.conf: winbind use default domain = yes, tak vypíše jen uživatele (someuser). Když dám no, vypíše uživatele i s doménou INDOM\someuser

/etc/krb5.conf

[libdefaults]
	default_realm = INDOM.DOMAIN.CZ
	dns_lookup_realm = false
	dns_lookup_kdc = true
	ticket_lifetime = 600
	renew_lifetime = 7d
	forwardable = true

[realms]
	BRNO.DOMAIN.CZ = {
                kdc = pdc.indom.domain.cz
                kdc = bdc.indom.domain.cz
		default_domain = indom.domain.cz
	}
[domain_realm]
    .indom.domain.cz = INDOM.DOMAIN.CZ
    indom.domain.cz = INDOM.DOMAIN.CZ
    .INDOM.DOMAIN.CZ = INDOM.DOMAIN.CZ
    INDOM.DOMAIN.CZ = INDOM.DOMAIN.CZ
    
[logging]
    kdc = FILE:/var/log/krb5/krb5kdc.log
    admin_server = FILE:/var/log/krb5/kadmind.log
    default = SYSLOG:NOTICE:DAEMON

#--- For the BUILTIN  accounts ---
	idmap config *:range = 10000-3001000
	idmap config *:backend = tdb
#--- For the AD Domain ---
	idmap config INDOM:backend = ad
	idmap config INDOM:range = 2000-9999
	#idmap config INDOM:range = 500-4000
	idmap config INDOM:schema_mode = rfc2307

#--- Settings for winbind
	winbind nss info = rfc2307
	winbind trusted domains only = no
	winbind use default domain = yes
	winbind enum users = yes
	winbind enum groups = yes
	winbind nested groups = yes
	winbind cache time = 10

[2017/08/08 14:13:00.007874,  3] ../auth/kerberos/kerberos_pac.c:453(kerberos_decode_pac)
  Found account name from PAC: someuser [Some User]
[2017/08/08 14:13:00.007907,  3] ../source3/auth/user_krb5.c:51(get_user_from_kerberos_info)
  Kerberos ticket principal name is [someuser@INDOM.DOMAIN.CZ]
[2017/08/08 14:13:00.007940,  4] ../source3/auth/user_util.c:362(map_username)
  Scanning username map /etc/samba/user.map
[2017/08/08 14:13:00.009710,  3] ../source3/auth/user_krb5.c:164(get_user_from_kerberos_info)
  get_user_from_kerberos_info: Username INDOM\someuser is invalid on this system
[2017/08/08 14:13:00.009763,  3] ../source3/auth/auth_generic.c:145(auth3_generate_session_info_pac)
  auth3_generate_session_info_pac: Failed to map kerberos principal to system user (NT_STATUS_LOGON_FAILURE)
[2017/08/08 14:13:00.009840,  3] ../source3/smbd/smb2_server.c:3098(smbd_smb2_request_error_ex)
  smbd_smb2_request_error_ex: smbd_smb2_request_error_ex: idx[1] status[NT_STATUS_ACCESS_DENIED] || at ../source3/smbd/smb2_sesssetup.c:134
[2017/08/08 14:13:00.010770,  4] ../source3/smbd/sec_ctx.c:321(set_sec_ctx_internal)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
[2017/08/08 14:13:00.010809,  4] ../source3/smbd/sec_ctx.c:321(set_sec_ctx_internal)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
[2017/08/08 14:13:00.010825,  4] ../source3/smbd/sec_ctx.c:321(set_sec_ctx_internal)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
[2017/08/08 14:13:00.010840,  4] ../source3/smbd/sec_ctx.c:321(set_sec_ctx_internal)
  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
[2017/08/08 14:13:00.011024,  3] ../source3/smbd/server_exit.c:246(exit_server_common)
  Server exit (NT_STATUS_CONNECTION_RESET)

To tučně zvýrazněné jsem hledal v google naposledy a žádná rada nepomohla. Stále stejný stav.