cifs_idmap_sss.so as idmap-plugin for smb access

[Alexander Fieroch]

If no winbind is used as ID/Auth provider the idmap-plugin should not be linked against idmapwb.so.
The manpage for idmapwb.so says:

"This plugin requires that winbindd(8) be properly configured and running."

This is not the case if SSSD instead of winbind is used for authentication in an Active Directory.

RedHat says:
--------------------
4.2.4. Switching Between SSSD and Winbind for SMB Share Access
This procedure describes how you can switch between SSSD and Winbind plug-ins that are used for accessing SMB shares from SSSD clients.

    Optional. Find out whether you are currently using SSSD or Winbind to access SMB shares from the SSSD client:

    # alternatives --display cifs-idmap-plugin
    cifs-idmap-plugin - status is auto.
     link currently points to /usr/lib/cifs-utils/cifs_idmap_sss.so
    /usr/lib/cifs-utils/cifs_idmap_sss.so - priority 20
    /usr/lib/cifs-utils/idmapwb.so - priority 10
    Current `best' version is /usr/lib/cifs-utils/cifs_idmap_sss.so.

    If the SSSD plug-in (cifs_idmap_sss.so) is installed, it has a higher priority than the Winbind plug-in (idmapwb.so) by default.
    Before switching to the Winbind plug-in, make sure Winbind is running on the system:

    # systemctl is-active winbind.service
    active

    Before switching to the SSSD plug-in, make sure SSSD is running on the system:

    # systemctl is-active sssd.service
    active

    To switch to a different plug-in, use the alternatives --set cifs-idmap-plugin command, and specify the path to the required plug-in. For example, to switch to Winbind:

    # alternatives --set cifs-idmap-plugin /usr/lib/cifs-utils/idmapwb.so

--------------------
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/windows_integration_guide/smb-sssd
--------------------

Although /usr/lib/x86_64-linux-gnu/cifs-utils/cifs_idmap_sss.so is installed
  update-alternatives --config idmap-plugin
does not list cifs_idmap_sss.so.

[Torsten Nielsen (torstenn)]

The cifs_idmap_sss.so is part of sssd-common
https://packages.ubuntu.com/bionic/amd64/sssd-common/filelist

I added it with priority of 50 (new default/auto):
$ sudo update-alternatives --install /etc/cifs-utils/idmap-plugin idmap-plugin /usr/lib/x86_64-linux-gnu/cifs-utils/cifs_idmap_sss.so 50 --slave /etc/cifs-utils//idmap-plugin.8.gz idmap-plugin.8.gz /usr/share/man/man8/idmap_sss.8.gz

$ sudo update-alternatives --query idmap-plugin
Name: idmap-plugin
Link: /etc/cifs-utils/idmap-plugin
Slaves:
 idmap-plugin.8.gz /etc/cifs-utils//idmap-plugin.8.gz
Status: auto
Best: /usr/lib/x86_64-linux-gnu/cifs-utils/cifs_idmap_sss.so
Value: /usr/lib/x86_64-linux-gnu/cifs-utils/cifs_idmap_sss.so

Alternative: /usr/lib/x86_64-linux-gnu/cifs-utils/cifs_idmap_sss.so
Priority: 50
Slaves:
 idmap-plugin.8.gz /usr/share/man/man8/idmap_sss.8.gz

Alternative: /usr/lib/x86_64-linux-gnu/cifs-utils/idmapwb.so
Priority: 40
Slaves:
 idmap-plugin.8.gz /usr/share/man/man8/idmapwb.8.gz

NB Not sure if the man page should be updated like this - prob. not!

[Alexander Fieroch (fieroch)]

I installed a new system with 20.04 and sssd-common.
Unfortunately the alternative for idmap-plugin from sssd is still not available by update-alternatives:

# update-alternatives --config idmap-plugin
There is only one alternative in link group idmap-plugin (providing /etc/cifs-utils/idmap-plugin): /usr/lib/x86_64-linux-gnu/cifs-utils/idmapwb.so
Nothing to configure.

I had to sym-link it manually:

rm /etc/alternatives/idmap-plugin
ln -s /usr/lib/x86_64-linux-gnu/cifs-utils/cifs_idmap_sss.so /etc/alternatives/idmap-plugin