I recently updated my Samba configuration and ran into a major issue: all of our user IDs (UIDs) and group IDs (GIDs) have changed after switching the idmap backend from 'ad' to 'rid'. We have a Windows Server 2022 with Active Directory and Ubuntu 24.04 LTS running Samba file sharing and Winbind. After installing the latest updates, which included some significant security changes from Microsoft, I backported a fix that seemed to work. However, once I reconfigured the idmap backend, the IDs for all AD users and groups no longer pulled from the gidNumber attribute, which is leading to inconsistent permissions across the board. Should I invest time in scripting the permission changes to align with these new IDs or is there a way to revert back to the old IDs? If reverting is possible, where can I make those adjustments?
2 Answers
If the update worked, it's puzzling why you switched the idmap from 'ad' to 'rid'. Maybe consider reverting that change? It might be simpler than you think, especially if the fix worked with your current setup. Just a thought!
Just a heads-up: only the 'ad' idmap backend ensures that IDs stay consistent across different servers. If you switch to 'autorid' or 'rid', you’ll end up with new IDs because they calculate based on the account's RID. The 'ad' backend pulls directly from the uidNumber and gidNumber attributes in AD, so you might want to reconsider your setup.
Exactly! While 'autorid' and 'rid' are alternatives, they don't guarantee ID consistency like 'ad' does. If you switch back now, it should help you manage those permissions better.
I know your concern; it's why I held off on reverting at first. But it could save you a lot of trouble in the long run if you don't run into future issues by switching back.