[ Impact ] to be provided based on the communication above [ Test Plan ] The test case for this bug requires a quite complex test environment. The objective is to reuse the test setup for bug #1934997 as much as possible. We can reuse one VM from bug #1934997 running a Samba Active Directory Domain Controller (AD DC), which will be our main server that holds the autofs maps. This needs only to be configured once. We then need to setup two privileged containers, which will join our AD domain using realmd and SSSD or Winbind. One container will act as autofs client, which wants to mount a file share from the second container that acts as NAS. The use of privileged containers is not strictly mandatory for this test plan. LDAP SASL authentication binds and autofs map retrieval work also using unprivileged containers. But in order to demonstrate that autofs mounts really work correctly NFS is required, which only works in privileged containers. For the autofs client we will use Winbind instead of SSSD to serve domain user logins. The reason for this is that SSSD provides its own autofs client and we want to avoid a mix and match of both implementations. == Virtual Network setup == The first step is to create a dedicated virtual network for our tests. This is not strictly mandatory, but it will simplify things. The best way to create this network is via virt-manager. Install it if needed, open the program and select the "QEMU/KVM" line. Go to Edit > Connection Details > Virtual Networks, click on the "+" icon (bottom left), give this network a name, make sure that "Enable IPv4" and "Enable DHCPv4" are selected (under "IPv4 configuration"). Go to "DNS domain name" and select "Custom". For the domain name, type "test.lan". Click on "Finish". Take note of the "Device" name that shows up after you create the network. We will use it when creating the containers. For this test plan, let's assume the device name is "virbr1". == Samba AD DC VM setup == We need to setup a Samba AD DC server. It doesn't matter which Ubuntu release we use for it. Note that we have to use "-n virbr1" when creating the VM, otherwise it won't use our virtual network. $ lxc launch ubuntu-daily:jammy sambadc -n virbr1 --vm $ lxc shell sambadc server# apt update server# ip a Make sure to grab this VM's IP address. server# cat >> /etc/hosts << _EOF_ IP_ADDRESS_HERE sambadc sambadc.test.lan _EOF_ server# reboot $ lxc shell sambadc server# apt install -y samba winbind server# mv /etc/samba/smb.conf /etc/samba/smb.conf.bkp server# samba-tool domain provision --use-rfc2307 --realm TEST.LAN --domain TEST --server-role dc --dns-backend SAMBA_INTERNAL --adminpass MyPassword1 server# systemctl mask smbd.service nmbd.service winbind.service server# systemctl disable --now smbd.service nmbd.service winbind.service server# systemctl unmask samba-ad-dc.service server# systemctl enable --now samba-ad-dc.service We now have to adjust the DNS server settings of the server. We are going to disable systemd-resolved.service and use samba as our DNS service. You will notice that the samba-tool command issued above has added 127.0.0.53 as the "dns forwarder" in /etc/samba/smb.conf. Edit the file and set the forwarder to be the virtual network's DNS resolver -- it should be the same as IP_ADDRESS_HERE, but ending in .1. server# systemctl disable --now systemd-resolved.service server# unlink /etc/resolv.conf server# cat > /etc/resolv.conf << _EOF_ nameserver IP_ADDRESS_HERE search test.lan _EOF_ server# reboot This should be enough to configure Samba as an AD DC. While at it, create a test user that will later be used to trigger the bug. As our domain TEST.LAN consists of Winbind and SSSD clients we need to ensure that users have the same UID/GID on both clients. This can be achieved in small domains by configuring the main Unix attributes for each user. $ lxc shell sambadc server# samba-tool user create testuser MyUserPassword1 server# samba-tool user addunixattrs testuser 1103 --gid=513 --login-shell=/bin/bash --unix-home=/home/testuser@TEST server# samba-tool group addunixattrs domain\ users 513 == Autofs client setup == Let's configure a privileged container to act as an autofs client. $ lxc launch ubuntu-daily:jammy autofsclient -n virbr1 -c security.privileged=true -c raw.apparmor="mount fstype=nfs4, mount fstype=nfs, mount fstype=autofs," $ lxc shell autofsclient Before anything else, let's configure this container to use the Samba AD DC VM as its DNS resolver. In the excerpt below, IP_ADDRESS_HERE refers to the IP address of the Samba AD DC VM (configured in the last section). client# systemctl disable --now systemd-resolved.service client# unlink /etc/resolv.conf client# cat > /etc/resolv.conf << _EOF_ nameserver IP_ADDRESS_HERE search test.lan _EOF_ client# apt update client# apt install -y realmd libnss-winbind winbind libpam-winbind samba-common-bin nfs-common client# pam-auth-update --enable mkhomedir We need to tell NSS that winbind will be used for communication with Samba AD DC and that this client wants to automatically mount shares using autofs. For this purpose we need to adapt /etc/nsswitch.conf as follows: client# vi /etc/nsswitch.conf passwd: files winbind systemd group: files winbind systemd shadow: files gshadow: files hosts: files dns networks: files protocols: db files services: db files ethers: db files rpc: db files netgroup: nis automount: ldap We can now check if our container can detect the AD DC: client# realm -v discover sambadc.test.lan * Resolving: _ldap._tcp.sambadc.test.lan * Resolving: sambadc.test.lan * Performing LDAP DSE lookup on: 192.168.101.142 * Successfully discovered: test.lan test.lan type: kerberos realm-name: TEST.LAN domain-name: test.lan configured: no server-software: active-directory client-software: sssd required-package: sssd-tools required-package: sssd required-package: libnss-sss required-package: libpam-sss required-package: adcli required-package: samba-common-bin You can also confirm that the "realm -v discover" works on the domain name: client# realm -v discover test.lan * Resolving: _ldap._tcp.test.lan * Performing LDAP DSE lookup on: 192.168.101.142 * Successfully discovered: test.lan test.lan type: kerberos realm-name: TEST.LAN domain-name: test.lan configured: no server-software: active-directory client-software: sssd required-package: sssd-tools required-package: sssd required-package: libnss-sss required-package: libpam-sss required-package: adcli required-package: samba-common-bin For autofs testing we do not want to follow realm's recommendation and rely on SSSD, which provides its own autofs client. In addition, all domain members shall use the same Unix attributes for users, as specified in AD. Therefore, join domain using following command: client# realm -v --client-software=winbind --automatic-id-mapping=no join test.lan You will be prompted the password for the Administrator user. It is MyPassword1. If everything worked OK, you should now be able to list the information from our test user: client# getent passwd