Hi, I did the same, still having the same problem. I know that samba is not needed for windowsxp to authenticate to freeIPA, as I said kerberos was not working for me (still trying on it with fresh windows client installation), so I have done a try with samba (removed samba and did a fresh IPA installation). Here are the exact steps I have followed. On the IPA Server. 1. Added host principal and set the password for the xp client # ipa-addservice host/<a href="http://bmdata01.testing.com">bmdata01.testing.com</a> # ipa-getkeytab -s <a href="http://viji.testing.com">viji.testing.com</a> -p host/<a href="http://bmdata01.testing.com">bmdata01.testing.com</a> -e des-cbc-crc -k krb5.keytab.txt -P (asked for the password) 2. On the Client (Windows XP) a. Installed MIT kerberos windows client b. Created a user called ipauser c. Configured kerberos C:> ksetup /setrealm <a href="http://TESTING.COM">TESTING.COM</a> C:> ksetup /addkdc <a href="http://TESTING.COM">TESTING.COM</a> <a href="http://viji.testing.com">viji.testing.com</a> C:> ksetup /setmachpassword <password> C:> ksetup /mapuser * ipauser d. Rebooted the machine, after the reboot windows is showing "<a href="http://TESTING.COM">TESTING.COM</a> (Kerberos Realm)" in the login screen, but when I enter a valid ipa user name it is throwing the following error. "The system could not log you on. Make sure your user name and domain are correct, and then type your password again. Letters in passwords must be typed using the correct case." But the kerberos server issuing the tickets, I could see this in logs. Dont know what happened, hope I did something wrong, but not getting what went wrong and where. Your suggestions are greatly appreciated. Thanks Viji <div class="gmail_quote">On Fri, Jan 2, 2009 at 12:05 AM, Kozlov <<a href="mailto:mackoel@gmail.com">mackoel@gmail.com</a>> wrote: <blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"> Hi, I know this document and had set up samba3 that way. The problem is samba3 can't use kerberos from winxp. No way for now. Samba4 is in alpha stage, it uses ADS schema in LDAP and can't work with FreeIPA. Samba is not needed for winxp to authenticate in freeipa. So if you need to authenticate winxp users in freeipa try to follow the steps for setting up kerberos on winxp. Did you try the ipa-getkeytab with -e and -P? winxp needs that enctype and password to work with freeipa. And it worked for me and some people on this list.<div class="Ih2E3d"> Best regards, Kostya Viji V Nair пишет: </div><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"> Hi, <div class="Ih2E3d"> Yes, my goal is to setup an Active Directory substitution, but not looking for a complete AD replacement. I really don't want to use windows active directory. In my organization around 60% of the users are using Linux as their desktop, remaining 40% is on windows XP SP3. I want to setup single sign on using free IPA, I found the attached document on the internet, so I tried to setup samba as a client to freeIPA and autheticate windows clients to samba and samba to freeIPA. (I tried this because I was struggling with windows to authenticate to the kerberos) Please have a look at the attached document, I will try your suggestions and post the results. Wishing you all a Happy and peaceful NEW YEAR. Thanks & Regards Viji </div><div class="Ih2E3d"> On Wed, Dec 31, 2008 at 9:22 PM, Kozlov <<a href="mailto:mackoel@gmail.com" target="_blank">mackoel@gmail.com</a> <mailto:<a href="mailto:mackoel@gmail.com" target="_blank">mackoel@gmail.com</a>>> wrote: Hi, </div><div><div></div><div class="Wj3C7c"> I saw your posts on samba list :) Is your goal to make the Active Directory substitution? Samba3 + FreeIPA won't work that way. Look for explanations on freeipa-users list. You either need Samba4 or no kerberos on Windows. However, samba3 can be used with FreeIPA as File Sharing solution and will use Single Sign On when you'll managed to setup winxp for IPA. Best regards and Happy New Year! Kostya Viji V Nair пишет: > Hi, > > I have setup samba as a PDC with kerberos and ldap. While adding the windows > clients I get the following error message on the logs, and windows says the > user name and password is incorrect > > [2008/12/31 19:00:09, 0] lib/util_sock.c:write_data(1059) > [2008/12/31 19:00:09, 0] lib/util_sock.c:get_peer_addr_internal(1607) > getpeername failed. Error was Transport endpoint is not connected > write_data: write failure in writing to client 0.0.0.0. Error Connection > reset by peer > [2008/12/31 19:00:09, 0] smbd/process.c:srv_send_smb(74) > Error writing 4 bytes to client. -1. (Transport endpoint is not connected) > > Any help on the same will be gratly appreciated. > > # rpm -qa |grep samba > samba-client-3.2.5-0.23.fc10.x86_64 > samba-common-3.2.5-0.23.fc10.x86_64 > samba-3.2.5-0.23.fc10.x86_64 > samba-winbind-3.2.5-0.23.fc10.x86_64 > > # uname -a </div></div> > Linux <a href="http://viji.testing.com" target="_blank">viji.testing.com</a> <<a href="http://viji.testing.com" target="_blank">http://viji.testing.com</a>><div class="Ih2E3d"> 2.6.27.7-134.fc10.x86_64 #1 SMP Mon Dec 1 22:21:35 > EST 2008 x86_64 x86_64 x86_64 GNU/Linux > > # cat /etc/samba/smb.conf > [global] </div> > workgroup = <a href="http://TESTING.COM" target="_blank">TESTING.COM</a> <<a href="http://TESTING.COM" target="_blank">http://TESTING.COM</a>><div class="Ih2E3d"> > server string = Samba Server Version %v > security = user > passdb backend = smbpasswd > socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192 > os level = 33 > domain logons = yes > domain master = yes > local master = yes > preferred master = yes > wins support = yes > template shell = /bin/false </div> > realm = <a href="http://TESTING.COM" target="_blank">TESTING.COM</a> <<a href="http://TESTING.COM" target="_blank">http://TESTING.COM</a>><div><div></div><div class="Wj3C7c"> > use kerberos keytab = yes > load printers = yes > cups options = raw > # log level = 3 passdb:5 auth:10 > [homes] > comment = Home Directories > browseable = no > writable = yes > [printers] > comment = All Printers > path = /var/spool/samba > browseable = no > guest ok = no > writable = no > printable = yes > [share] > comment = Share > path = /share > browseable = yes > guest ok = no > writable = yes > valid users = admin > > Thanks > Viji Viji V Nair пишет: Hi, I have done the modifications as suggested, but no luck, getting the same error. # kinit admin # ipa-addservice host/<a href="http://bmdata01.testing.com" target="_blank">bmdata01.testing.com</a> </div></div> <<a href="http://bmdata01.testing.com" target="_blank">http://bmdata01.testing.com</a>> <<a href="http://bmdata01.testing.com" target="_blank">http://bmdata01.testing.com</a>><div class="Ih2E3d"> # ipa-getkeytab -s <a href="http://viji.testing.com" target="_blank">viji.testing.com</a> <<a href="http://viji.testing.com" target="_blank">http://viji.testing.com</a>> <<a href="http://viji.testing.com" target="_blank">http://viji.testing.com</a>> -p host/<a href="http://bmdata01.testing.com" target="_blank">bmdata01.testing.com</a> </div> <<a href="http://bmdata01.testing.com" target="_blank">http://bmdata01.testing.com</a>> <<a href="http://bmdata01.testing.com" target="_blank">http://bmdata01.testing.com</a>> -k<div class="Ih2E3d"> /etc/krb5.keytab Could you please elaborate the steps which you have done to get it working on both the client and server side? Thanks Viji On Tue, Dec 30, 2008 at 11:46 PM, Kozlov <<a href="mailto:mackoel@gmail.com" target="_blank">mackoel@gmail.com</a> </div> <mailto:<a href="mailto:mackoel@gmail.com" target="_blank">mackoel@gmail.com</a>> <mailto:<a href="mailto:mackoel@gmail.com" target="_blank">mackoel@gmail.com</a><div><div></div><div class="Wj3C7c"> <mailto:<a href="mailto:mackoel@gmail.com" target="_blank">mackoel@gmail.com</a>>>> wrote: Hi, The minor comment is that kadmin is supposed to be substituted with ipa-addservice. The major comment is that you've missed ipa-getkeytab on ipaserver that actually SETS password that you then install on winxp. And try to map all users to one: for example, "* Administrator". Best regards, Kostya Viji V Nair пишет: Hi, Thank you for the information, I have tried all these steps, but no success 1. On the IPA Server I have created a host principal using the following command. # kadmin -q "ank host/<a href="http://bmdata01.testing.com" target="_blank">bmdata01.testing.com</a> <<a href="http://bmdata01.testing.com" target="_blank">http://bmdata01.testing.com</a>> <<a href="http://bmdata01.testing.com" target="_blank">http://bmdata01.testing.com</a>> <<a href="http://bmdata01.testing.com" target="_blank">http://bmdata01.testing.com</a>>" 2. On the windows xp client C:> ksetup /setrealm <a href="http://TESTING.COM" target="_blank">TESTING.COM</a> <<a href="http://TESTING.COM" target="_blank">http://TESTING.COM</a>> <<a href="http://TESTING.COM" target="_blank">http://TESTING.COM</a>> <<a href="http://TESTING.COM" target="_blank">http://TESTING.COM</a>> C:> ksetup /addkdc <a href="http://TESTING.COM" target="_blank">TESTING.COM</a> <<a href="http://TESTING.COM" target="_blank">http://TESTING.COM</a>> <<a href="http://TESTING.COM" target="_blank">http://TESTING.COM</a>> <<a href="http://TESTING.COM" target="_blank">http://TESTING.COM</a>> <a href="http://viji.bigmaps.com" target="_blank">viji.bigmaps.com</a> <<a href="http://viji.bigmaps.com" target="_blank">http://viji.bigmaps.com</a>> <<a href="http://viji.bigmaps.com" target="_blank">http://viji.bigmaps.com</a>> <<a href="http://viji.bigmaps.com" target="_blank">http://viji.bigmaps.com</a>> C:> ksetup /setmachpassword <password> C:> ksetup /mapuser <a href="mailto:admin@TESTING.COM" target="_blank">admin@TESTING.COM</a> <mailto:<a href="mailto:admin@TESTING.COM" target="_blank">admin@TESTING.COM</a>> <mailto:<a href="mailto:admin@TESTING.COM" target="_blank">admin@TESTING.COM</a> <mailto:<a href="mailto:admin@TESTING.COM" target="_blank">admin@TESTING.COM</a>>> <mailto:<a href="mailto:admin@TESTING.COM" target="_blank">admin@TESTING.COM</a> <mailto:<a href="mailto:admin@TESTING.COM" target="_blank">admin@TESTING.COM</a>> <mailto:<a href="mailto:admin@TESTING.COM" target="_blank">admin@TESTING.COM</a> <mailto:<a href="mailto:admin@TESTING.COM" target="_blank">admin@TESTING.COM</a>>>> guest C:> ksetup /mapuser * * After the above setup windows is showing <a href="http://TESTING.COM" target="_blank">TESTING.COM</a> <<a href="http://TESTING.COM" target="_blank">http://TESTING.COM</a>> <<a href="http://TESTING.COM" target="_blank">http://TESTING.COM</a>> <<a href="http://TESTING.COM" target="_blank">http://TESTING.COM</a>> as a Kerberos Realm on the login screen, but when I try to login using the user name "admin" it is throwing the following error. "The system could not log you on. Make sure your user name and domain are correct, and then type your password again. Letters in passwords must be typed using the correct case." But the IPA (kerberos) server is issuing the tickets, the log shows: Dec 30 22:36:03 <a href="http://viji.testing.com" target="_blank">viji.testing.com</a> <<a href="http://viji.testing.com" target="_blank">http://viji.testing.com</a>> <<a href="http://viji.testing.com" target="_blank">http://viji.testing.com</a>> <<a href="http://viji.testing.com" target="_blank">http://viji.testing.com</a>> krb5kdc[5179](info): AS_REQ (7 etypes {23 -133 -128 3 1 24 -135}) 172.16.33.112 <<a href="http://172.16.33.112" target="_blank">http://172.16.33.112</a>>: NEEDED_PREAUTH: <a href="mailto:admin@TESTING.COM" target="_blank">admin@TESTING.COM</a> <mailto:<a href="mailto:admin@TESTING.COM" target="_blank">admin@TESTING.COM</a>> <mailto:<a href="mailto:admin@TESTING.COM" target="_blank">admin@TESTING.COM</a> <mailto:<a href="mailto:admin@TESTING.COM" target="_blank">admin@TESTING.COM</a>>> <mailto:<a href="mailto:admin@TESTING.COM" target="_blank">admin@TESTING.COM</a> <mailto:<a href="mailto:admin@TESTING.COM" target="_blank">admin@TESTING.COM</a>> </div></div> <mailto:<a href="mailto:admin@TESTING.COM" target="_blank">admin@TESTING.COM</a> <mailto:<a href="mailto:admin@TESTING.COM" target="_blank">admin@TESTING.COM</a>>>><div class="Ih2E3d"> for krbtgt/<a href="http://TESTING.COM" target="_blank">TESTING.COM</a> <<a href="http://TESTING.COM" target="_blank">http://TESTING.COM</a>> <<a href="http://TESTING.COM" target="_blank">http://TESTING.COM</a>> <<a href="http://TESTING.COM" target="_blank">http://TESTING.COM</a>>@<a href="http://TESTING.COM" target="_blank">TESTING.COM</a> <<a href="http://TESTING.COM" target="_blank">http://TESTING.COM</a>> <<a href="http://TESTING.COM" target="_blank">http://TESTING.COM</a>> <<a href="http://TESTING.COM" target="_blank">http://TESTING.COM</a>>, Additional pre-authentication required Dec 30 22:36:03 <a href="http://viji.testing.com" target="_blank">viji.testing.com</a> <<a href="http://viji.testing.com" target="_blank">http://viji.testing.com</a>> <<a href="http://viji.testing.com" target="_blank">http://viji.testing.com</a>> <<a href="http://viji.testing.com" target="_blank">http://viji.testing.com</a>> krb5kdc[5179](info): AS_REQ (3 etypes {23 3 1}) 172.16.33.112 <<a href="http://172.16.33.112" target="_blank">http://172.16.33.112</a>>: ISSUE: authtime 1230656763, etypes {rep=23 tkt=18 ses=23}, <a href="mailto:admin@TESTING.COM" target="_blank">admin@TESTING.COM</a> <mailto:<a href="mailto:admin@TESTING.COM" target="_blank">admin@TESTING.COM</a>> <mailto:<a href="mailto:admin@TESTING.COM" target="_blank">admin@TESTING.COM</a> <mailto:<a href="mailto:admin@TESTING.COM" target="_blank">admin@TESTING.COM</a>>> </div><div class="Ih2E3d"> <mailto:<a href="mailto:admin@TESTING.COM" target="_blank">admin@TESTING.COM</a> <mailto:<a href="mailto:admin@TESTING.COM" target="_blank">admin@TESTING.COM</a>> </div> <mailto:<a href="mailto:admin@TESTING.COM" target="_blank">admin@TESTING.COM</a> <mailto:<a href="mailto:admin@TESTING.COM" target="_blank">admin@TESTING.COM</a>>>><div class="Ih2E3d"> for krbtgt/<a href="http://TESTING.COM" target="_blank">TESTING.COM</a> <<a href="http://TESTING.COM" target="_blank">http://TESTING.COM</a>> <<a href="http://TESTING.COM" target="_blank">http://TESTING.COM</a>> <<a href="http://TESTING.COM" target="_blank">http://TESTING.COM</a>>@<a href="http://TESTING.COM" target="_blank">TESTING.COM</a> <<a href="http://TESTING.COM" target="_blank">http://TESTING.COM</a>> </div><div class="Ih2E3d"> <<a href="http://TESTING.COM" target="_blank">http://TESTING.COM</a>> <<a href="http://TESTING.COM" target="_blank">http://TESTING.COM</a>> Dec 30 22:36:03 <a href="http://viji.testing.com" target="_blank">viji.testing.com</a> <<a href="http://viji.testing.com" target="_blank">http://viji.testing.com</a>> <<a href="http://viji.testing.com" target="_blank">http://viji.testing.com</a>> <<a href="http://viji.testing.com" target="_blank">http://viji.testing.com</a>> krb5kdc[5179](info): TGS_REQ (7 etypes {23 -133 -128 3 1 24 -135}) 172.16.33.112 <<a href="http://172.16.33.112" target="_blank">http://172.16.33.112</a>>: ISSUE: authtime 1230656763, etypes {rep=23 tkt=18 ses=23}, <a href="mailto:admin@TESTING.COM" target="_blank">admin@TESTING.COM</a> <mailto:<a href="mailto:admin@TESTING.COM" target="_blank">admin@TESTING.COM</a>> <mailto:<a href="mailto:admin@TESTING.COM" target="_blank">admin@TESTING.COM</a> <mailto:<a href="mailto:admin@TESTING.COM" target="_blank">admin@TESTING.COM</a>>> </div><div class="Ih2E3d"> <mailto:<a href="mailto:admin@TESTING.COM" target="_blank">admin@TESTING.COM</a> <mailto:<a href="mailto:admin@TESTING.COM" target="_blank">admin@TESTING.COM</a>> </div> <mailto:<a href="mailto:admin@TESTING.COM" target="_blank">admin@TESTING.COM</a> <mailto:<a href="mailto:admin@TESTING.COM" target="_blank">admin@TESTING.COM</a>>>><div><div></div><div class="Wj3C7c"> for host/<a href="http://bmdata01.testing.com" target="_blank">bmdata01.testing.com</a> <<a href="http://bmdata01.testing.com" target="_blank">http://bmdata01.testing.com</a>> <<a href="http://bmdata01.testing.com" target="_blank">http://bmdata01.testing.com</a>> <<a href="http://bmdata01.testing.com" target="_blank">http://bmdata01.testing.com</a>>@<a href="http://TESTING.COM" target="_blank">TESTING.COM</a> <<a href="http://TESTING.COM" target="_blank">http://TESTING.COM</a>> <<a href="http://TESTING.COM" target="_blank">http://TESTING.COM</a>> <<a href="http://TESTING.COM" target="_blank">http://TESTING.COM</a>> I have found some article on Microsoft website, saying this is a bug and apply the latest service pack (SP3), I even tried that, but no success. <a href="http://support.microsoft.com/kb/825081" target="_blank">http://support.microsoft.com/kb/825081</a> Similar Thread: <a href="http://mailman.mit.edu/pipermail/kerberos/2006-May/009890.html" target="_blank">http://mailman.mit.edu/pipermail/kerberos/2006-May/009890.html</a> Thanks & Regards Viji On Mon, Dec 29, 2008 at 6:35 PM, Konstantin Kozlov <<a href="mailto:kozlov@spbcas.ru" target="_blank">kozlov@spbcas.ru</a> <mailto:<a href="mailto:kozlov@spbcas.ru" target="_blank">kozlov@spbcas.ru</a>> <mailto:<a href="mailto:kozlov@spbcas.ru" target="_blank">kozlov@spbcas.ru</a> <mailto:<a href="mailto:kozlov@spbcas.ru" target="_blank">kozlov@spbcas.ru</a>>> <mailto:<a href="mailto:kozlov@spbcas.ru" target="_blank">kozlov@spbcas.ru</a> <mailto:<a href="mailto:kozlov@spbcas.ru" target="_blank">kozlov@spbcas.ru</a>> <mailto:<a href="mailto:kozlov@spbcas.ru" target="_blank">kozlov@spbcas.ru</a> <mailto:<a href="mailto:kozlov@spbcas.ru" target="_blank">kozlov@spbcas.ru</a>>>>> wrote: Hi, You can search the list for a similar thread and here are the steps I've followed with success: Add host principal for winxp machine with the encoding des-cbc-crc and passowrd (-P ioption for ipa-getkeytab). Do not store this keytab in /etc/krb5.keytab but rather in some other file. Install MS Support Tools on WinXP, and run ksetup /setdomain ... ksetup /addkdc ... ksetup /setcomputerpassword ... ksetup /mapuser * <your user> WinXP machine asks to login to Kerberos realm at login screen. I failed to map one ipa-user to one win-user. But may be because I didn't have enough time. If you will succeed - leave a note here please. Best regards, Kostya Viji V Nair wrote: Hi, I am a new user of free-ipa, I have installed the free-ipa packages shipped with fedora 10. I have more that 100 windows clients to authenticate. Here is my problem, All the clients are XP SP2, I have installed MIT Kerberos for Windows 3.2.2. Always the native windows login prompt appears first, when i login to windows the kerberos client is asking for authentication. I want to replace this windows authentication with kerberos Any help on the same will be greatly appreciated. Thanks Viji ------------------------------------------------------------------------ _______________________________________________ Freeipa-users mailing list <a href="mailto:Freeipa-users@redhat.com" target="_blank">Freeipa-users@redhat.com</a> <mailto:<a href="mailto:Freeipa-users@redhat.com" target="_blank">Freeipa-users@redhat.com</a>> <mailto:<a href="mailto:Freeipa-users@redhat.com" target="_blank">Freeipa-users@redhat.com</a> <mailto:<a href="mailto:Freeipa-users@redhat.com" target="_blank">Freeipa-users@redhat.com</a>>> <mailto:<a href="mailto:Freeipa-users@redhat.com" target="_blank">Freeipa-users@redhat.com</a> <mailto:<a href="mailto:Freeipa-users@redhat.com" target="_blank">Freeipa-users@redhat.com</a>> <mailto:<a href="mailto:Freeipa-users@redhat.com" target="_blank">Freeipa-users@redhat.com</a> <mailto:<a href="mailto:Freeipa-users@redhat.com" target="_blank">Freeipa-users@redhat.com</a>>>> <a href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a> -- Konstantin Kozlov Department of Computational Biology, Center for Advanced Studies, SPb State Polytechnical University, 195251, Polytechnicheskaya ul., 29, bld 4, office 204, St.Petersburg, Russia. Tel./fax: +7 812 596 2831 _______________________________________________ Freeipa-users mailing list <a href="mailto:Freeipa-users@redhat.com" target="_blank">Freeipa-users@redhat.com</a> <mailto:<a href="mailto:Freeipa-users@redhat.com" target="_blank">Freeipa-users@redhat.com</a>> <mailto:<a href="mailto:Freeipa-users@redhat.com" target="_blank">Freeipa-users@redhat.com</a> <mailto:<a href="mailto:Freeipa-users@redhat.com" target="_blank">Freeipa-users@redhat.com</a>>> <mailto:<a href="mailto:Freeipa-users@redhat.com" target="_blank">Freeipa-users@redhat.com</a> <mailto:<a href="mailto:Freeipa-users@redhat.com" target="_blank">Freeipa-users@redhat.com</a>> <mailto:<a href="mailto:Freeipa-users@redhat.com" target="_blank">Freeipa-users@redhat.com</a> </div></div><div class="Ih2E3d"> <mailto:<a href="mailto:Freeipa-users@redhat.com" target="_blank">Freeipa-users@redhat.com</a>>>> <a href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a> ------------------------------------------------------------------------ _______________________________________________ Freeipa-users mailing list </div><div class="Ih2E3d"> <a href="mailto:Freeipa-users@redhat.com" target="_blank">Freeipa-users@redhat.com</a> <mailto:<a href="mailto:Freeipa-users@redhat.com" target="_blank">Freeipa-users@redhat.com</a>> <a href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a> </div></blockquote> </blockquote></div>