Active Directory – New Custom Home Directory Path Not Recognized

active-directorysamba

The goal is to have a custom home directory, as we need to migrate from /home, to a new volume, /people.

I've created a new test user, bilbo, yet the winbind service keeps assuming their home is at /home/bilbo instead of at /people/bilbo.

I am suspecting that Samba is not even reading the user's home directory path from Active Directory, as the results seem to indicate as such. Is there an smb.conf flag for that?

Steps taken to add new user, with a custom home directory path:

Create new user in AD, 
    with extensions, used home directory path of "/people/bilbo"

AD screenshot

On CentOS 7 host, 
    I manually created /people/bilbo and contents, 
    and tagged all files/directories with proper permissions.

However, upon initial login, the system created a new "/home/bilbo" instead of using the existing path!

What else I've tried:

Restart smb and winbind, and flushed cache (deleting *.tdb's too) - no good.
Modified the local smb.conf, removing "template homedir = /home/%U" and restarted smb and winbind.
- it then created a new one in /home/DEVELOPMENT/bilbo upon login, and did not attempt to look in /people at all.

Contents of smb.conf:

[global]
security = ADS
workgroup = DEVELOPMENT
realm = DEVELOPMENT.mycompany.com
client use spnego = yes
server signing = auto
server string = Samba Client
winbind nss info = rfc2307
winbind enum users = yes
winbind enum groups = yes
winbind use default domain = yes
winbind separator = +
winbind refresh tickets = yes
winbind offline logon = yes
inherit acls = yes

idmap config * : backend = tdb
idmap config * : range = 10000-20000

template homedir = /home/%U
force group = dev
template shell = /bin/bash

Any suggestions, recommendations?

Best Answer

I found the cause:

I was using pre-4.6.0 settings when using a newer version of samba.
I reworked the smb.conf to allow for some local IDs and a larger AD space, as well as correct my RFC2307 data collection from Windows Active Directory.

##### New smb.conf file #####

    password server = windowsADserver.development.mycompany.com
    passdb backend = tdbsam

# idmap config for local BUILTIN accounts and groups
    idmap config * : backend = tdb
    idmap config * : range = 3000-7999

# idmap config for the DEVELOPMENT domain
    idmap config DEVELOPMENT:backend = ad           <<---- Need AD backend
    idmap config DEVELOPMENT:schema_mode = rfc2307  <<---- plus this one
    idmap config DEVELOPMENT:unix_nss_info = yes    <<---- and this one
    idmap config DEVELOPMENT:range = 10000-40000
    idmap config DEVELOPMENT:unix_primary_group = yes

    template shell = /bin/bash
    template homedir = /home/%U

    winbind use default domain = true
    winbind offline logon = false
    winbind enum users = yes
    winbind enum groups = yes
    encrypt passwords = yes
    log file = /var/log/samba/log.%m
    max log size = 50
    kerberos method = system keytab
    log level = 10

[homes]
    comment = Home Directories
    valid users = %S, %D%w%S
    browseable = No
    read only = No
    inherit acls = Yes
Related Topic