Applies to: All Versions of Centrify DirectControl on AIX 7.2
Problem: In Centrify Samba 5.5.2, we have below enhanced commands of wbinfo to provide consistent results with adquery when getting Zone-enabled user or group information and will list zone users/groups in the current domain.
· wbinfo --name-to-sid <user/group name>· wbinfo --user-info <user name>· wbinfo --group-info <group name>· wbinfo --domain-users --domain <domain name>· wbinfo --domain-groups --domain <domain name>· wbinfo --name-to-sid <user/group name>· wbinfo --user-info <user name>· wbinfo --group-info <group name>· wbinfo --domain-users --domain <domain name>· wbinfo --domain-groups --domain <domain name>Below is sample of using the wbinfo -u to list the current domain zone user, which show the same consistent result as adquery user:
[root@centos7 bin]# wbinfo -u
administrator
andy_ling
test1
[root@centos7 bin]# adquery user
administrator:x:1929380340:1929380340: :/home/administrator:/bin/bash
andy_ling:x:1929382941:1929382941:andy_ling:/home/andy_ling:/bin/bash
test1:x:1929382942:1929382942:test1:/home/test1:/bin/bash
If user Unixname is not Same as samaccountname, the User will prompt "NT_STATUS_INVALID_SID" error when username lookup failed to be find.
[root@centos7 bin]# smbclient -U andy.ling //centos7/B2B
Enter ANDYDOM4\andy.ling's password:
tree connect failed: NT_STATUS_INVALID_SID
This was due to the parameter "winbind use default domain" was set to No in "/etc/centrifydc/smb.conf" , therefore smbd will lookup "Unix User\<unixname>" instead of "DomainName\<unixname>" if domain not specified and it will treat the user as a local user.
winbind use default domain = no
Workaround:This issue can be workaround by changing the setting "winbind use default domain" to "Yes" and smbd now will be able to the lookup users without the NTLM format:
winbind use default domain = Yes
Resolution:The issue has been fixed in adbindproxy 5.6.1 release.