SIDs cannot be resolved into names

[bolduant]

Hi,
I've tested the samba in containers thing a lot and I got a strange issue every time.
When using sink within ceph and use the AD method the security tab in my windows client file/folder properties only sees SIDs instead of names.
As far as I know the client uses rpc calls to resolve that, so I simulated that situation with rpcclient from within the samba container.

The short version:
[root@sink1]# rpcclient sc-cph-jen-cifs -U 'GROUP\toni.bolduan' -c 'lookupsids S-1-5-21-9581874-891650608-2337158460-142756'

returns a:
S-1-5-21-9581874-891650608-2337158460-142756 *unknown*\*unknown* (8)

The long version can be found here: rpcclient.txt

I do not know what is wrong here. A standalone samba server or ctdb cluster does not have this problem. Only the sink/samba-container or smb in ceph have this problem.

Have you seen this error before?

[phlogistonjohn]

Thanks for reporting the issue. This is a new one to me. Thanks for already doing a bunch of debugging!

Can you also please share what samba server container tag and hash (just in case it matters)?
Can you also please share what AD version and OS you are testing with? Thanks.

[bolduant]

Thank you for answering :)

Tested it with container tag 0.5, 0.6, 0.7 and latest.
The used AD version is Domain Functional Level 2016 / Forest Functional Level 2016 and the OS were Windows Server Datacenter Edition 2019, 2022 & 2025.

Hope it helps & Thank you.

[b1knoll]

Hello John,

yes, same here. We deployed a new Tentacle cluster with a Win AD. Same result using rpcclient or even smbcacls in the command line. SIDs cannot be resolved.

However if we run rpcclient against a User name aka:

rpcclient ad-host -c "lookupnames user.name"

then for just a minute the command like this:

rpcclient ad-host -U 'group\user.name' -c 'lookupsids S....'

gives the correct names and groups. smbcacls, too.

Everything else works flawlessly.

Best,
Marc