Problem: Creating new users fails with an `objectSid` conflict "failed to re-index objectSid "

Knowledge Base Community
1

Problem

Creating new users, groups, or computer objects fails with an objectSid conflict although free RIDs should still be available.

Example:

$ samba-tool user add testuser 'Password123'

ERROR(ldb): Failed to add user 'testuser':
../../lib/ldb/ldb_kv_index.c:2931: unique index violation on objectSid

univention-ldapsearch -LLL cn=group_one sambaSID
sambaSID: S-1-4-1111

Connector reject:

ldap.CONSTRAINT_VIOLATION: {'msgtype': 105, 'msgid': 105089, 'result':
19, 'desc': 'Constraint violation', 'ctrls': [], 'info': '0000202F:
../../lib/ldb/ldb_key_value/ldb_kv_index.c:3086: Failed to re-index
objectSid in CN=group_neu,OU=groups,DC=age,DC=mpg,DC=de -
../../lib/ldb/ldb_key_value/ldb_kv_index.c:2931: unique index violation
on objectSid in CN=group_one,OU=groups,DC=schein,DC=me'}

Running samba-tool dbcheck on the local Domain Controller reports RID Set conflicts similar to:

$ samba-tool dbcheck --cross-ncs \
  "CN=$(ucr get hostname),OU=Domain Controllers,$(ucr get ldap/base)" -v

SID S-1-5-21-...-3100 for CN=<object> conflicts with our current RID set in CN=RID Set,CN=UCS,OU=Domain Controllers,DC=schein,DC=me

Investigation

Inspect the current RID Set:

ldbsearch -H /var/lib/samba/private/sam.ldb \
  '(cn=RID Set)' \
  rIDPreviousAllocationPool \
  rIDAllocationPool \
  rIDNextRID \
  rIDUsedPool

Example:

rIDPreviousAllocationPool: 1600-2099
rIDAllocationPool: 3100-3599
rIDNextRID: 3531

Although rIDNextRID indicates that RIDs from the current pool have already been assigned, Samba may still try to allocate RID 3100, resulting in:

unique index violation on objectSid

Running dbcheck reports only one conflicting RID:

SID ...-3100 conflicts with our current RID set in CN=RID Set
...

Solution

Always create a backup of sam.ldb before modifying the Samba database.

Run dbcheck against the local Domain Controller object and allow Samba to repair the RID Set.

samba-tool dbcheck --cross-ncs \
  "CN=$(ucr get hostname),OU=Domain Controllers,$(ucr get ldap/base)" \
  --fix -v

For every reported conflict, Samba asks:

Fix conflict between SID -3100 and RID pool in CN=RID Set by allocating a new RID? [y/N/all/none]

Answer:

y

or

all

to repair all reported RID conflicts automatically.

The repair updates the RID Set by allocating new RIDs until all conflicting RIDs have been skipped.

Verify that object creation works again:

samba-tool user add testuser 'Password123'

Or check the s4-connector log, for rejected users beeing created.

Finally, verify the updated RID Set:

ldbsearch -H /var/lib/samba/private/sam.ldb \
  '(cn=RID Set)' \
  rIDPreviousAllocationPool \
  rIDAllocationPool \
  rIDNextRID \
  rIDUsedPool

The RID allocator should now continue with non-conflicting RIDs and new objects can be created successfully.