Difference between revisions of "Maintaining Unix Attributes in AD using ADUC"

(Add introduction, minor edits here and there)
m (grammar)
Line 3: Line 3:
 
In the following we describe how to set/edit the RFC2307 attributes used by [[Idmap_config_ad|idmap_ad]]. This requires to have [[Setting_up_RFC2307_in_AD#Check_if_NIS_Extensions_are_installed_in_your_Directory|NIS extensions]] installed in your AD and [[Setting_up_RFC2307_in_AD#Check_if_RFC2307_is_used_by_your_Domain_Controllers|RFC2307 enabled]] in each DCs smb.conf
 
In the following we describe how to set/edit the RFC2307 attributes used by [[Idmap_config_ad|idmap_ad]]. This requires to have [[Setting_up_RFC2307_in_AD#Check_if_NIS_Extensions_are_installed_in_your_Directory|NIS extensions]] installed in your AD and [[Setting_up_RFC2307_in_AD#Check_if_RFC2307_is_used_by_your_Domain_Controllers|RFC2307 enabled]] in each DCs smb.conf
  
Install the [[Installing RSAT|Remote Server Administration Tools (RSAT)]], if not done yet and enable the advanced view ("View" / "Advanced features"). Modifications on user and group objects be done by the Domain Administrator, if you haven't set any [[Delegation/Account_management|delegations]].
+
Install the [[Installing RSAT|Remote Server Administration Tools (RSAT)]], if not already installed and enable the advanced view ("View" / "Advanced features"). Modifications on user and group objects will be done by the Domain Administrator, if you haven't set any [[Delegation/Account_management|delegations]].
  
  
Line 53: Line 53:
 
Everytime a UID/GID is assigned using Active Directory Users and Computers (ADUC), <u>the next</u> UID/GID is stored inside the Active Directory. By default, ADUC starts assigning UIDs and GIDs at 10000
 
Everytime a UID/GID is assigned using Active Directory Users and Computers (ADUC), <u>the next</u> UID/GID is stored inside the Active Directory. By default, ADUC starts assigning UIDs and GIDs at 10000
  
If you have setup a new Samba AD and want to use a different start value, before using the first time ADUC, you need to add the counting attributes first:
+
If you have setup a new Samba AD and want to use a different start value, before using ADUC for the first time, you need to add the counting attributes first:
  
 
  # ldbedit -H /usr/local/samba/private/sam.ldb -b \
 
  # ldbedit -H /usr/local/samba/private/sam.ldb -b \

Revision as of 15:25, 1 November 2015

Introduction

In the following we describe how to set/edit the RFC2307 attributes used by idmap_ad. This requires to have NIS extensions installed in your AD and RFC2307 enabled in each DCs smb.conf

Install the Remote Server Administration Tools (RSAT), if not already installed and enable the advanced view ("View" / "Advanced features"). Modifications on user and group objects will be done by the Domain Administrator, if you haven't set any delegations.



Setting attributes on an user account

  • Open ADUC.
  • Right-click to a user account and choose properties.
  • Navigate to the "UNIX Attributes" tab.
Note: If you don't see this tab, you haven't installed the RSAT function "Server for NIS Tools".
  • When choosing the "NIS Domain", the other fields are getting enabled. Fill the values as required.
Hint: As primary group you can only choose groups, that have Unix attributes defined!
File:ADUC Unix Attributes User.png
  • Click "OK" to save your changes.



Setting attributes on a group

  • Open ADUC.
  • Right-click to a group and choose properties.
  • Navigate to the "UNIX Attributes" tab.
Note: If the tab isn't visible, you haven't installed the RSAT function "Server for NIS Tools".
  • The other fields are not enabled until the "NIS Domain" is chosen, fill the values as required.
Hint: It's not required to add users to the group in this tab! Winbind, sssd and nslcd retrieve the account membership from the Windows groups (see "Member Of"-tab).
File:ADUC Unix Attributes Groups.png
  • Click "OK" to save your changes.



Defining the next UID/GID to use

Everytime a UID/GID is assigned using Active Directory Users and Computers (ADUC), the next UID/GID is stored inside the Active Directory. By default, ADUC starts assigning UIDs and GIDs at 10000

If you have setup a new Samba AD and want to use a different start value, before using ADUC for the first time, you need to add the counting attributes first:

# ldbedit -H /usr/local/samba/private/sam.ldb -b \
  CN=samdom,CN=ypservers,CN=ypServ30,CN=RpcServices,CN=System,DC=samdom,DC=example,DC=com
msSFU30MaxUidNumber: 10000
msSFU30MaxGidNumber: 10000

With the same command you can change the values. E. g. if you require to start UIDs at 20000 and GIDs at 50000, adapt the values to your requirements:

msSFU30MaxUidNumber: 20000
msSFU30MaxGidNumber: 50000