3.4. Manually adding an ID mapping configuration if IdM trusts a new domain

Samba requires an ID mapping configuration for each domain from which users access resources. On an existing Samba server running on an IdM client, you must manually add an ID mapping configuration after the administrator added a new trust to an Active Directory (AD) domain.

Prerequisites

You configured Samba on an IdM client. Afterward, a new trust was added to IdM.
The DES and RC4 encryption types for Kerberos must be disabled in the trusted AD domain. For security reasons, RHEL 10 does not support these weak encryption types.

Procedure

Authenticate using the host’s keytab:
```
[root@idm_client]# kinit -k
```

Use the ipa idrange-find command to display both the base ID and the ID range size of the new domain. For example, the following command displays the values for the ad.example.com domain:

[root@idm_client]# ipa idrange-find --name="AD.EXAMPLE.COM_id_range" --raw
---------------
1 range matched
---------------
  cn: AD.EXAMPLE.COM_id_range
  ipabaseid: 1918400000
  ipaidrangesize: 200000
  ipabaserid: 0
  ipanttrusteddomainsid: S-1-5-21-968346183-862388825-1738313271
  iparangetype: ipa-ad-trust
----------------------------
Number of entries returned 1
----------------------------

You need the values from the ipabaseid and ipaidrangesize attributes in the next steps.

To calculate the highest usable ID, use the following formula:
```
maximum_range = ipabaseid + ipaidrangesize - 1
```
With the values from the previous step, the highest usable ID for the ad.example.com domain is 1918599999 (1918400000 + 200000 - 1).
Edit the /etc/samba/smb.conf file, and add the ID mapping configuration for the domain to the [global] section:
```
idmap config AD : range = 1918400000 - 1918599999
idmap config AD : backend = sss
```
Specify the value from ipabaseid attribute as the lowest and the computed value from the previous step as the highest value of the range.

Restart the smb and winbind services:

[root@idm_client]# systemctl restart smb winbind

Verification

List the shares on the Samba server using Kerberos authentication:

$ smbclient -L idm_client.idm.example.com -U user_name --use-kerberos=required
lp_load_ex: changing to config backend registry

    Sharename       Type      Comment
    ---------       ----      -------
    example         Disk
    IPC$            IPC       IPC Service (Samba 4.15.2)
...

3.4. Manually adding an ID mapping configuration if IdM trusts a new domain

詳細情報

試用、購入および販売

コミュニティー

Red Hat ドキュメントについて

多様性を受け入れるオープンソースの強化

会社概要

Theme

Red Hat legal and privacy links

Red Hat legal and privacy links