HP CIFS Server Administrator's Guide Version A.03.01.02 (5900-1766, September 2011)
Figure 21 Winbind Process Flow
Windows
UNIX
1
2
3
13
8
JFS
ADS
Domain
Controller
Client
Samba
NSSWITCH
winbind
11
14
netlogin
share mapped
Return UID/GID
If UID/GID = ACE
get file
map share
Pass-thru
authentication
Is this SID
mapped?
If mapped,
get UID/GID
else, map SID to UID/GID
return
user/group
SIDs
W2003 = PAC
6
12
7
tdb
open file
accept/reject
accept/deny
UID/GID now mapped
10
9
4
5
DC returns user/group
SID list
The following describes winbind process flow shown in Figure 7–1:
1. A Windows client logs in to the domain (authentication).
2. The Windows 2003 domain controller authenticates client and passes user security data.
3. The Windows client maps an HP CIFS share.
4. The HP CIFS Server passes the user name to Windows Domain Controller to verify the user is
a domain member.
5. The Windows Domain Controller returns the user authorization and member SID list.
6. The smbd daemon passes the SID and user information to the winbind daemon.
7. The Winbind daemon checks the SID and user name against ID mapping data in the Trivial
Database (TDB).Winbind either finds the existing mappings between the Windows SID and the
HP-UX UID/GID or creates a new map if no mapping currently exists.
8. Return mapped UID or GID from TDB database.
9. Winbind returns UID and GID mappings to smbd.
10. The HP CIFS Server presents the mapped share to the Windows client.
11. The Windows client opens file on the HP CIFS server share.
12. UID and GID are compared with file owner, group, and any ACE on ACL in the file system.
13. The File open action is accepted or denied based on the checking result in step 12.
14. The Samba sever displays the open status to the Windows client.
Winbind Supports Non-blocking, Asynchronous Functionality
For HP CIFS Server A.02.03 or later, winbind supports an almost completely non-blocking,
asynchronous request/reply implementation (with the exception of user and group enumeration).
With this new enhancement, winbind provides better scalability in large domain environments
and on high-latency networks.
100 Winbind Support