18.04, in a domain, reading a windows share with ACL

[mat58]

Hello everyone,

I have a synology NAS that is a active directory server, and that is hosting file shares. This, afaik, uses windows like ACL permissions (Acces control lists). We have some windows computers working from that and everything is fine from windows.

Now, I must add some ubuntu computers to the LAN.

I succesfully made my ubuntu 18.04 LTS join the active directory, making some kerberos/DNS/nsswitch configurations. So I can login with the domain users on the linux computer fine.
if I type the command :
id user@mydomain.local
I get the expected result showing the user id # and the groups he belongs to on the domain.

The share is mounted as nfs through a /etc/fstab line.
I can see the files that have no restrictions (readable to all). But if the windows ACL does not allow everybody to read, then my user cannot see the file, even if he should, even if the ACL specify him to be able to, and the group permissions do not work either. That is my problem. I would like the user and group permission from the windows acl to work under linux.

If I set unix Posix permissions with chown, chgrp, chmod, it messes up the ACL permissions for windows users, and they cannot access the files anymore. Then it does work under ubuntu as expected. But I need it to work both under win10 and ubuntu at the same time.

I have read and tried a few things, but was unsuccesfull.
Is it because I need to set up a samba and/or winbind? or is that only if I want my linux computer to host the domain and the share? (I do not). Most tutorials seems to be about that, while I just want to use an allready existing share.

I have seen example of getfacl and setfacl. the first one works, not the second one. I get an error: Operation is not supported. Googling that error points me to changing my hdd mounts configuration to allow acl formats, but in my case the mount is distant, not on my hdd. I tried a few options in my nfs mounting line, without success.

I've tried nfs4 and their nfs4_getfacl and nfs4_setfacl and that didn't work ("Operation to request attribute not supported), but I m not even sure that is the way to go.

Anyone knows what must be done, or has a good link to do it under 18.04 ?
Thank you