FreeNAS 11.1 / FreeBSD winbind idmap_ad problem

[tfili]

Hi,

i found a strange behaviour when i test a FreeNAS 11.1 installation.
We authenticate against a Active Directory, mostly from Ubuntu clients but also from ZFS capable fileservers using OmniOS, OpenIndiana or FreeBSD without problems.

Now i tested FreeNAS 11.1 and was glad to find the posibilty using the idmap_ad and nss_info rfc2307
I was able to join the domain and got the user list from wbinfo -u and group list from wbinfo -g

But when i test the wbinfo -i i only get the correct uidNumber from the requested username but i do not get correct entries for displayName, gidNumer, homeDirectory and loginShell.

I am not sure but i suppose a relation with the samba version. 4.3.11 on Ubuntu ist ok, OpenIndiana Hipster with 4.5.15 is also ok.

But FreeBSD 11.0-p16 with samba 4.4.16 shows still the correct HomeDirectory and loginShell, but displayName is missing and gidNumber is the "Domain User" and not the gidNumber from LDAP

Now under FreeBSD 11.1 with samba 4.6.8 only uidNumber is correct ... gidNumber is from the "Domain Users", displayName is missing and homeDirectory and loginShell seems to be generated from the "template homedir/shell" option

FreeNAS 11.1 with samba 4.7.x ?! show the same as FreeBSD 11.1 with samba 4.6.8

Can anybody confirm this behaviour ???

Or is there a new option for smb.conf changing this behaviour back to a "old" compatible value ?
With testparm -vvv i do not found any option seem to be related with my problem.

 

[tfili]

Ok, sorry .. found the problem

https://www.samba.org/samba/history/samba-4.6.0.html

...
winbind primary group and nss info
----------------------------------

With 4.6, it will be possible to optionally use the primary group as
set in the "Unix Attributes" tab for the local unix token of a domain
user. Before 4.6, the Windows primary group was always chosen as
primary group for the local unix token.

To activate the unix primary group, set

idmap config <DOMAIN> : unix_primary_group = yes

Similarly, set

idmap config <DOMAIN> : unix_nss_info = yes

to retrieve the home directory and login shell from the "Unix
Attributes" of the user. This supersedes the "winbind nss info"
parameter with a per-domain configuration option.

...