Updated to 22.12-MASTER-20221117-031211 and ACLs not showing AD users/groups

[sgt_jamez]

I have run into this on another attempt to run a current nightly, and when I do the ACL editor does not show my AD users and groups. Wbinfo -u and -g shows the appropriate domain users and groups, but I can't set my shares with the correct permissions as they are not showing up in the drop down.

I have tried restarting the SMB service, and tried leaving and rejoining the domain.

I have been running on 22.12-MASTER-20220626-072905, but today I tried to update some of my apps and had issues. I think some of the innards have changed to where I can mp longer use such an old nightly. So I updated, and I'm back to having this domain issue.

Someone tell me there's a solution to this??

 

[morganL]

Does the issue exist on RC1?

 

[sgt_jamez]

I tried to install the RC1 update file but it wouldn’t let me. So I think I have to reinstall from the ISO. My question then is will my current config file work with the RC1 install or will I lose everything?

 

[sgt_jamez]

Ok so I booted from USB with the RC1 ISO. It allowed me to perform an upgrade install and keep my existing configuration which I did. The install went through fine and I rebooted. The same issue persists.

'getent passwd' shows no domain users
Leaving and rejoining the domain doesn't help
Disregard - Also noticed that the shell screen from system settings doesn't work

I should add that I tested all this on a different machine running an old nightly and it is working fine. Just my main node that can't connect to the domain.

Further reading suggested I run testparm -s. I saw an error
idmap range not specified for domain '*' ERROR: Invalid idmap range for domain *! Server role: ROLE_DOMAIN_MEMBER
I changed the idmap backend type to AUTORID, and after restarting the directory services, getent group showed domain groups.
I looked at my share permissions and they would have to be reset. I tested it on one share and it works. I switched back to RID and getent is back to not showing domain groups and testparm shows the invalid idmap range (which is set to 100000000 - 200000000).

How can I make this run on RID instead of AUTORID?

 

[sgt_jamez]

So I was able to fix this problem. Here's how:
I saw on my working machine that the idmap section of the Directory Services had two lines. I added the second line to my troubled machine and after a Directory Services restart, everything was working.

So that's the "how". I still don't know WHY that fixed it. Could someone make sense of this to me?

 

[morganL]

If the old machine is updated to RC1 does it work or have the issue?

 

[sgt_jamez]

After putting RC1 on the old machine it still had the issue. And the issue was resolved by adding the SMB line in my previous post.

 

[berichards]

So I was able to fix this problem. Here's how:
I saw on my working machine that the idmap section of the Directory Services had two lines. I added the second line to my troubled machine and after a Directory Services restart, everything was working.
View attachment 60036

So that's the "how". I still don't know WHY that fixed it. Could someone make sense of this to me?

I had the same issue and this did the trick! Thank you so much for posting this here.

For reference: I upgraded from TrueNAS-SCALE-22.02.0 to TrueNAS-SCALE-22.12.0. I have two servers that are set up near identically as well. One of the servers is still on 22.02.0. I can also confirm (the same as you) that the setting exists in the server that I have yet to update and was missing in the server I have already updated.

 

[anodos]

I had the same issue and this did the trick! Thank you so much for posting this here.

For reference: I upgraded from TrueNAS-SCALE-22.02.0 to TrueNAS-SCALE-22.12.0. I have two servers that are set up near identically as well. One of the servers is still on 22.02.0. I can also confirm (the same as you) that the setting exists in the server that I have yet to update and was missing in the server I have already updated.

We're tracking this bug and will have fix in 22.12.1 (it was a broken migration that deleted an internal idmap entry in some edge cases).