Bug 7145 - samba pdc with winbind has duplicate domain sam unix accounts
samba pdc with winbind has duplicate domain sam unix accounts
Status: RESOLVED FIXED
Product: Samba 3.5
Classification: Unclassified
Component: Winbind
unspecified
Other Linux
: P3 normal
: ---
Assigned To: Guenther Deschner
Samba QA Contact
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2010-02-17 07:35 UTC by Guenther Deschner
Modified: 2010-03-04 04:13 UTC (History)
1 user (show)

See Also:
kseeger: review?


Attachments
smb.conf (541 bytes, text/plain)
2010-02-17 07:47 UTC, Guenther Deschner
no flags Details
patch by volker (1.37 KB, patch)
2010-02-19 02:58 UTC, Michael Adam
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description Guenther Deschner 2010-02-17 07:35:45 UTC
samba pdc with winbind has duplicate domain sam unix accounts
Comment 1 Guenther Deschner 2010-02-17 07:36:52 UTC
Problem has been found by LOCAL-NSSWRAPPER test on the buildfarm while testing master (problem is not discovered by this test in v3-5-test as "winbind enum users = yes" is not activated in v3-5-test for make test)
Comment 2 Guenther Deschner 2010-02-17 07:39:15 UTC
getent passwd | grep -i administrator
Administrator:*:10000:10001:Administrator:/home/SAMBA/Administrator:/bin/bash
administrator:*:10104:10000:Administrator:/home/SAMBA/administrator:/bin/bash

is what I get on a samba pdc with ldapsam and nss_winbind and "winbind enum users = yes".

(in my case I already had created some users, that is why the uid of the 2nd account is 10104, from a fresh install it may differ)
Comment 3 Guenther Deschner 2010-02-17 07:47:32 UTC
Created attachment 5365 [details]
smb.conf 

smb.conf for my test
Comment 4 Guenther Deschner 2010-02-17 11:28:11 UTC
winbind on a dc running tdbsam has the same problem of course
Comment 5 Michael Adam 2010-02-18 10:18:04 UTC
I just very briefly tried to reproduce it (with master)
with tdbsam. But no success yet.
I might find time to test again later...

Comment 6 Guenther Deschner 2010-02-18 16:33:00 UTC
easiest way to demonstrate this is to fetch master with 2eb83f29648c7647cff4ac6eb38830ae35fcbcb5 including and call:

TESTS=posix_s3 POSIX_SUBTESTS="RPC-SAMR-LARGE-DC LOCAL-NSS-WRAPPER" make test
Comment 7 Michael Adam 2010-02-19 00:59:18 UTC
OK, reproduced it with Günther's new test in master.
It does not seem to be completely deterministic though.
As non-root I get 300 duplicate group entries, while
running as root, I get 2 duplicate entries for root.
This is on ubuntu 9.10, 64bit. 

Günther seems to get different figures.
Comment 8 Michael Adam 2010-02-19 02:26:02 UTC
Volker has patches for this.
Comment 9 Michael Adam 2010-02-19 02:58:26 UTC
Created attachment 5396 [details]
patch by volker

proposed patch by volker.
Comment 10 Michael Adam 2010-02-19 02:59:27 UTC
While the patch seems to fix the issue for volker in a "real world environment", the make test run still fails on my box with the same dups.

Assigning to Günther for now, to review / decide...
Comment 11 Volker Lendecke 2010-02-28 07:41:47 UTC
0e9882a65e91e4ab5 in master fixes it for me.

Volker
Comment 12 Volker Lendecke 2010-02-28 11:04:40 UTC
Hmmm. Now WINBIND-STRUCT fails because we don't return anything in for GETPWENT :-(

I think we need to decide what make test is supposed to expect...

Volker
Comment 13 Guenther Deschner 2010-03-01 03:50:27 UTC
Phantastic! Thanks so much Volker for fixing this!
Karolin, please pick 0e9882a65e91e4ab5 for 3.5.0 final

We can make sure to pass WINBIND-STRUCT again later (the failure of that is based on mixed expectations between s3 and s4 winbind).
Comment 14 Karolin Seeger 2010-03-01 04:08:35 UTC
(In reply to comment #13)
> Phantastic! Thanks so much Volker for fixing this!
> Karolin, please pick 0e9882a65e91e4ab5 for 3.5.0 final

Pushed to v3-5-test.

> We can make sure to pass WINBIND-STRUCT again later (the failure of that is
> based on mixed expectations between s3 and s4 winbind).

Re-assigning to Günther for fixing the test.
Lowering severity.
Comment 15 Guenther Deschner 2010-03-04 04:13:08 UTC
Ok, WINBIND-STRUCT test fixed as well. 
Hey, buildfarm is getting green again!