sambaXP 2024: Winbind varlink service? What is it and what is it for?
Talk by Samuel Cabrero (SUSE)
Abstract:
When samba is joined to a domain, the domain users and groups are available in the local system so one can for example set a file owner to an AD user. This mechanism works thanks to the Name Service Switch (NSS), the mechanism used to retrieve user information from different services, each one providing a pluggable module in the form of a dynamic loadable library. Samba provides the nss_winbind.so module, which uses libwbclient to talk to Winbind daemon, to resolve user and group information from a Windows Domain.
This just works fine for traditional servers, but the world is moving to containerized workloads and this presents new challenges for Samba. What happens for example if we want to run winbindd in a container and smbd in another one? Or if we want to run winbindd in a container but have AD users available on the host? Do we need to install nss_winbind.so and libwbclient everywhere?
This talk presents the systemd's User and Group lookup API and the implementation of the io.systemd.UserDatabase interface in winbind, which provides user and group name resolution through nss_systemd as an alternative to nss_winbind. There is also a demo to show how it can help in the exposed scenario.
Slides: https://sambaxp.org/fileadmin/user_up...
Visit the conference website at: https://sambaxp.org