[SSSD-users] Setting ACLs through Samba from Windows?

A small group of us have been trying to get our Ubuntu servers fully integrated into AD with sssd and Samba. We have slowly chipped away at the issues. We believe we are left with one major issue: Windows cannot set ACLs through Samba. The Windows permission dialog seems to work, but when you click Apply they vanish, and getfacl on Ubuntu shows they were not applied. The host is Ubuntu 16.04.2, up to date as of today, so sssd 1.13.4-1ubuntu1.1 and Samba 2:4.3.11+dfsg-0ubuntu0.16.04.3. Our AD is set up with OU.AD3.UCDAVIS.EDU as a child domain in the same forest as the parent domain, AD3.UCDAVIS.EDU, with users in AD3.UCDAVIS.EDU and computers and groups in OU.AD3.UCDAVIS.EDU. The sssd part seems to be setup correctly. We can login via SSH and auth correctly with Samba. Windows honors the ACLs that are set on the Ubuntu side, but setting ACLs on Windows fails to actually apply. The Samba config is attached. [storage] is on ZFS with: root@phys-adtest:~# zfs get all storage | grep acl storage aclinherit restricted local storage acltype posixacl local And [storage2] is on ext4 with the user_xattr mount option added. The behavior, where ACLs vanish after clicking Apply in Windows is the same with both of them. I had previously found a thread with the issue on a Samba mailing list indicating it "must be a sssd issue because it works with winbind", but can't find the thread now. Anyone have any clues as to what may be going wrong or what config options I should check? I can post debug logs if it would help. Thanks, Omen -- Omen Wild Systems Administrator Metro Cluster