[SOLVED] Some users are displayed with pdbedit tool; some not

[todd_dsm]

I'm a big believer in the Zimbra6/Samba integration.

My current problem is that some accounts are not displaying when working with Samba's pdbedit tool. This has worked consistently for over a year.

Recently I've upgraded from samba 3.0 (on RHEL) to samba 3.3 (the samba3x rpm). So, for starters, I'm suspecting that the new version of samba is maybe a bit buggy.

These are all of the zimbra accounts:

$ zmaccts
           account                          status             created       last logon
------------------------------------   -----------     ---------------  ---------------
admin@domain.tld                              active      11/01/10 01:44            never   check
ham@domain.tld                                active      11/01/10 01:45            never   check
hgwells@domain.tld                            active      11/01/10 02:33            never
hitman@domain.tld                             active      11/01/10 02:34            never
nobody@domain.tld                             closed      11/01/10 02:33            never
spam@domain.tld                               active      11/01/10 01:45            never   check
lname@domain.tld                              active      11/01/10 02:33            never   check
user1@domain.tld                              active      11/01/10 02:34            never
user2@domain.tld                              active      11/01/10 02:35            never
user3@domain.tld                              active      11/01/10 02:35            never
wiki@domain.tld                               active      11/01/10 01:45            never   check

                                 domain summary

    domain                  active    closed    locked    maintenance     total
-----------------------   --------  --------  --------  -------------  --------
domain.tld                        10         1         0              0        11

When listing them from pdbedit only these users are displayed:

# pdbedit -L
smbldap_search_domain_info: Searching for:[(&(objectClass=sambaDomain)(sambaDomainName=OFFICE))]
smbldap_open_connection: connection opened
ldap_connect_system: successful connection to the LDAP server
smbldap_search_domain_info: Searching for:[(&(objectClass=sambaDomain)(sambaDomainName=OFFICE))]
smbldap_open_connection: connection opened
ldap_connect_system: successful connection to the LDAP server
smbldap_search_paged: base => [dc=domain,dc=tld], filter => [(&(uid=*)(objectclass=sambaSamAccount))],scope => [2], pagesize => [1024]
smbldap_search_paged: search was successfull
init_sam_from_ldap: Entry found for user: admin
admin:10002:admin
init_sam_from_ldap: Entry found for user: wiki
wiki:10003:wiki
init_sam_from_ldap: Entry found for user: spam
spam:10004:spam
init_sam_from_ldap: Entry found for user: ham
ham:10005:ham
init_sam_from_ldap: Entry found for user: root		(displays as it is ONLY in samba's tdb)
root:0:root
init_sam_from_ldap: Entry found for user: lname
thomas:10007:fname mi lname

per the above output we are searching the...
basedn: dc=domain,dc=tld
and filtering for
[(&(uid=*)(objectclass=sambaSamAccount))]
---

All necessary attributes appear to be associated with all users. ldapsearch output:

# extended LDIF
#
# LDAPv3
# base <dc=domain,dc=tld> with scope subtree
# filter: (objectclass=*)
# requesting: ALL
#

# domain.tld
dn: dc=domain,dc=tld
o: domain.tld domain
zimbraDomainName: domain.tld
zimbraDomainStatus: active
zimbraId: e5cabe32-23fc-4a13-9169-f594592f5806
zimbraMailStatus: enabled
zimbraCreateTimestamp: 20101101064347Z
objectClass: dcObject
objectClass: organization
objectClass: zimbraDomain
objectClass: amavisAccount
zimbraDomainType: local
dc: domain
zimbraPrefTimeZoneId: (GMT-06.00) Central Time (US & Canada)

# people, domain.tld
dn: ou=people,dc=domain,dc=tld
ou: people
objectClass: organizationalRole
cn: people

# admin, people, domain.tld
dn: uid=admin,ou=people,dc=domain,dc=tld
zimbraMailTransport: lmtp:mail.domain.tld:7025
zimbraAccountStatus: active
zimbraAdminConsoleUIComponents: cartBlancheUI
zimbraMailDeliveryAddress: admin@domain.tld
sn: admin
userPassword:: e1NTSEF9R3ovbWpNNlFZRmV2M2xhaE1nQUwwbHhNNmNaY3BVdHc=
zimbraMailStatus: enabled
zimbraId: 3812ae70-dd0f-4cf0-9418-be333d5bef5e
zimbraCreateTimestamp: 20101101064425Z
zimbraIsAdminAccount: TRUE
mail: admin@domain.tld
mail: root@domain.tld
mail: postmaster@domain.tld
uid: admin
objectClass: organizationalPerson
objectClass: zimbraAccount
objectClass: amavisAccount
objectClass: posixAccount
objectClass: sambaSamAccount
zimbraPasswordModifiedTime: 20101101064425Z
cn: admin
zimbraMailHost: mail.domain.tld
zimbraMailAlias: root@domain.tld
zimbraMailAlias: postmaster@domain.tld
uidNumber: 10002
gidNumber: 10002
homeDirectory: /bin/false
loginShell: /sbin/nologin
sambaAcctFlags: [UX]
sambaDomainName: OFFICE
sambaSID: S-1-5-21-3888668672-2314038961-3016845176-21004

# postmaster, people, domain.tld
dn: uid=postmaster,ou=people,dc=domain,dc=tld
zimbraId: e0363424-064e-4ccf-89b0-c1f6d4d5ab0e
uid: postmaster
zimbraAliasTargetId: 3812ae70-dd0f-4cf0-9418-be333d5bef5e
zimbraCreateTimestamp: 20101101064445Z
objectClass: zimbraAlias

# wiki, people, domain.tld
dn: uid=wiki,ou=people,dc=domain,dc=tld
zimbraAttachmentsIndexingEnabled: FALSE
objectClass: organizationalPerson
objectClass: zimbraAccount
objectClass: amavisAccount
objectClass: posixAccount
objectClass: sambaSamAccount
userPassword:: e1NTSEF9SDJGU1FQek4yY1g4eUx6OE0wNWppWG5yOXVnWlIzTDk=
zimbraHideInGal: TRUE
zimbraId: 77ff0227-fc7e-4776-ad15-579971032146
zimbraMailStatus: enabled
zimbraIsSystemResource: TRUE
zimbraMailDeliveryAddress: wiki@domain.tld
uid: wiki
mail: wiki@domain.tld
zimbraAccountStatus: active
cn: wiki
zimbraMailQuota: 0
zimbraMailTransport: lmtp:mail.domain.tld:7025
amavisBypassSpamChecks: TRUE
zimbraMailHost: mail.domain.tld
zimbraPasswordModifiedTime: 20101101064504Z
description: Global Documents account
sn: wiki
zimbraCreateTimestamp: 20101101064504Z
zimbraFeatureNotebookEnabled: TRUE
uidNumber: 10003
gidNumber: 10002
homeDirectory: /bin/false
loginShell: /sbin/nologin
sambaAcctFlags: [UX]
sambaDomainName: OFFICE
sambaSID: S-1-5-21-3888668672-2314038961-3016845176-21006

# spam, people, domain.tld
dn: uid=spam,ou=people,dc=domain,dc=tld
zimbraAttachmentsIndexingEnabled: FALSE
objectClass: organizationalPerson
objectClass: zimbraAccount
objectClass: amavisAccount
objectClass: posixAccount
objectClass: sambaSamAccount
userPassword:: e1NTSEF9UDZrbEJRTFFjTEQ4WEJxSG1tV1pKZVBtYndOTjl2Yzg=
zimbraHideInGal: TRUE
zimbraId: 16e987fa-ee3f-4b4d-b45e-1ff7e9368b36
zimbraMailStatus: enabled
zimbraIsSystemResource: TRUE
zimbraMailDeliveryAddress: spam@domain.tld
uid: spam
mail: spam@domain.tld
zimbraAccountStatus: active
cn: spam
zimbraMailQuota: 0
zimbraMailTransport: lmtp:mail.domain.tld:7025
amavisBypassSpamChecks: TRUE
zimbraMailHost: mail.domain.tld
zimbraPasswordModifiedTime: 20101101064526Z
description: Spam training account
sn: spam
zimbraCreateTimestamp: 20101101064526Z
uidNumber: 10004
gidNumber: 10002
homeDirectory: /bin/false
loginShell: /sbin/nologin
sambaAcctFlags: [UX]
sambaDomainName: OFFICE
sambaSID: S-1-5-21-3888668672-2314038961-3016845176-21008

# ham, people, domain.tld
dn: uid=ham,ou=people,dc=domain,dc=tld
zimbraAttachmentsIndexingEnabled: FALSE
objectClass: organizationalPerson
objectClass: zimbraAccount
objectClass: amavisAccount
objectClass: posixAccount
objectClass: sambaSamAccount
userPassword:: e1NTSEF9T25GTVZzb0FScXhhZHhSQ2w0eU5mcGRuVmVBdjRqUHc=
zimbraHideInGal: TRUE
zimbraId: 5208e820-67a9-489f-a373-25ff0696db96
zimbraMailStatus: enabled
zimbraIsSystemResource: TRUE
zimbraMailDeliveryAddress: ham@domain.tld
uid: ham
mail: ham@domain.tld
zimbraAccountStatus: active
cn: ham
zimbraMailQuota: 0
zimbraMailTransport: lmtp:mail.domain.tld:7025
amavisBypassSpamChecks: TRUE
zimbraMailHost: mail.domain.tld
zimbraPasswordModifiedTime: 20101101064547Z
description: Spam training account
sn: ham
zimbraCreateTimestamp: 20101101064547Z
uidNumber: 10005
gidNumber: 10002
homeDirectory: /bin/false
loginShell: /sbin/nologin
sambaAcctFlags: [UX]
sambaDomainName: OFFICE
sambaSID: S-1-5-21-3888668672-2314038961-3016845176-21010

# OFFICE, domain.tld
dn: sambaDomainName=OFFICE,dc=domain,dc=tld
sambaDomainName: OFFICE
sambaSID: S-1-5-21-3888668672-2314038961-3016845176
sambaAlgorithmicRidBase: 1000
objectClass: sambaDomain
sambaNextUserRid: 1000
sambaMinPwdLength: 5
sambaPwdHistoryLength: 0
sambaLogonToChgPwd: 0
sambaMaxPwdAge: -1
sambaMinPwdAge: 0
sambaLockoutDuration: 30
sambaLockoutObservationWindow: 30
sambaLockoutThreshold: 0
sambaForceLogoff: -1
sambaRefuseMachinePwdChange: 0
sambaNextRid: 1001

# root, people, domain.tld
dn: uid=root,ou=people,dc=domain,dc=tld
uid: root
sambaSID: S-1-5-21-3888668672-2314038961-3016845176-1001
displayName: root
sambaNTPassword: 76D69788AEC77F6289FF48A940351B94
sambaPasswordHistory: 00000000000000000000000000000000000000000000000000000000
 00000000
sambaPwdLastSet: 1288596584
sambaAcctFlags: [U          ]
objectClass: sambaSamAccount
objectClass: account
sambaLogonScript: admins.vbs

# groups, domain.tld
dn: ou=groups,dc=domain,dc=tld
ou: groups
objectClass: organizationalUnit

# machines, domain.tld
dn: ou=machines,dc=domain,dc=tld
ou: machines
objectClass: organizationalUnit

# admins, groups, domain.tld
dn: cn=admins,ou=groups,dc=domain,dc=tld
displayName: Admins
description: Domain Admins
objectClass: posixGroup
objectClass: sambaGroupMapping
cn: admins
gidNumber: 10001
sambaGroupType: 2
sambaSID: S-1-5-21-3888668672-2314038961-3016845176-512
memberUid: 10007
memberUid: 10008
memberUid: 10009

# staff, groups, domain.tld
dn: cn=staff,ou=groups,dc=domain,dc=tld
displayName: Staff
description: Domain Users
objectClass: posixGroup
objectClass: sambaGroupMapping
cn: staff
gidNumber: 10002
sambaGroupType: 2
sambaSID: S-1-5-21-3888668672-2314038961-3016845176-513

# guests, groups, domain.tld
dn: cn=guests,ou=groups,dc=domain,dc=tld
description: Domain Guests
displayName: Guests
objectClass: posixGroup
objectClass: sambaGroupMapping
cn: guests
gidNumber: 10003
sambaGroupType: 2
sambaSID: S-1-5-21-3888668672-2314038961-3016845176-514

# nobody, people, domain.tld
dn: uid=nobody,ou=people,dc=domain,dc=tld
sambaDomainName: OFFICE
objectClass: organizationalPerson
objectClass: zimbraAccount
objectClass: amavisAccount
objectClass: posixAccount
objectClass: sambaSamAccount
userPassword:: e1NTSEF9bUxoRGRNY0NaZm92MnB2TDlCOG9Yd2tzcjN2a0xEKzc=
zimbraId: 3f5b7703-9da3-4229-8e10-d06f5c9552b0
zimbraMailStatus: disabled
zimbraMailDeliveryAddress: nobody@domain.tld
uid: nobody
mail: nobody@domain.tld
uidNumber: 10006
zimbraAccountStatus: closed
cn: nobody
zimbraMailTransport: lmtp:mail.domain.tld:7025
loginShell: /sbin/nologin
zimbraMailHost: mail.domain.tld
gidNumber: 10003
zimbraPasswordModifiedTime: 20101101073313Z
sambaSID: S-1-5-21-3888668672-2314038961-3016845176-21012
homeDirectory: /bin/false
sn: nobody
zimbraCreateTimestamp: 20101101073313Z

# thomas, people, domain.tld
dn: uid=thomas,ou=people,dc=domain,dc=tld
sambaDomainName: OFFICE
objectClass: organizationalPerson
objectClass: zimbraAccount
objectClass: amavisAccount
objectClass: posixAccount
objectClass: sambaSamAccount
userPassword:: e1NTSEF9dDFHZ2JZcmIwNmZVdHFlYVc4ZnVkeWhyYmFtL05vQ08=
zimbraId: 49386a0d-bfa4-47f7-9fb3-3ededee05ffb
zimbraMailStatus: enabled
zimbraMailDeliveryAddress: thomas@domain.tld
uid: thomas
mail: thomas@domain.tld
uidNumber: 10007
zimbraAccountStatus: active
cn: thomas
zimbraMailTransport: lmtp:mail.domain.tld:7025
loginShell: /bin/bash
zimbraMailHost: mail.domain.tld
gidNumber: 10001
zimbraPasswordModifiedTime: 20101101073325Z
sambaSID: S-1-5-21-3888668672-2314038961-3016845176-21014
homeDirectory: /export/homes/thomas
zimbraCreateTimestamp: 20101101073325Z
givenName: Todd
initials: E
sn: Thomas
displayName: Todd Thomas
description:
company:
street: 
l: 
st: IA
postalCode: 
co: 
telephoneNumber:
sambaAcctFlags: [HU]

# hgwells, people, domain.tld
dn: uid=hgwells,ou=people,dc=domain,dc=tld
sambaDomainName: OFFICE
objectClass: organizationalPerson
objectClass: zimbraAccount
objectClass: amavisAccount
objectClass: posixAccount
objectClass: sambaSamAccount
userPassword:: e1NTSEF9RHRuUFAySkMwQTZBUWhMRGlGWmpFbzBlSFFKbzhNUkc=
zimbraId: 81f1a78d-fa90-40fa-ba0b-d7e8f8c32b15
zimbraMailStatus: enabled
zimbraMailDeliveryAddress: hgwells@domain.tld
uid: hgwells
mail: hgwells@domain.tld
uidNumber: 10008
zimbraAccountStatus: active
cn: hgwells
zimbraMailTransport: lmtp:mail.domain.tld:7025
loginShell: /bin/bash
zimbraMailHost: mail.domain.tld
gidNumber: 10001
zimbraPasswordModifiedTime: 20101101073338Z
sambaSID: S-1-5-21-3888668672-2314038961-3016845176-21016
homeDirectory: /export/homes/hgwells
sn: hgwells
zimbraCreateTimestamp: 20101101073338Z

# hitman, people, domain.tld
dn: uid=hitman,ou=people,dc=domain,dc=tld
sambaDomainName: OFFICE
objectClass: organizationalPerson
objectClass: zimbraAccount
objectClass: amavisAccount
objectClass: posixAccount
objectClass: sambaSamAccount
userPassword:: e1NTSEF9N25Zc0JIcHhVaGx4ZmpJQ2ZGd21NOTNENVVKUllMRGg=
zimbraId: ffef9627-39a7-4597-8abf-8e7884a3f709
zimbraMailStatus: enabled
zimbraMailDeliveryAddress: hitman@domain.tld
uid: hitman
mail: hitman@domain.tld
uidNumber: 10009
zimbraAccountStatus: active
cn: hitman
zimbraMailTransport: lmtp:mail.domain.tld:7025
loginShell: /bin/bash
zimbraMailHost: mail.domain.tld
gidNumber: 10001
zimbraPasswordModifiedTime: 20101101073403Z
sambaSID: S-1-5-21-3888668672-2314038961-3016845176-21018
homeDirectory: /export/homes/hitman
sn: hitman
zimbraCreateTimestamp: 20101101073403Z

# user1, people, domain.tld
dn: uid=user1,ou=people,dc=domain,dc=tld
sambaDomainName: OFFICE
objectClass: organizationalPerson
objectClass: zimbraAccount
objectClass: amavisAccount
objectClass: posixAccount
objectClass: sambaSamAccount
userPassword:: e1NTSEF9M3oxczJ5eEs2dWJqQUNmRTZmU3pFVWJWNG0zVHJWU1k=
zimbraId: 1f381668-5a74-4b6a-952e-675ad26d6837
zimbraMailStatus: enabled
zimbraMailDeliveryAddress: user1@domain.tld
uid: user1
mail: user1@domain.tld
uidNumber: 10010
zimbraAccountStatus: active
cn: user1
zimbraMailTransport: lmtp:mail.domain.tld:7025
loginShell: /sbin/nologin
zimbraMailHost: mail.domain.tld
gidNumber: 10002
zimbraPasswordModifiedTime: 20101101073445Z
sambaSID: S-1-5-21-3888668672-2314038961-3016845176-21020
homeDirectory: /export/homes/user1
sn: user1
zimbraCreateTimestamp: 20101101073445Z

# user2, people, domain.tld
dn: uid=user2,ou=people,dc=domain,dc=tld
sambaDomainName: OFFICE
objectClass: organizationalPerson
objectClass: zimbraAccount
objectClass: amavisAccount
objectClass: posixAccount
objectClass: sambaSamAccount
userPassword:: e1NTSEF9M0pTQk56U2ZVeGFDamNUWnZFNC90cXNCNXBhUmxRc2E=
zimbraId: a7b86036-19bc-4b90-b934-ab29838751fc
zimbraMailStatus: enabled
zimbraMailDeliveryAddress: user2@domain.tld
uid: user2
mail: user2@domain.tld
uidNumber: 10011
zimbraAccountStatus: active
cn: user2
zimbraMailTransport: lmtp:mail.domain.tld:7025
loginShell: /sbin/nologin
zimbraMailHost: mail.domain.tld
gidNumber: 10002
zimbraPasswordModifiedTime: 20101101073513Z
sambaSID: S-1-5-21-3888668672-2314038961-3016845176-21022
homeDirectory: /export/homes/user2
sn: user2
zimbraCreateTimestamp: 20101101073513Z

# user3, people, domain.tld
dn: uid=user3,ou=people,dc=domain,dc=tld
sambaDomainName: OFFICE
objectClass: organizationalPerson
objectClass: zimbraAccount
objectClass: amavisAccount
objectClass: posixAccount
objectClass: sambaSamAccount
userPassword:: e1NTSEF9NjU2ZCtDVlU0dDEyb0NEMEJkYWdGQ0o5aTRyUzlOUkQ=
zimbraId: 17b4477e-1ce4-42ac-b540-4c3c432eec3f
zimbraMailStatus: enabled
zimbraMailDeliveryAddress: user3@domain.tld
uid: user3
mail: user3@domain.tld
uidNumber: 10012
zimbraAccountStatus: active
cn: user3
zimbraMailTransport: lmtp:mail.domain.tld:7025
loginShell: /sbin/nologin
zimbraMailHost: mail.domain.tld
gidNumber: 10002
zimbraPasswordModifiedTime: 20101101073536Z
sambaSID: S-1-5-21-3888668672-2314038961-3016845176-21024
homeDirectory: /export/homes/user3
sn: user3
zimbraCreateTimestamp: 20101101073536Z

# search result
search: 2
result: 0 Success

# numResponses: 22
# numEntries: 21

Since I do a lot of testing I don't like to build these accounts over and over again. This is the snippet of code used to build lname, hgwells, and hitman. To make it thoroughly confusing, you can see these 3 accounts are built at the same time with the same attributes:

ADMINUSERS="lname hgwells hitman"
for user in ${ADMINUSERS}
do
        NEXTUID=$((NEXTUID+1))
        USERRID=$((2*(NEXTUID)+1000))
        SambaSID="${LOCALSID}-${USERRID}"

        GROUP_ROOT=`getent group | grep root: | cut -d":" -f3`

        su - zimbra -c "zmprov ca ${user}@${DOMAIN} ${user} uidNumber ${NEXTUID} gidNumber ${GROUP_ADMINS} homeDirectory /export/homes/${user} sambaSID ${SambaSID} zimbraAccountStatus active sambaDomainName ${SAMBADOMAIN} loginShell /bin/bash"
        check_errs $? "zmprov ca ${user} failed"

        ### verify
        su - zimbra -c "zmaccts | grep "${user}@${DOMAIN}""
        check_errs $? "zmaccts failed to display ${user}@${DOMAIN}"

        ### Add admin account with smbpasswd:
#       (echo ${user}; echo ${user}) | smbpasswd -as ${user}
#       check_errs $? "smbpasswd -as ${user} failed"
done

And that's where I am - thoroughly confused. If anyone can shed some light on this odd behavior I'd be appreciative.

[todd_dsm]

I found this a few days after posting...

When creating new accounts in zimbra, intended for samba interaction, the Samba SAM Account Control Block Flags must be set during user creation:

Creating the Samba Guest User:
zmprov ca nobody@${DOMAIN} ${NOBODYPASSWD} uidNumber ${NEXTUID} gidNumber ${GROUP_GUEST} homeDirectory /bin/false loginShell /sbin/nologin sambaSID ${SambaSID} zimbraAccountStatus closed sambaDomainName ${SAMBADOMAIN} sambaAcctFlags [DUX]

Creating a domain user:
zmprov ca user1@${DOMAIN} ${TESTUSERPASSWD} uidNumber ${NEXTUID} gidNumber ${GROUP_STAFF} homeDirectory /export/homes/${user} sambaSID ${SambaSID} zimbraAccountStatus active sambaDomainName ${SAMBADOMAIN} loginShell /sbin/nologin sambaAcctFlags [HU]

Modifying an existing account:
zmprov ma admin@${DOMAIN} +objectClass posixAccount uidNumber ${NEXTUID} gidNumber ${GROUP_ADMINS} homeDirectory /export/homes/${user} loginShell /bin/bash

then...
zmprov ma admin@${DOMAIN} +objectClass sambaSamAccount sambaDomainName ${SAMBADOMAIN} sambaSID ${SambaSID} sambaAcctFlags [HUX]

When creating a guest account for Samba it was necessary to set the sambaAcctFlags. Now they can be dredged with the pdbedit tool:

$ pdbedit -L admin
smbldap_search_domain_info: Searching for:[(&(objectClass=sambaDomain)(sambaDomainName=OFFICE ))]
smbldap_open_connection: connection opened
ldap_connect_system: successful connection to the LDAP server
smbldap_search_domain_info: Searching for:[(&(objectClass=sambaDomain)(sambaDomainName=OFFICE ))]
smbldap_open_connection: connection opened
ldap_connect_system: successful connection to the LDAP server
init_sam_from_ldap: Entry found for user: admin
admin:10002:admin
$ pdbedit -L nobody
smbldap_search_domain_info: Searching for:[(&(objectClass=sambaDomain)(sambaDomainName=OFFICE ))]
smbldap_open_connection: connection opened
ldap_connect_system: successful connection to the LDAP server
smbldap_search_domain_info: Searching for:[(&(objectClass=sambaDomain)(sambaDomainName=OFFICE ))]
smbldap_open_connection: connection opened
ldap_connect_system: successful connection to the LDAP server
init_sam_from_ldap: Entry found for user: nobody
nobody:99:nobody
$ pdbedit -L user1
smbldap_search_domain_info: Searching for:[(&(objectClass=sambaDomain)(sambaDomainName=OFFICE ))]
smbldap_open_connection: connection opened
ldap_connect_system: successful connection to the LDAP server
smbldap_search_domain_info: Searching for:[(&(objectClass=sambaDomain)(sambaDomainName=OFFICE ))]
smbldap_open_connection: connection opened
ldap_connect_system: successful connection to the LDAP server
init_sam_from_ldap: Entry found for user: user1
user1:10010:user1