i got Linux server (SLES 12) joined in Windows AD with winbind and samba services. I got unix group "mqm" and windows AD group "67uts-mq-admins". I want to map windows AD to unix group with "net groupmap" and manage members of mqm group through AD. So i tried:

net groupmap add sid=%ACTUAL_67uts-mq-admins_SID% ntgroup=67uts-mq-admins unixgroup=mqm type=d

the command successfully completed. I see result in "net groupmap list". But when i login to unix with user who is member of 67uts-mq-admins group, i don't see him in mqm group

> getent group mqm
> getent group 67uts-mq-admins
> groups myuser
myuser: .... 67uts-mq-admins 

I can't create "mqm" group in my AD, cause AD group naming rules in my company. And software requirement (IBM MQ) is that product administrators must be in "mqm" group


In my case I've found that I can add an entry to /etc/group that masks the Active Directory entry. (This might not be the correct solution but in my situation it works). Here is what I would add for your example, where getent group 67uts-mq-admins returns 67uts-mq-admins:x:57376:


You may be able to run the command addgroup --gid 57376 mqm or groupadd --gid 57376 --non-unique mqm to add this line programmatically. (I don't run SLES here so I can't give you advice specific to that platform.)

  • Thank you for reply, but for me it's not good to setup non-default gid for this group. Is it possible to set manually gid=1010 for AD group 67uts-mq-admins, if i am using idmap_rid backend for this domain?
    – Andrey
    Jun 29 '16 at 14:02
  • @Andrey I don't know; I couldn't get net groupmap to do anything useful. Here for this solution you're not really setting a non-default gid; you're just overriding the name associated with the gid provided by AD.
    – roaima
    Jun 29 '16 at 14:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.