Samba shares with windows AD picking wrong username

Question

I have a strange problem, which I have found no answers for on the web.

I have ubuntu 12.04 LTS with Samba 3.6. 3 (ntp krb5-user smbfs smbclient winbind)

At first everything works fine, groups in AD have the proper file access and user permissions work, except for one anomaly:

There are 2 users with the same first name:

simon folly and simon wally

If I log into Windows as simon wally and try to access his share I get permission denied. When I view samba.log is states:

[2014/03/24 20:39:04.702632, 2] smbd/service.c:627(create_connection_session_info) user 'WINDOMAIN\simon folly' (from session setup) not permitted to access this share (simonw)

As you can see above the wrong username is been authenticated. It's seems it finds the first name from the list and picks that one.

So to test my theory I changed the username in the smb.conf file to "simon folly" and sure enough when logged in as simon wally I have full access to my share ??

Has this happened to anyone and how to fix it ?

Here is my share in smb.conf

note: when I change wally to folly then wally has full access.
otherwise below gets denied.    

[simonw]
    comment = Simon Only
    path = /sharing/ceo
    valid users = "WINDOMAIN\simon wally"
    force group = "domain users"
    writable = yes
    read only = no
    force create mode = 0660
    create mask = 0777
    directory mask = 0777
    force directory mode = 0770
    access based share enum = yes
    hide unreadable = yes

thank you in advance for your help :)

Answer 1

This problem is caused by the lack of support for spaces inside user names with samba, this is because they are used as seperators.

The following solution can be used to solve this problem, this creates an alias for the user name with spaces:

1. Define a user name map by placing the following inside your samba configuration:

   username map = /usr/local/private/usermap.txt
   

2. Add the following content to /usr/local/private/usermap.txt

   WINDOMAIN\simonwally = "WINDOMAIN\simon wally"
   WINDOMAIN\simonfolly = "WINDOMAIN\simon folly"
   

   This creates an alias, so the name can be the user without spaces

3. Change the valid users section inside your configuration to:

   valid users = "WINDOMAIN\simonwally"
   

   Because of the mappings we made before, this will map to the user account with a space, and because of that, it will accept the user to the share.

4. Check if the samba configuration contains mistakes (always recommend after a modification) Run the following code on a terminal like bash:

   testparm && echo "Syntax OK" || echo "Syntax Error"
   

5. Restart samba:

   sudo service smbd restart
   

Ref 1: Explains how to use spaces inside the configuration.

Ref 2: Code for checking if the samba configuration contains mistakes.