setting acl on AD users

[Maaz]

I have a samba server(as a MS Windows AD member server).
can I grant/set permissions on users/group of AD on shared folders stored on samba server.

in other words, on a samba server that has joined AD domain, I want to assign permissions on users of AD on directories on samba server.

Regards
Maaz

[Court Campbell]

Yes you can.

[Maaz]

Hi Court Campbell
>Yes you can.
:), thanks but if you can also please guide how to do this ?
any url/doc/tutorial ?

Regards

[Ivan Ferreira]

To be able to set permissions to files and folders, you must map the UID/GID to Windows SIDS. For this job, probably, winbind is the way to go.

[Court Campbell]

Well, I assume that you are using winbind. If so and all is working, you just use the chown or chgrp commands. I just assume you are already familiar with those commands.

[Maaz]

Hi Ivan Ferreira and Court Campbell, thanks for help.
I dont know about winbind, because this SAMBA server is SLES 10, SLES 10 can join AD Domain, using 3 or 4 mouse clicks, very smoothly and without any issue.

Anyhow I'll check it

Thanks

[Gokul Chandola]

Hi,
You can do this.
You have to define AD users in Samba Server for desired directories also.

Regards,
Gokul Chandola

[Maaz]

Hi thanks Gokul Chandola
>You have to define AD users in Samba Server for desired directories also.

say I have a user maaz in MS AD Domain, then what to do in smb.conf ? please share.

cat /etc/samba/smb.conf
[data]
path = /data
read only = No

I want to set permission for maaz(domain user), and to all those users that are member of "grad1" group of MS AD domain on /data directroy

[Ivan Ferreira]

It depends of the "security = " samba setting. Check the Samba 3 Howto for detailed information about this setting or smb.conf.

Then you will have:

cat /etc/samba/smb.conf
[data]
path = /data
read only = No
valid users = maaz @grad1

Considering that grad1 is a Unix/LDAP group.