using idmap_rid with Samba 3.0.25 makes winbind segfault when I do a "wbinfo --user-groups=W2K3AD\\administrator". The idmap parameters are like this: security = domain workgroup = W2K3AD idmap uid=10000-20000 idmap gid=10000-20000 idmap backend = idmap_rid:"W2K3AD=10000-12000,BUILTIN=12001-13000" very serious looks this from the log file: [2007/05/16 17:20:18, 0] lib/util.c:talloc_check_name_abort(2977) Talloc type mismatch, expected struct winbindd_async_request, got struct getgroups_state
Created attachment 2696 [details] winbind log file
strange. I just retried that with a new samba build *without* stripped binaries, everything else is exactly the same. At least now I cannot reproduce the segfault.
Created attachment 2720 [details] gdb backtrace of parent segfault
Created attachment 2721 [details] winbind log (cut-out)
Attachments are created against current SAMBA_3_0_25 branch (same smb.conf as Bjoern has used, reproduced as described above).
I'm assuming that we do not have a patch yet?
Ok, it seems that idmap_rid does not look at the BUILTIN=x-y parameters at all. Inside idmap_rid_initialize we get (gdb) p *dom $3 = {name = 0x8343450 "default domain", default_domain = 1, readonly = 1, private_data = 0x0, methods = 0x82d5ecc, initialized = 0, params = 0x83434e8 "BUILTIN=10000-11000,BLA=11001-20000"} so the parameters are passed down, but I do not see code that would bother to look at dom->params. Where is that? Am I blind? ;-))) ... this is Volker at Karolins machine btw :-)
Karolin, You are probably right and I believe that the idmap_rid.c may be suffering from bit rot. I'll take a look at this. Couple of comments: (a) The BUILTIN and MACHINE domain should always be handled by idmap_passdb and not generic idmap plugins. (b) The correct way to get multi-domain support from idmap_rid will be to define a list of idmap domains and configure the rid backend for each domain. (c) Multi-domain support prior to 3.0.25 for idmap_rid always required a #define to enable the experiemental feature.
even if multiple domain support had to be enabled by a #define I would consider it to have been supported as smb.conf(5) (checked 3.0.2[34]) said: Example: idmap backend = rid:"BUILTIN=1000-1999,DOMNAME=2000-100000000"
(In reply to comment #9) > even if multiple domain support had to be enabled by a #define I would consider > it to have been supported as smb.conf(5) (checked 3.0.2[34]) said: > > Example: idmap backend = rid:"BUILTIN=1000-1999,DOMNAME=2000-100000000" You'll have to whine at Guenther about that. My position has always been that the multi-domain feature was experiemental and hence not enabled by default with "./configure && make && make install". Moving forward, I'll maintain this code. Patches forthcoming but probably for 3.0.25b.
We have several customers with the old idmap backend config: idmap uid=10000-20000 idmap gid=10000-20000 idmap backend = idmap_rid:"W2K3AD=10000-12000" (Only one domain!) This config does not work in Samba 3.0.25 and 3.0.25a, because winbindd segfaults again. What about backward compatibility? Should this setup still work or is only the new configuration supported?
(In reply to comment #11) > We have several customers with the old idmap backend config: > > idmap uid=10000-20000 > idmap gid=10000-20000 > idmap backend = idmap_rid:"W2K3AD=10000-12000" > > (Only one domain!) > > This config does not work in Samba 3.0.25 and 3.0.25a, because winbindd > segfaults again. > > What about backward compatibility? Should this setup still work or is only the > new configuration supported? In >= 3.0.25 only the "idmap domains" configuration options can help you out with idmap rid. Only the non-multi-domain default behavior of idmap_rid will be supported with idmap backend = rid
*** Bug 4662 has been marked as a duplicate of this bug. ***
Created attachment 2746 [details] idmap_rid segfault fix and bacward compatibility This patch (a new fixed version) was attached to #4662 which is basically the same bug discussed here. This patch should fix the segfault problem and handle correctly the only backward configuration we decided to handle. (non multi-domain with idmap backend = rid.) Multi domain is available with idmap domains, and BUILTIN is handle by idmap_passdb and group mapping. Please let me know if this patch is ok for you and I'll commit it to all branches.
Committed as r23525 To me this closes the bug, reopen it if there is still some probelm.