Re: Clarification on Samba AD Security Model for Remote RPC Administration

Hi Rowland,

Thank you for your feedback. It helped clarify my wording, and I will be more careful to distinguish authentication, identity mapping, and authorization in future discussions.

Just to put the design in its broader context: OpenLDAP predates our Samba deployment and remains the authoritative source for Unix identities. This is an architectural decision driven by requirements outside of Samba: our Unix domain members rely on OpenLDAP as their identity source, while only a subset of those identities is synchronized to AD through LSC.

Conversely, our AD administrative accounts are intentionally AD-only and do not have Unix identities in OpenLDAP. This was not originally designed as a Samba security mechanism, nor was another idmap backend technically impossible. It is simply a consequence of keeping OpenLDAP as the authoritative Unix identity source.

The behavior I find interesting is the following: AD-only accounts can authenticate successfully against AD/Kerberos, but they cannot obtain a Unix identity on the file servers because no SID to UID mapping can be resolved through NSS/OpenLDAP. As a result, the SMB session cannot proceed to the point where local authorization checks (ACLs or privileges) can be applied.

This does not replace Samba/AD authorization mechanisms. It is simply an additional separation boundary resulting from the identity architecture: an AD-only privileged account has no Unix identity on our domain-member file servers.

I understand that ACLs and privileges remain the proper authorization mechanisms. In our case, this additional restriction comes from the fact that AD is not the only identity source in our environment: OpenLDAP remains the authoritative source for Unix identities.

Thanks again for taking the time to answer and for your work on Samba.

Best regards,

Havany
-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba