I am using Samba version 4.6.16-git.124.aee309c5c183.32.1-SUSE-SLE_12-x86_64, and the server is member of a Windows AD domain.
We have a couple of jobs using shares on the Linux machine and have been using dedicated users for those so far. We would like to change this and use Managed Service Accounts (MSA) for the jobs now.
The problem I have is that the MSA account cannot access the share, while the dedicated user account can. When I check log.smbd I can see that the MSA account is being successfully authorized and password-checked, however it gets an "ACCESS_DENIED" when trying to access the share. Both the user and the MSA account are members of the same group in AD which was allowed to access the share.
Is this a general issue / does Samba not play well with MSA accounts, or is there something I can tweak in smb.conf to make the share usable?
=> The domain controller is a Windows Server, the Linux system is a domain member.
=> I want that a MSA account e.g. "MSA-ETLJOB$" accesses a samba share on the Linux system. The account is member of a group which is granted access to the share. I can also verify that by checking the groups with the groups command "groups MSA-ETLJOB$"
=> in log.smbd I can see that "MSA-ETLJOB$" gets successfully authenticated, however when it then tries to access the share / chdir, it says "ACCESS_DENIED".
==> why can't "MSA-ETLJOB$" access the directory? Can I make that work somehow? ==> or is there a general issue with MSA-accounts and Samba?