Linux – Limiting UID range for new local user accounts

I have the exact same issue and found out what the problem is: the problem is that nfsv4 uses idmapd and idmapd does mapping between userid => names but not the other way around. In other words, it can't work. It is just fancy and confusing to see the correct permissions user and group, however when you use the filesystem it will still use the old way of mapping through uid. So the uid on the server side should be the same as on the client side for that user. Otherwhise creating files, ... will fail with permission denied. Unless the uid match of course.

reference: http://thread.gmane.org/gmane.linux.nfsv4/7103/focus=7105

I've got a /etc/pam.d/system-auth that was setup with local users to authenticate first, and then fall back to kerberos (pam_krb5.so). I'll provide it here with pam_krb5.so replaced with pam_winbind.so to give you something to start with. This was cobbled together a couple years ago, and as I recall took a bit of refining to get it to work right for us.

account     required      pam_unix.so broken_shadow
account     sufficient    pam_localuser.so
account     sufficient    pam_succeed_if.so uid < 500 quiet
account     [authinfo_unavail=ignore default=bad success=ok user_unknown=ignore] pam_winbind.so
account     required      pam_permit.so


password    requisite     pam_cracklib.so try_first_pass retry=3
password    sufficient    pam_unix.so md5 shadow nullok try_first_pass use_authtok
password    sufficient    pam_winbind.so use_authtok
password    required      pam_deny.so

session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
session     optional      pam_mkhomedir.so umask=0077
session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session     required      pam_unix.so
session     optional      pam_winbind.so