Re: samba-tool group addmembers error - string_to_sid: SID <groupname> is not in a valid format

Mandi! Rowland Penny via samba
  In chel di` si favelave...

> I think this is all down to you seemingly having /etc/samba/smb.conf.%M
> instead of /etc/samba/smb.conf . The %M is used internally by smb.conf
> as a substitute for the clients hostname, so why try and use it
> externally ?

I use in smb.conf:

	log file = /var/log/samba/log.%M

to be able to enable debugging (or other options) per-machive; i've ever
used this on my smb.conf and never hit a trouble (apart the warning, indeed).


> What I think is happening is, the samba-tool command tries to read the
> smb.conf file and fails, this leads to winbind being unable to map the
> SID to an ID, so you get 'SID_ALIAS' (something I can never remember
> seeing). Try removing the '.%M' from /etc/samba/smb.conf.%M and see if
> that cures your problem.

I've commented out and retry, same result:

[root@ppfs1 ~]# samba-tool group addmembers fvg_sir marco.gaiarin --URL=ldap://ppdc1.fvg.ad.lnf.it -U adminmgaiarin -d 3
lpcfg_load: refreshing parameters from /etc/samba/smb.conf
Tried to load /etc/samba/smb.conf.%M but variable substitution in filename, ignoring file.
resolve_lmhosts: Attempting lmhosts lookup for name ppdc1.fvg.ad.lnf.it<0x20>
GENSEC backend 'gssapi_spnego' registered
GENSEC backend 'gssapi_krb5' registered
GENSEC backend 'gssapi_krb5_sasl' registered
GENSEC backend 'spnego' registered
GENSEC backend 'schannel' registered
GENSEC backend 'ncalrpc_as_system' registered
GENSEC backend 'sasl-EXTERNAL' registered
GENSEC backend 'ntlmssp' registered
GENSEC backend 'ntlmssp_resume_ccache' registered
GENSEC backend 'http_basic' registered
GENSEC backend 'http_ntlm' registered
GENSEC backend 'http_negotiate' registered
Password for [LNF_FVG\adminmgaiarin]:
string_to_sid: SID fvg_sir is not in a valid format
ERROR: Failed to add members ['marco.gaiarin'] to group "fvg_sir" - Unable to find group "fvg_sir"
  File "/usr/lib64/python3.9/site-packages/samba/netcmd/group.py", line 486, in run
    samdb.add_remove_group_members(groupname, groupmembers,
  File "/usr/lib64/python3.9/site-packages/samba/samdb.py", line 467, in add_remove_group_members
    raise Exception('Unable to find group "%s"' % group)

Also to me the 'SID_ALIAS' smells not so good... but server are now in
production and all works as expected.

Group are:

[root@ppfs1 ~]# ldbsearch -P -H ldap://ppdc1.fvg.ad.lnf.it -b DC=fvg,DC=ad,DC=lnf,DC=it "(&(objectClass=group)(samAccountName=FVG_SIR))"
# record 1
dn: CN=FVG_SIR,OU=Gruppi,DC=fvg,DC=ad,DC=lnf,DC=it
objectClass: top
objectClass: group
cn: FVG_SIR
description: Servizio Informatico Regionale
distinguishedName: CN=FVG_SIR,OU=Gruppi,DC=fvg,DC=ad,DC=lnf,DC=it
instanceType: 4
whenCreated: 20260402134929.0Z
whenChanged: 20260410104750.0Z
uSNCreated: 117769
uSNChanged: 164865
name: FVG_SIR
objectGUID: 7297353e-4eef-4b3b-82f9-2050876eb65a
objectSid: S-1-5-21-3195041156-2418829160-2956828833-4233
sAMAccountName: FVG_SIR
sAMAccountType: 536870912
groupType: -2147483644
objectCategory: CN=Group,CN=Schema,CN=Configuration,DC=ad,DC=lnf,DC=it
dSCorePropagationData: 16010101000000.0Z

# Referral
ref: ldap://DomainDnsZones.fvg.ad.lnf.it/DC=DomainDnsZones,DC=fvg,DC=ad,DC=lnf,DC=it

# returned 2 records
# 1 entries
# 1 referrals


-- 



-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba