Doesn't update /etc/nsswitch.conf when using winbind

[Andreas Hasenack]

realmd is not updating /etc/nsswitch.conf with "winbind" when using --client-software=winbind to join an AD domain.

This is configurable per distro, and the debian configuration doesn't specify a method to do this:

service/realmd-debian.conf:
[commands]

# Various pam and nss plugins are automatically configured when
# installed on debian. So just stub them out.

winbind-enable-logins =
winbind-disable-logins =
sssd-enable-logins =
sssd-disable-logins =

For the sssd case, it's correct to remain empty because the sssd packages themselves (libnss-sss specifically) update /etc/nsswitch.conf upon installation. But libnss-winbind doesn't.

One could argue that it's libnss-winbind that should update /etc/nsswitch.conf upon installation, in which case this bug should be against that package. That would be better solved on the debian side first.

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Andreas Hasenack (ahasenack)]

This was fixed in debians samba package 4.17.3-3[1], by having the libnss-winbind postinst handle /etc/nsswitch.conf:

if [ "$1" = configure ] && [ -z "$2" ]; then
    echo "First installation detected, adding winbind to /etc/nsswitch.conf..."
    if ! [ -e /etc/nsswitch.conf ]; then
        echo "Could not find /etc/nsswitch.conf."
    else
        sed -r -i \
          -e '/^(passwd|group):.*[[:space:]]winbind\b/b' \
          -e 's/^(passwd|group):.*/& winbind/' \
          /etc/nsswitch.conf
    fi
fi

This change is available in lunar and later.
1. https://launchpad.net/debian/+source/samba/2:4.17.3+dfsg-3
2. https://git.launchpad.net/ubuntu/+source/samba/tree/debian/libnss-winbind.postinst?h=import/2%254.17.3%2bdfsg-3

[Andreas Hasenack (ahasenack)]

Would be good to have this fixed in jammy as well, so I added a jammy task to the bug.