Applies to:  All Versions of Centrify DirectControl on AIX 7.2

Problem:

  In Centrify Samba 5.5.2, we have below enhanced commands of wbinfo to provide consistent results with adquery when getting Zone-enabled user or group information and  will list zone users/groups in the current domain. 
·           wbinfo --name-to-sid <user/group name>
·           wbinfo --user-info <user name>
·           wbinfo --group-info <group name>
·           wbinfo --domain-users --domain <domain name>
·           wbinfo --domain-groups --domain <domain name>
·           wbinfo --name-to-sid <user/group name>
·           wbinfo --user-info <user name>
·           wbinfo --group-info <group name>
·           wbinfo --domain-users --domain <domain name>
·           wbinfo --domain-groups --domain <domain name>

Below is sample of using the wbinfo -u to list the current domain zone user, which show the same consistent result as adquery user:

[root@centos7 bin]# wbinfo -u
administrator
andy_ling
test1

[root@centos7 bin]# adquery user
administrator:x:1929380340:1929380340: :/home/administrator:/bin/bash
andy_ling:x:1929382941:1929382941:andy_ling:/home/andy_ling:/bin/bash
test1:x:1929382942:1929382942:test1:/home/test1:/bin/bash

 If user Unixname is not Same as samaccountname, the User will prompt "NT_STATUS_INVALID_SID" error when username lookup failed to be find. 

[root@centos7 bin]# smbclient -U andy.ling //centos7/B2B
Enter ANDYDOM4\andy.ling's password:
tree connect failed: NT_STATUS_INVALID_SID

This was due to the parameter "winbind use default domain" was set to No in "/etc/centrifydc/smb.conf" , therefore smbd will lookup "Unix User\<unixname>" instead of "DomainName\<unixname>" if domain not specified and it will treat the user as a local user.
 

winbind use default domain = no

Workaround:
This issue can be workaround by changing the setting "winbind use default domain" to "Yes" and smbd now will be able to the lookup users without the NTLM format:

winbind use default domain = Yes

Resolution:
The issue has been fixed in adbindproxy 5.6.1 release.