Re: Clarification on Samba AD Security Model for Remote RPC Administration

On Tue, 11 Aug 2026 14:34:28 +0000
Havany via samba <[email protected]> wrote:

> Hi Rowland,
> 
> Thank you for your feedback. It helped clarify my wording, and I will
> be more careful to distinguish authentication, identity mapping, and
> authorization in future discussions.
> 
> Just to put the design in its broader context: OpenLDAP predates our
> Samba deployment and remains the authoritative source for Unix
> identities. This is an architectural decision driven by requirements
> outside of Samba: our Unix domain members rely on OpenLDAP as their
> identity source, while only a subset of those identities is
> synchronized to AD through LSC.
> 
> Conversely, our AD administrative accounts are intentionally AD-only
> and do not have Unix identities in OpenLDAP. This was not originally
> designed as a Samba security mechanism, nor was another idmap backend
> technically impossible. It is simply a consequence of keeping
> OpenLDAP as the authoritative Unix identity source.
> 
> The behavior I find interesting is the following: AD-only accounts
> can authenticate successfully against AD/Kerberos, but they cannot
> obtain a Unix identity on the file servers because no SID to UID
> mapping can be resolved through NSS/OpenLDAP. As a result, the SMB
> session cannot proceed to the point where local authorization checks
> (ACLs or privileges) can be applied.
> 
> This does not replace Samba/AD authorization mechanisms. It is simply
> an additional separation boundary resulting from the identity
> architecture: an AD-only privileged account has no Unix identity on
> our domain-member file servers.
> 
> I understand that ACLs and privileges remain the proper authorization
> mechanisms. In our case, this additional restriction comes from the
> fact that AD is not the only identity source in our environment:
> OpenLDAP remains the authoritative source for Unix identities.
> 
> Thanks again for taking the time to answer and for your work on Samba.
> 
> Best regards,
> 
> Havany

I think your problems show why, even though it might seem to be a good
idea at the time a dual system is setup (openLDAP syncing from AD), it
usually isn't, but the choice is yours.

As for why your AD users can get a kerberos ticket but not use it on a
Unix machine, it is for the very reason you stated, there is no Unix
user to map the AD SID to and the Unix OS does not have a clue who the
user is. Even a Samba standalone server requires a Samba user and a
Unix user.

Rowland


-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba