Bug 10335 - net groupmap cleanup cleans wrong
Summary: net groupmap cleanup cleans wrong
Status: NEW
Alias: None
Product: Samba 4.1 and newer
Classification: Unclassified
Component: Winbind (show other bugs)
Version: 4.1.3
Hardware: All All
: P5 normal (vote)
Target Milestone: ---
Assignee: Samba QA Contact
QA Contact: Samba QA Contact
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2013-12-19 11:57 UTC by Björn Jacke
Modified: 2013-12-19 11:57 UTC (History)
0 users

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Björn Jacke 2013-12-19 11:57:43 UTC 
the builtin domain is also stored in the group mapping tdb.

"net groupmap cleanup" however deletes all mappings from SIDs that are not the own SID. The domain SID S-1-5-32 should also be excluded by the cleanup accordingly, shouldn't it?

On the other hand it would be nice if the "net groupmap cleanup" command would recognice if the Unix IDs of the defined mappings fit to the configured winbind idmap ranges. For example when the builtin\users group was created on the server, "net groupmap list" lists the mapping by name not by number. Only the --verbose switch will also show the numeric posix ID. If the idmap ranges had been shifted one day, it will not be obvious that there is trouble waiting because there is an old sid<>id maping from the previous configuration for a range that belongs to another domain now actually. "net groupmap cleanup" should issue a warning in cases like that.