Learn Samba - Winbind: AD User Integration

#Introduction

In episode 9 you built a Domain Controller. Now we put that domain to use: turning another Samba server into a domain member — a machine that joins AD but isn't a DC — so AD users can log into Linux and access shares. The hero is winbindd, the daemon that translates domain identities (SIDs) into Unix identities (UID/GID). This is the integration that makes the phrase "log in once for everything" real in the Linux world.

#Concept: Member Server vs DC

Don't confuse this with episode 9: a member server joins an existing domain, uses the DC for authentication, and provides services (file/print) to domain users. It doesn't store the AD database. The daemons at work: smbd (files) + winbindd (identities) + nmbd (optional). Member mode is the most common way to add Linux to an existing Windows environment.

#Joining the Domain: net ads join

#DNS Prerequisites

Before joining, the server must be able to find the DC. Test with an AD client tool:

host -t SRV _ldap._tcp.lab.local

If it fails, fix /etc/resolv.conf to point at the DC's address (episode 9). Joining without correct DNS always fails — this is pitfall number one.

#The Join Command

sudo net ads join -U Administrator

net ads join uses domain admin credentials, creates a computer account in AD, and writes the Kerberos file. Verify:

net ads testjoin
klist -k

net ads testjoin confirms the machine trust is valid; klist -k shows the machine keytab used for Kerberos.

#Configuration: security = ads and winbind

#smb.conf for Member Mode

[global]
   workgroup = LAB
   security = ads
   realm = LAB.LOCAL
 
   winbind use default domain = yes
   winbind enum users = yes
   winbind enum groups = yes
   winbind refresh tickets = yes
 
   idmap config * : backend = tdb
   idmap config * : range = 3000-7999
   idmap config LAB : backend = rid
   idmap config LAB : range = 10000-999999

Breaking down the important parts:

• security = ads: authenticate via Active Directory (not NT4-style domain).
• realm = LAB.LOCAL: the Kerberos realm name — must be exactly the domain FQDN.
• winbind use default domain = yes: users are referred to as budi, not LAB\budi — reduces confusion on systems that use plain usernames.
• winbind enum users/groups = yes: getent passwd and getent group can list AD objects.
• idmap: SID → UID/GID mapping. Two key lines:
  • * (default): backend tdb for non-domain accounts (e.g. internal groups) in the low range 3000-7999.
  • LAB (domain-specific): backend rid — UIDs computed deterministically from the RID (the last bits of the SID), so they are stable on every machine. This is crucial: a file written as UID 10023 on machine A has the same UID on machine B, with no collisions.

#Why the "rid" idmap Matters

Imagine a share accessed by two servers. Without a consistent idmap, the same user could be mapped to different UIDs on each server — files created on server A look owned by a different user on server B. The rid backend solves this with a deterministic hash. The 10000-999999 range gives plenty of room without colliding with local users (usually < 1000).

#winbindd and Linux Login

#Enable winbindd

sudo systemctl enable --now winbindd

Then connect winbind to NSS — the /etc/nsswitch.conf file that determines the sources for user/group lookups:

passwd:         files winbind
group:          files winbind
shadow:         files winbind

The order files winbind means local users are looked up first, then winbind. Restart the services that read NSS:

sudo systemctl restart nscd   # atau sssd

#Testing AD User Resolution

wbinfo -u
wbinfo -g
getent passwd budi
id budi

• wbinfo -u/-g: list users/groups from the domain.
• getent passwd budi: the AD user appears as a passwd entry — proof NSS works.
• id budi: shows the UID/GID from idmap — proof the mapping is active.

#Linux Login Authentication

For SSH/console login with AD credentials, integrate PAM with winbind — on Debian/Ubuntu, install the libpam-winbind package and run pam-auth-update, while the RHEL family uses authselect with the winbind profile. Once active, test SSH login with an AD user:

ssh budi@fileserver

The key to this pattern: authentication (password) is verified by the DC, identity (UID/GID) is provided by winbind — one password source, many consistent machines.

#Shares for Domain Users

With winbind active, shares can use AD users/groups directly:

[data]
   path = /srv/data
   valid users = @LAB\staf
   writable = yes

valid users = @LAB\staf restricts access to the AD group staf — and because idmap is consistent, files created by domain users have the same ownership on every member server. This is the payoff of the whole episode: Windows and Linux users share the same space with the same identity.

#Common Pitfalls

• Join fails because of DNS: check the SRV records; net ads join is very DNS-sensitive.
• getent passwd empty even with winbind active: check winbind enum users = yes and restart winbindd; make sure nsswitch includes winbind.
• UIDs change between machines: use the same idmap backend (rid) on all member servers.
• SSH login hangs for local users: PAM blocks on a timed-out winbind lookup — set winbind offline logon and sensible timeout parameters.

#Closing

Key takeaways:

• A member server joins with net ads join and uses the DC for authentication; DNS must be correct first.
• security = ads, realm, and winbind use default domain are the core member configuration.
• idmap with the rid backend produces deterministic UID/GIDs that are consistent across machines.
• wbinfo -u, getent passwd, and id verify AD identity resolution.
• PAM + winbind enable Linux login with domain credentials.

In episode 11 next, we'll cover filesystem: permission ACL & quota — nt acl support, POSIX ACL + xattr with the acl_xattr module, NTFS permission mapping, plus per-user/group quota via quota.vfs. This is where Samba's access control reaches Windows-level precision.