Samba as AD member: "force user" confused by identical local & domain user names

Question

I am running Samba 4.9.1 on RHEL7, joined to a Win AD domain. In one share, I set

force user = foo

, hoping to force the local user foo. However, the same user name also exists in the AD, and Samba actually uses the AD user e.g. upon file creation.

getent passwd foo

returns the local user, as expected, since /etc/nsswitch.conf reads

passwd: files winbind
group: files winbind

Obviously, I set the option

winbind use default domain = yes

in smb.conf, and I would prefer not to change that, since I am not sure how many things I would need to change elsewhere then...

Any hints how to force Samba to look for local users first?

Regards, Eric

Answer 1

Well, as Worthweile asked for it, I will post my workaround as an answer.

1. Remove "force user" directive from share definition. This will make newly created files owned by the currently authenticated share user and his/her primary group.
2. If necessary, e.g. on ext2/3 file systems, enable ACLs via mount options. In my case (xfs), ACLs are always available by default.
3. setfactl -R -m u:foo:rwX <share_dir> setfactl -R -d -m u:foo:rwX <share_dir>

The first command will grant user foo read, write and execute permissions to all files and directories within the share. The capital X will set execute permissions only if it is a directory or someone else already has execute permission, as stated in man setfactl.

The second one will add the same permission as default for new files within the share.

Probably, Samba's force user option is in most cases actually a workaround for insufficient priviledge management, so this should be the cleanest way (the Linux equivalent to 'pythonic', maybe?). However, there will probably still be situations where ACLs are not applicable, so the question about force user's behaviour remains.