Home / server / Questions / 260966
Accepted
blsub6
Asked: 2011-04-19 09:05:10 +0800 CST

Alias for AD account?

  • 772

I've got a Linux file server set up by the previous IT department with permissions set up to allow Jane to access a certain folder with the username "jane"

My new AD domain that I put in has everyone's username set as first initial, last name so her username in the domain is "jdoe"

For reasons I don't want to go into here, I can't just add "jdoe" as a user on the file server

Can I set her SamAccountName to "jane" and keep her User UPN Logon as "jdoe"? Will that work to let her into the Linux file share?

windows linux active-directory samba file-server

1 Answers

  1. Best Answer

    Samba has a username map config option that you can use to specify a list of remote usernames that will be transparently mapped to a different local user name.

    The format for this in /etc/smb/samba.conf would be something like this:

    [share]
    ...normal share optionsoptions
    username map = /path/to/file
    users = jane bob fred ... etc

    And the contents of /path/to/file should be:

    jane = jdoe

    You can add more lines to this file, including quoted usernames with spaces, references to whole groups, etc. See documentation link above for more details.

    My original answer is a bit of a hack, but for reference here's the deal on forced users. You can add a user to the samba password file using smbpasswd -a without adding them as a unix system user. Then you can authenticate those users on the samba share. You do not have to add them to the unix system password list in order for this to work, but since their users don't exist they will not particularly be able to make use of the share because the unix privaledge system will keep them from writing etc. To fix this, there is a "force user" option that you can add to any share and all actions taken by any authenticated user on that share will be executed using that unix system user. So if you create a share for everybody, then create a duplicate share just for jdoe and add force user = jane to that share, even when jdoe authenticates they will read/write files on the system using jane's unix user.

    • 1