Tips for finding Knowledge Articles

  • - Enter just a few key words related to your question or problem
  • - Add Key words to refine your search as necessary
  • - Do not use punctuation
  • - Search is not case sensitive
  • - Avoid non-descriptive filler words like "how", "the", "what", etc.
  • - If you do not find what you are looking for the first time,reduce the number of key words you enter and try searching again.
  • - Minimum supported Internet Explorer version is IE9
Home  >

KB-11817: Samba invalid SID error when samaccountname not equal to unixname

Authentication Service ,  

27 November,20 at 01:41 PM

Applies to:  All Versions of Centrify DirectControl on AIX 7.2


  In Centrify Samba 5.5.2, we have below enhanced commands of wbinfo to provide consistent results with adquery when getting Zone-enabled user or group information and  will list zone users/groups in the current domain. 
·           wbinfo --name-to-sid <user/group name>
·           wbinfo --user-info <user name>
·           wbinfo --group-info <group name>
·           wbinfo --domain-users --domain <domain name>
·           wbinfo --domain-groups --domain <domain name>
·           wbinfo --name-to-sid <user/group name>
·           wbinfo --user-info <user name>
·           wbinfo --group-info <group name>
·           wbinfo --domain-users --domain <domain name>
·           wbinfo --domain-groups --domain <domain name>

Below is sample of using the wbinfo -u to list the current domain zone user, which show the same consistent result as adquery user:
[root@centos7 bin]# wbinfo -u

[root@centos7 bin]# adquery user
administrator:x:1929380340:1929380340: :/home/administrator:/bin/bash
 If user Unixname is not Same as samaccountname, the User will prompt "NT_STATUS_INVALID_SID" error when username lookup failed to be find. 
[root@centos7 bin]# smbclient -U andy.ling //centos7/B2B
Enter ANDYDOM4\andy.ling's password:
tree connect failed: NT_STATUS_INVALID_SID
This was due to the parameter "winbind use default domain" was set to No in "/etc/centrifydc/smb.conf" , therefore smbd will lookup "Unix User\<unixname>" instead of "DomainName\<unixname>" if domain not specified and it will treat the user as a local user.
winbind use default domain = no

This issue can be workaround by changing the setting "winbind use default domain" to "Yes" and smbd now will be able to the lookup users without the NTLM format:
winbind use default domain = Yes

The issue has been fixed in adbindproxy 5.6.1 release.