CIFS ACLs on ZFS Problem

Recently had an issue with a CIFS share on a Solaris 11 box. Still not sure how this happened but it turned out there was a weird Idmap mapping. Active Directory Group and members were correct and group had correct members. Yet still the users in this group could not write to the folder.

How to check identities in idmap:

1
# idmap show -cv rrosso@domain.com
2
winuser:rrosso@domain.com -> <span style="color: #0000ff;">uid:2147483651</span>
3
Source: Cache
4
Method: Ephemeral
5

6
# idmap show -cv DFS_Corp-CA-Dept-IT_rw@domain.com
7
wingroup:DFS_Corp-CA-Dept-IT_rw@domain.com -> <span style="color: #0000ff;">gid:2147483667</span>
8
Source: Cache
9
Method: Ephemeral

Lets just see how the mapping rules look:

1
# idmap list
2
add     winuser:*@domain.com  unixuser:*
3
add     wingroup:*@domain.com unixgroup:*
4
add     winuser:administrator@domain.com      unixuser:root
5
add     "wingroup:Domain Users@domain.com"    unixgroup:smbusers

The Active Directory Read-Write group that is not allowing the members to write to the folder:

1
# idmap show -cv DFS_Eng-CA-Dirs-Engineering-Bugzilla_rw@domain.com
2
wingroup:DFS_Eng-CA-Dirs-Engineering-Bugzilla_rw@domain.com -> <span style="color: #0000ff;">gid:2147484149</span>
3
Source: Cache
4
Method: Ephemeral

Looking at the folder called Bugzilla:
Current (broken) acl must be this one user:2147483813 if I look at the gid above. Not to mention the mapping is not for a group but for a user.

1
root@zfs001:/tank/dfs/engdirs/engineering/engineering# /bin/ls -v | more
2
d---------+ 16 2147483650 smbusers      17 Oct 12 14:14 Bugzilla
3
0:<strong><span style="color: #ff0000;">user:2147483813</span></strong>:list_directory/read_data/add_file/write_data
4
/add_subdirectory/append_data/read_xattr/write_xattr/execute
5
/read_attributes/write_attributes/delete/read_acl/synchronize
6
:file_inherit/dir_inherit:allow
7
1:<strong><span style="color: #008000;">group:2147483763</span></strong>:list_directory/read_data/add_file/write_data
8
/add_subdirectory/append_data/read_xattr/write_xattr/execute
9
/delete_child/read_attributes/write_attributes/delete/read_acl
10
/synchronize:file_inherit/dir_inherit:allow
11
2:<strong><span style="color: #008000;">group:2147483660</span></strong>:list_directory/read_data/read_xattr/execute
12
/read_attributes/read_acl/synchronize:file_inherit/dir_inherit
13
:allow

Looking at above something looks odd. Looking at the windows side we expect three groups to have permission here but spot the “user” listed in the first ACL.

Lets find the three id”s. Left the grep wide open to find all uid and gid matching the number. But really we are just after the gid”s:

1
# idmap dump -n | grep 2147483813
2
wingroup:Guests@BUILTIN ==      <strong><span style="color: #ff0000;">gid:2147483813</span></strong>
3
wingroup:DFS_Eng-CA-Dirs-Engineering-Bugzilla_rw@domain.com   ==      <strong><span style="color: #ff0000;">uid:2147483813</span></strong>
4

5
# idmap dump -n | grep 2147483763
6
winuser:Homey@domain.com     ==      uid:2147483763
7
wingroup:DFS_Eng-CA-Dirs-Engineering_rw@domain.com    ==      <strong><span style="color: #008000;">gid:2147483763</span></strong>
8

9
# idmap dump -n | grep 2147483660
10
winuser:Stewey@domain.com     ==      uid:2147483660
11
wingroup:DFS_Eng-CA-Dirs-Engineering_ro@domain.com    ==      <strong><span style="color: #008000;">gid:2147483660</span></strong>
12

13
# idmap dump -n | grep 2147484149
14
wingroup:DFS_Eng-CA-Dirs-Engineering-Bugzilla_rw@domain.com   ==      <strong><span style="color: #ff0000;">gid:2147484149</span></strong>

After we removed and recreated the group in AD. Might take a little bit to show up:

1
# idmap show -cv DFS_Eng-CA-Dirs-Engineering-Bugzilla_rw@domain.com
2
wingroup:DFS_Eng-CA-Dirs-Engineering-Bugzilla_rw@domain.com -> gid:2147484149
3
Source: Cache
4
Method: Ephemeral
5

6
# idmap dump -n | grep 2147483813
7
wingroup:Guests@BUILTIN ==      gid:2147483813
8
usid:S-1-5-21-1977730361-3076317898-4166923938-22371    ==      uid:2147483813
9

10
# idmap dump -n | grep 147484149
11
wingroup:DFS_Eng-CA-Dirs-Engineering-Bugzilla_rw@domain.com   ==      gid:2147484149

Permissions after re-applying from Windows:

1
# /bin/ls -dv Bugzilla/
2
d---------+ 17 2147483650 smbusers      18 Nov 12 20:12 Bugzilla/
3
     0:<strong><span style="color: #008000;">group:2147483763</span></strong>:list_directory/read_data/add_file/write_data
4
         /add_subdirectory/append_data/read_xattr/write_xattr/execute
5
         /delete_child/read_attributes/write_attributes/delete/read_acl
6
         /synchronize:file_inherit/dir_inherit:allow
7
     1:<strong><span style="color: #008000;">group:2147483660</span></strong>:list_directory/read_data/read_xattr/execute
8
         /read_attributes/read_acl/synchronize:file_inherit/dir_inherit
9
         :allow
10
     2:<strong><span style="color: #008000;">group:2147484149</span></strong>:list_directory/read_data/add_file/write_data
11
         /add_subdirectory/append_data/read_xattr/write_xattr/execute
12
         /read_attributes/write_attributes/delete/read_acl/synchronize
13
         :file_inherit/dir_inherit:allow

Just checking a new file we just created for good measure:

1
# /bin/ls -v | grep Test
2
d---------+  2 2147483740 smbusers       2 Nov 12 20:12 Test