This is my scenario:

I have a CentOS 7.5 server which must act as a file server and allow AD-integrated authentication for Samba access, without the need to create local users with smbpasswd.
Samba Version 4.7.1
SSSD Version 1.16.0


What I've done so far:

Joined my linux server to my AD domain using REALMD(client-software=sssd) and configured Samba to serve shares.


Upon completing these steps, I have the following problem:

Can't authenticate domain users accessing Samba shares because Samba complains that "Failed to fetch domain SID for MYDOMAIN".
"net getdomainsid" shows SID for local machine, but also reports that "Could not fetch domain SID".


I found a workaround to solve this by either:

1. Leaving the domain then joining again with REALMD (but this time with client-software=winbind)
2. Manually setting the SID with "net setdomainsid"

Both approaches will set the domain SID for Samba and allow me to use AD authentication.


So, I would like to know why is it that joining the domain with client-software=winbind sets this domain SID, while joining with client-software=sssd doesn't. And finally: is there a way to automatically have SSSD set this domain SID for Samba while joining the domain?

I still haven't figured out why the domain SID isn't set when joining with SSSD, or if that's even possible. But i've found out that I can use "net rpc getsid" to set the domain SID into samba's secrets.tdb, without knowing it beforehand.