linux - NT to UNIX group mapping in Samba 4

I want to map the NT Group Domain Users to a different UNIX group than users on my Samba 4.7.6 Active Directory Domain Controller, but when I try to do this, it fails as follows:

> net groupmap modify ntgroup='Domain Users' unixgroup='share' type=domain
Could not update group database
[255]

I read that you might now do this with winbind, so I tried, but then I get the following error.

> wbinfo --set-gid-mapping=1000,S-1-5-21-...-513
failed to call wbcSetGidMapping: WBC_ERR_NOT_IMPLEMENTED
Could not create or modify gid to sid mapping
[1]

What is the proper way to manage NT to UNIX group mapping in Samba 4?

EDIT: On the Samba mailing list I found someone with a similar problem, so maybe I could work around it by modifying the internal LDAP server directly? Something like:

ldbadd /var/lib/samba/private/sam.ldb.d/metadata.tdb ...

Unfortunately I have no experience with LDAP, so I don't know how to supply it with a valid LDIF file for my use case.

EDIT2: Thanks to a blogpost about Samba 4 user and group management in LDAP, I managed to edit the UNIX group that the NT group maps to:

> ldbedit -e nano -H /var/lib/samba/private/idmap.ldb '(objectSid=S-1-5-21-1580746459-3543417057-3597883204-513)'

> wbinfo --group-info='Domain Users'
AD.EXAMPLE\domain users:x:100:

> net groupmap list ntgroup='Domain Users'
Domain Users (S-1-5-21-1580746459-3543417057-3597883204-513) -> share

So the right group is now being reported by net groupmap, but wbinfo still reports the old value, so it probably does not get its data from that database. I am not sure how important wbinfo reporting the right group is for my use case, but I will see if I can change that as well before using this as my answer and marking it solved.

Answer

From what I have been able to piece together it seems that there is no tool available in Samba 4 that allows you to configure this properly, other than editing the built-in LDAP server directly.

The net tool does not seem to work well with the built-in LDAP server, only some operations are successful, e.g. listing the group mappings and granting rights work, but listing members of a group or modifying the group mappings does not work (as seen in my question).

To modify the mapping I ran the following commands as root. First we have to retrieve the SID of Domain Users, because it will be unique for each provisioning of the Samba server.

root> net groupmap list ntgroup='Domain Users'
Domain Users (S-1-5-21-1580746459-3543417057-3597883204-513) -> users

Then we update the built-in LDAP server's record for the SID by updating xidNumber: 100 with the intended UNIX GID:

root> ldbedit -e nano -H /var/lib/samba/private/idmap.ldb '(objectSid=S-1-5-21-1580746459-3543417057-3597883204-513)'
# 0 adds  1 modifies  0 deletes

Let's say you changed it to the GID 250 of the UNIX group called share, then calling net groupmap will result in the group reported back being share:

root> net groupmap list ntgroup='Domain Users'
Domain Users (S-1-5-21-1580746459-3543417057-3597883204-513) -> share

However wbinfo of winbindd will still report the old GID:

root> wbinfo --group-info='Domain Users'
AD.EXAMPLE\domain users:x:100:

So we have to invalidate the cache entry for Domain Users. After some experimentation I managed to do so by asking it to lookup the updated GID:

root> wbinfo --gid-info 250
AD.EXAMPLE\domain users:x:250:

Which is then also reported back correctly by --group-info:

root> wbinfo --group-info='Domain Users'
AD.EXAMPLE\domain users:x:250: