I've configured samba 3.6.3 to use AD on my ubuntu box. The configuration seems to be correct, commands like getent group, getent passwd return groups and users from AD. I can grant AD user permissions on folders and using sudo that user has access. However, when going through samba the user has no access to the folder. Here's some test code. First just testing winbind and the linux permissions:

sudo mkdir /tmp/test
sudo chown root:sambashare /tmp/test
sudo chmod 775 /tmp/test
sudo usermod -G sambashare DOM+user1
sudo -u DOM+user2 touch /tmp/test/file
  touch: cannot touch `test/file': Permission denied
#good because DOM+user2 is not in sambashare group
sudo -u DOM+user1 touch /tmp/test/file
ls -l /tmp/test
  -rw-r--r-- 1 DOM+user1 DOM+domain users 0 Jan 14 16:53 test/file

Now configuring samba share

        path = /tmp/test
        writable = yes
        follow symlinks = yes
        valid users = DOM+user1,@sambashare

The directory is visible to the user. But creating new directory or file is not allowed.

If I change linux permissions:

chown DOM+user1 /tmp/test

I can write to the samba share from windows. Note that I haven't added a write list to samba or anything else, just the user ownership on that share in linux. And linux was allowing the user to write to that folder before based on group permissions.

I've tried opening the share from Windows 7 box, and Ubuntu box via Go -> Open Location -> smb:// . Same issue. So I don't think it's windows.

Anyone know what's going on?


I'm trying to group domain users by local groups and allow access to certain shares, so I don't have to bother AD admins to create custom groups. Also I want to use filesystem permissions instead of samba write lists. It's cleaner and samba is not the only service.

Mapping a domain group to a local linux group isn't what I'm trying to achieve.

So for example locally I create local dev_team1, dev_team2 groups. Add DOM+sally to dev_team1 and DOM+john to dev_team2, then set filesystem permissions using ACL.

I thought this configuration was possible because winbind is mapping domain groups/users to a range specified by samba:

idmap config * : backend = tdb
idmap config * : range = 20000-999999

And when you execute getent group; getent passwd you get a list of domain groups/users with ID > 20,000. So based on that I assumed samba authenticates the user, assigns them one of the ids, and it doesn't matter if ID 20,000 is in a local group 500, or part of domain group 21,000.

Guess not...


Method 1 - Change Group

Try following

chown :DOM+domain /tmp/test

Then re-test.

Method 2 - Force Group

Use samba force group to assign default group for the share

        path = /tmp/test
        writable = yes
        follow symlinks = yes
        force group = sambashare
        valid users = DOM+user1

Method 3 - Add domain user to a domain group

This is actually a generalized method 1 and the common way in this kind of sharing

        path = /tmp/test
        writable = yes
        follow symlinks = yes
        force group = sambashare
        valid users = @DOM+domainshare, @sambashare

Create an AD group domainshare and add any domain user needed to access the share into it.

linux user in sambashare group can access the share.

| improve this answer | |
  • It works with AD groups as you suggest and as I described in the bounty. Though my description is using ACL instead of posix permissions - I've tried both, it's not samba/ACL issue. When you add "domain" users to local group, linux is happy that the permissions are satisfied (see touch example), samba isn't. I'm trying to understand why and if there's a fix. – Budric Jan 21 '13 at 15:57
  • Mixing domain login with local group is not straight forward. According to this samba doc you need to do group mapping. I would say Method 1 or 2 is easier and less messy if you have to move your share across machine in future, but it will be your choice. – John Siu Jan 21 '13 at 16:49
  • Please see my edit. I guess I lack some understanding in samba protocol and group mapping. I'll wait for a day to see if there's a better answer, but I'll accept yours if nothing comes along. – Budric Jan 21 '13 at 17:14
  • OK, was too focus on your setup and just forgotten the common way to do a samba share. Please see method 3. If you don't need to share with local linux account, you can skip the smabashare group setup. – John Siu Jan 21 '13 at 17:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.