How To Set Up A Basic idmap_ad Backend On SLES 11 SP 1

1. The first step is to make sure that time is in sync for the SLES 11 server and the Windows server. I cannot over emphasize the importance of this step.
2. Edit the /etc/resolv.conf file on the SLES server and include a 'nameserver ip.addr.of.srvr' entry that points the SLES' DNS to the Active Directory (AD) server.
3. Install Services For UNIX (SFU) on the Windows 2003 server, or the Windows AD Role "Identity Management for UNIX" as found under the Server Manager under other distributions.  Under the UNIX ATTRIBUTES tab of the user object properties (as found under AD), various attributes (such as UID) can be set.  For testing purposes (as outlined under step 7), configure this for at least one user.
4. Launch 'yast2 samba-client' from a shell, or open YAST > WINDOWS DOMAIN MEMBERSHIP and do the following:
   • After the domain/workgroup is verified, change the "Domain or Workgroup" field to the netbios name of your domain.
   • Check the box "Also Use SMB Information for Linux Authentication"
   • Click OK, and authenticate to the AD server.
5. Edit the /etc/samba/smb.conf. Under the [global] section, do the following:
   • Make sure the "workgroup =" contains the netbios name of the domain as specified under the WINDOWS DOMAIN MEMBERSHIP plugin as mentioned in the previous step
   • Make sure "realm = " is set to the domain name (this should have been already completed by the plugin--if not, rerun the plugin)
   • Security should be set to ADS (should have been done already)
   • Add the following entries:
     
     idmap backed = tdb
     idmap uid = 21000-30000
     idmap gid = 21000-30000
     idmap config YourDomain: backend = ad
     idmap config YourDomain: range = 10000-20000
     idmap config YourDomain: schema_mode = sfu
   • Now, a couple of notes about the above configuration:
     1. 'idmap config YourDomain:range' is a filter. This specifies the range of users on the AD server that are to be filtered or included on this systems winbind queries. For instance, if I have two users configured in AD, and one as a UID of 9999 and the other has a UID of 10000, then only the user with the UID of 10000 will be included in our searches because the range specified only includes users 10000-20000. Modify this range to fit your needs.
     2. 'idmap uid/gid =' is probably already in the smb.conf. The important thing to remember is that the range specified in this parameter should not overlap the 'idmap config YourDomain:range' and should not overlap local users. Local users are usually in the 0-1000+ range (depending on the number of users configured). Just in case I decide to create thousands of local users in the future, I changed the 'idmap uid/gid' range to something that wouldn't interfere with those potential assignments
     3. 'idmap config YourDomain:schema_mode' will either be 'sfu' or 'rfc2307' depending on your setup. If SFU is installed on the AD server, then sfu is the schema_mode utilized. If Identity Management for UNIX is utilized, then rfc2307 will be the schema_mode utilized. Having the wrong schema_mode specified will prevent the idmap_ad backend from working properly.
6. Save the smb.conf file. Backup the /var/lib/samba/*tdb files, delete them from that directory, and restart winbind
   • winbind stores the mappings in these files. As we are changing the way the mappings are being stored, we are deleting them and letting winbind recreate them with the new information as configured with the smb.conf. It is a good idea to back these up regularly in case something were to happen to these files
7. Test your setup by doing the following:
   • wbinfo -u (DOMAIN\users should be returned, where DOMAIN is your domain name and users are the users configured with UIDs)
   • id user (where user is the user as seen in the output of the previous command. IE. MyDomain\testuser will need to be tested with 'id MyDomain\\testuser' (the \ has to be escaped))
   • Assuming users are returned via 'wbinfo -u' (or groups for that matter), and the same user/group can be id'd and output returned, everything should be working at this point with the idmap_ad backend
   • NOTE: The UID returned should match the UID of the user in AD (the key point of idmap_ad)
   • NOTE:  It may take some time for the user mappings to be pulled across by winbind.  For instance, in my testing, it took a few minutes for userA to show up, and another couple of minutes for userB to show up. 

• winbind nss info = <sfu/rfc2307> (See the man page for smb.conf for more details)
• winbind use default domain = yes (wbinfo will return UserName instead of Domain\UserName)
• 'winbind enum users = no' and 'winbind enum groups = no' (this is default, but setting these to yes is not recommended for production environments as it can really slow things down)

[global]

winbind use default domain = yes
winbind nss info = sfu
idmap backend = tdb
idmap uid = 21000-30000
idmap gid = 21000-30000
idmap config TESTDOM: backend = ad
idmap config TESTDOM: range = 10000-20000
idmap config TESTDOM: schema_mode = sfu

NOTE:  SLES 11 SP 2 and beyond deprecate the idmap uid/gid options in favor for "idmap config *: range".  In order for winbind to work correctly this will need to be included in the configuration.

IE