<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">Hi all,<div><br></div><div>I am quite aware that installing ipa-server-trust-ad and using the samba as a file server is as unsupported as one can get... but I really needed a Samba server integrated with IPA (damn Mac OS and Windows). I don't actually have a Windows environment but this seemed to bootstrap enough of the requirements to get it working</div><div><br></div><div>Bit of a story for those who have time to read and maybe battling similiar, or just skip to after the log for the fix+patch :)</div><div>* ipaNTSecurityIdentifier ended up missing because I didn't use --setsid and NT hash missing because I did not do a ipa passwd reset</div><div>* As a result, experienced user not found or invalid password, and after debug level 5 I had about 500M of core dumps (sorry don't have them anymore)</div><div>* Ran ipa-adtrust-install again with --setsid and reset some passwords and things started looking better, could connect, all good, NT hash was there and ipaNTSecurityIdentifier there (ldapsearch <3)</div><div>* Then next problem was when I added "valid users = @groupname" to share config. No longer could connect even if member of the group!</div><div>* Turned out ipNTGroupAttr was missing from some groups - thus had to register the ldif for the ipa-setsid task</div><div><br></div><div>Still had problems even after ipa-setsid, and ldapsearch showed all correct.</div><div>Here is a snippet from the logs at debug level 10.</div><div><br></div><div><div></div><blockquote type="cite"><div><font face="Courier">[2014/03/06 15:32:55.658567, 4, pid=28139, effective(0, 0), real(0, 0)] ../source3/smbd/sec_ctx.c:316(set_sec_ctx)</font></div><div><font face="Courier"> setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1</font></div><div><font face="Courier">[2014/03/06 15:32:55.658601, 5, pid=28139, effective(0, 0), real(0, 0)] ../libcli/security/security_token.c:53(security_token_debug)</font></div><div><font face="Courier"> Security token: (NULL)</font></div><div><font face="Courier">[2014/03/06 15:32:55.658634, 5, pid=28139, effective(0, 0), real(0, 0)] ../source3/auth/token_util.c:528(debug_unix_user_token)</font></div><div><font face="Courier"> UNIX token of user 0</font></div><div><font face="Courier"> Primary group is 0 and contains 0 supplementary groups</font></div><div><font face="Courier">[2014/03/06 15:32:55.658691, 5, pid=28139, effective(0, 0), real(0, 0)] ../source3/lib/smbldap.c:1249(smbldap_search_ext)</font></div><div><font face="Courier"> smbldap_search_ext: base => [dc=local,dc=othermedia,dc=com], filter => [(&(ipaNTSecurityIdentifier=S-1-5-21-2563482189-1697247676-1628377611-1005)(|(objectClass=ipaNTGroupAttrs)(objectClass=ipaNTUserAttrs)))], scope => [2]</font></div><div><font face="Courier">[2014/03/06 15:32:55.659599, 10, pid=28139, effective(0, 0), real(0, 0)] ipa_sam.c:309(get_single_attribute)</font></div><div><font face="Courier"> Attribute [uidNumber] not found.</font></div><div><font face="Courier">[2014/03/06 15:32:55.659667, 1, pid=28139, effective(0, 0), real(0, 0)] ipa_sam.c:717(ldapsam_sid_to_id)</font></div><div><font face="Courier"> Could not find uidNumber in cn=filestore_archive,cn=groups,cn=accounts,dc=local,dc=othermedia,dc=com</font></div><div><font face="Courier">[2014/03/06 15:32:55.659716, 4, pid=28139, effective(0, 0), real(0, 0)] ../source3/smbd/sec_ctx.c:424(pop_sec_ctx)</font></div><div><font face="Courier"> pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0</font></div><div><font face="Courier">[2014/03/06 15:32:55.659758, 10, pid=28139, effective(0, 0), real(0, 0)] ../source3/passdb/lookup_sid.c:1121(legacy_sid_to_unixid)</font></div><div><font face="Courier"> LEGACY: mapping failed for sid S-1-5-21-2563482189-1697247676-1628377611-1005</font></div><div><font face="Courier">[2014/03/06 15:32:55.659796, 4, pid=28139, effective(0, 0), real(0, 0)] ../source3/smbd/sec_ctx.c:216(push_sec_ctx)</font></div><div><font face="Courier"> push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1</font></div></blockquote></div><div><br></div><div>I noticed the "Could not find uidNumber" - turns out ipa-sam was being asked to turn SID into ID and was successfully finding it but needed to work out whether it was a group or a user. To do this, it searches the objectClass for "ipNTGroupAttr" - if it finds it, it looks for gidNumber, otherwise it looks for uidNumber. However, the objectClass added by ipa-setsid is "ipntgroupattr" and ipa-sam was using "strncmp".</div><div><br></div><div>I've fixed this with a patch to use strncasecmp. Might not be the best fix... maybe ipa-sam should be modified to have the attributes lower case for comparison? But this was simplest patch. Comments/feedback welcome and maybe I'll have time to do alternative fix if felt better?</div><div><br></div><div>Versions:</div><div>RHEL 6.4 3.0.0-37</div><div>Code in master branch appears to show the same issue</div><div><br></div><div>References:</div><div><div>freeipa/daemons/ipa-slapi-plugins/ipa-sidgen/ipa_sidgen.h</div><div>around line 54-55: lowercase objectClass addition</div></div><div><div>freeipa/daemons/ipa-sam/ipa_sam.c</div><div>around line 688: case sensitive comparison to ipaNTGroupAttrs</div></div><div><br></div><div>Patch for master branch:</div><div><div><font face="Courier">diff --git a/daemons/ipa-sam/ipa_sam.c b/daemons/ipa-sam/ipa_sam.c</font></div><div><font face="Courier">index 1ca504d..c5e8b39 100644</font></div><div><font face="Courier">--- a/daemons/ipa-sam/ipa_sam.c</font></div><div><font face="Courier">+++ b/daemons/ipa-sam/ipa_sam.c</font></div><div><font face="Courier">@@ -750,7 +750,7 @@ static bool ldapsam_sid_to_id(struct pdb_methods *methods,</font></div><div><font face="Courier"> <span class="Apple-tab-span" style="white-space:pre"> </span>}</font></div><div><font face="Courier"> </font></div><div><font face="Courier"> <span class="Apple-tab-span" style="white-space:pre"> </span>for (c = 0; values[c] != NULL; c++) {</font></div><div><font face="Courier">-<span class="Apple-tab-span" style="white-space:pre"> </span>if (strncmp(LDAP_OBJ_GROUPMAP, values[c]->bv_val,</font></div><div><font face="Courier">+<span class="Apple-tab-span" style="white-space:pre"> </span>if (strncasecmp(LDAP_OBJ_GROUPMAP, values[c]->bv_val,</font></div><div><font face="Courier"> <span class="Apple-tab-span" style="white-space:pre"> </span> values[c]->bv_len) == 0) {</font></div><div><font face="Courier"> <span class="Apple-tab-span" style="white-space:pre"> </span>break;</font></div><div><font face="Courier"> <span class="Apple-tab-span" style="white-space:pre"> </span>}</font></div></div><div><br></div><div>Patch for RHEL 6.5 3.0.0-37:</div><div><div><font face="Courier">--- a/daemons/ipa-sam/ipa_sam.c<span class="Apple-tab-span" style="white-space:pre"> </span>2014-03-06 19:30:15.994792879 +0000</font></div><div><font face="Courier">+++ b/daemons/ipa-sam/ipa_sam.c<span class="Apple-tab-span" style="white-space:pre"> </span>2014-03-06 19:35:34.966791637 +0000</font></div><div><font face="Courier">@@ -685,7 +685,7 @@</font></div><div><font face="Courier"> <span class="Apple-tab-span" style="white-space:pre"> </span>}</font></div><div><font face="Courier"><br></font></div><div><font face="Courier"> <span class="Apple-tab-span" style="white-space:pre"> </span>for (c = 0; values[c] != NULL; c++) {</font></div><div><font face="Courier">-<span class="Apple-tab-span" style="white-space:pre"> </span>if (strncmp(LDAP_OBJ_GROUPMAP, values[c]->bv_val,</font></div><div><font face="Courier">+<span class="Apple-tab-span" style="white-space:pre"> </span>if (strncasecmp(LDAP_OBJ_GROUPMAP, values[c]->bv_val,</font></div><div><font face="Courier"> <span class="Apple-tab-span" style="white-space:pre"> </span> values[c]->bv_len) == 0) {</font></div><div><font face="Courier"> <span class="Apple-tab-span" style="white-space:pre"> </span>break;</font></div><div><font face="Courier"> <span class="Apple-tab-span" style="white-space:pre"> </span>}</font></div></div><div><br></div><div>Regards,</div><div><br></div><div>Jason</div></body></html>