After days of samba studying, finally have some hint on UID-SID mapping problem, it is related to overlapping SID in multiple domain case, for example, DOMAINA\fai has SID of x-x-x-x-1001 but DOMAINB\fai has SID of y-y-y-y-1001, it is different in the point of view of Windows, but it is the same in samba, so winbind will assign DOMAINB\fai another UID in Linux side, which is unpredictable and inconsistent.
The worst thing is, even there is only one domain, different servers may got different mapping due to UID collision, to make it consistent, we need to use RID method in samba configuration, by:
idmap backend = rid:"DOMAINA=16777216-33554431"idmap uid = 16777216-33554431 idmap gid = 16777216-33554431 But it doesn't work for multiple domain, to entertain multiple domain case, use this:
idmap domains = DOMAINA DOMAINBidmap config DOMAINA:default = yes idmap config DOMAINA:backend = rid idmap config DOMAINB:backend = rid
idmap config DOMAINA:base_rid = 1000 idmap config DOMAINB:base_rid = 1000
idmap config DOMAINA:range = 10000-19999idmap config DOMAINB:range = 20000-29999Together with idmap uid and idmap gid range, this can avoid any collision and make the UID-SID mapping consistent all the time.
Source: http://www.mail-archive.com/samba@lists.samba.org/msg95890.html