This is my scenario:
I have a CentOS 7.5 server which must act as a file server and allow AD-integrated authentication for Samba access, without the need to create local users with
Samba Version 4.7.1
SSSD Version 1.16.0
What I've done so far:
Joined my linux server to my AD domain using
client-software=sssd) and configured Samba to serve shares.
Upon completing these steps, I have the following problem:
Can't authenticate domain users accessing Samba shares because Samba logs complain that it "Failed to fetch domain SID for MYDOMAIN".
net getdomainsid shows SID for local machine, but also reports that "Could not fetch domain SID".
I found a workaround to solve this by either:
- Leaving the domain then joining again with
realmd(but this time with
- Manually setting the SID with
Both approaches will set the domain SID for Samba and allow me to use AD authentication.
So, I would like to know why is it that joining the domain with
client-software=winbind sets this domain SID, while joining with
client-software=sssd doesn't. And finally: is there a way to make
sssd automatically set this domain SID for Samba while joining the domain?