<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><style></style></head><body lang=EN-CA link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Hi Youenn,<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Thank you for the response.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>I am sure the issue is related to the samba attributes not existing, but I am not fully clear on how to fix it.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>I was trying to find out the correct steps on a CentOS system, and I think it is something like:<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>>yum remove samba-common<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>>yum install samba4<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>>yum install ipa-server-trust-ad<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>>ipa-adtrust-install<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>I thought the ipa-adtrust-install was supposed to add the samba attributes, but for some reason it still does not work.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Does anyone have any insight in what steps I might have missed?<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Thanks,<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>-Chris<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><b><span lang=EN-US style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span lang=EN-US style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> Youenn PIOLET [mailto:piolet.y@gmail.com] <br><b>Sent:</b> October-11-15 6:49 PM<br><b>To:</b> Chris Tobey<br><b>Cc:</b> freeipa-users@redhat.com; Matt .<br><b>Subject:</b> Re: [Freeipa-users] FreeNAS Authenticating Againts FreeIPA<o:p></o:p></span></p><p class=MsoNormal><o:p> </o:p></p><div><p class=MsoNormal>Sorry for the double post.<o:p></o:p></p><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>I forgot to say that my speech is about newest versions of FreeIPA.<o:p></o:p></p></div><div><p class=MsoNormal>Maybe someone here knows something about IPA 3.0 ?<o:p></o:p></p></div><div><p class=MsoNormal>I'm not sure it used to work with ipasam module. But I suppose the problem is the same: you need to generate Samba schema values for your IPA users in the directory.<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>Cheers,<o:p></o:p></p></div></div><div><p class=MsoNormal><br clear=all><o:p></o:p></p><div><div><div><div><p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>--<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Arial","sans-serif";color:#666666'>Youenn Piolet</span><span style='font-family:"Arial","sans-serif"'><o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:7.5pt;font-family:"Arial","sans-serif";color:#999999'><a href="mailto:piolet.y@gmail.com" target="_blank">piolet.y@gmail.com</a></span><span style='font-family:"Arial","sans-serif"'><o:p></o:p></span></p></div><div><div><p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p></div></div></div></div></div><p class=MsoNormal><o:p> </o:p></p><div><p class=MsoNormal>2015-10-12 0:41 GMT+02:00 Youenn PIOLET <<a href="mailto:piolet.y@gmail.com" target="_blank">piolet.y@gmail.com</a>>:<o:p></o:p></p><div><p class=MsoNormal>Hi Chris,<o:p></o:p></p><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>First, to be sure were on the same page:<o:p></o:p></p></div><div><p class=MsoNormal>Without IPA, to make CIFS users authenticate against directory in a classic LDAP implementation, you need to extend your LDAP tree with Samba schema. The FreeNAS documentation is a bit light on this subjet and previous FreeNAS versions (stable 9.3 included) used to mess up rfc2307bis/rfc2307. I think it is fixed now, and know nothing about your 9.2 version. Wrote some messy stuff about it here: <a href="https://github.com/uZer/rootools/blob/master/ldap/integrations/ldap.integration.freenas.md" target="_blank">https://github.com/uZer/rootools/blob/master/ldap/integrations/ldap.integration.freenas.md</a><o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>To make CIFS users authenticate or FreeIPA recent versions (I only tried with 4.1), I suggest you to start by reading some of our investigations in this thread:<o:p></o:p></p></div><div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>[Freeipa-users] Ubuntu Samba Server Auth against IPA<o:p></o:p></p></div><div><p class=MsoNormal><a href="https://www.redhat.com/archives/freeipa-users/2015-August/thread.html#00000" target="_blank">https://www.redhat.com/archives/freeipa-users/2015-August/thread.html#00000</a><o:p></o:p></p></div></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>When we discuss about this in august, I've spend almost a week trying to make this integration with FreeNAS/FreeIPA work. I quit FreeNAS without fully understand why it didn't work, and moved our CIFS to a dedicated Centos server. Matt arrived with a similar situation in Ubuntu.<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>To quickly summarize the issue, FreeNAS and Ubuntu CIFS work by default with ldapsam.so module. FreeIPA developpers have built a AD trust exchange possibility with a custom ipasam module that isn't compiled yet for Ubuntu or FreeNAS. This module gives the possibility to use IPA AD trust components (e.g. special schema in IPA's directory managing user/group NT SID)<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>If you can't compile the module for FreeNAS / FreeBSD, you may need to extend 365directory with Samba schema.<o:p></o:p></p></div><div><p class=MsoNormal>You will need to find a way to generate the new attributes when adding users or groups in FreeIPA, and a way to store password in a CIFS/NT understandable way. I don't suggest you to follow this dark path.<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>You can also quit FreeNAS and migrate to CentOS with ipasam as I did ;)<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>Good luck in your experimentations, I hope you will succeed!<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal><br clear=all><o:p></o:p></p><div><div><div><div><p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>--<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-family:"Arial","sans-serif";color:#666666'>Youenn Piolet</span><span style='font-family:"Arial","sans-serif"'><o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:7.5pt;font-family:"Arial","sans-serif";color:#999999'><a href="mailto:piolet.y@gmail.com" target="_blank">piolet.y@gmail.com</a></span><span style='font-family:"Arial","sans-serif"'><o:p></o:p></span></p></div><div><div><p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><o:p> </o:p></span></p></div></div></div></div></div><p class=MsoNormal><o:p> </o:p></p><div><div><div><p class=MsoNormal>2015-10-11 2:06 GMT+02:00 Chris Tobey <<a href="mailto:tobeychris@hotmail.com" target="_blank">tobeychris@hotmail.com</a>>:<o:p></o:p></p></div></div><blockquote style='border:none;border-left:solid #CCCCCC 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm'><div><div><div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>Hi Everyone,<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><br>I have a functioning FreeIPA server that manages all my users and I would like to also use it for my FreeNAS CIFS shares to authenticate against.<br><br>Does anyone know what needs to be run on both servers to get this working? I believe it has something to do with Samba properties on the FreeIPA side.<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>I had tried asking the FreeNAS forums but they were of no help (<a href="https://forums.freenas.org/index.php?threads/freeipa-and-freenas-ldap-setup.37083/" target="_blank">https://forums.freenas.org/index.php?threads/freeipa-and-freenas-ldap-setup.37083/</a>).<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>I have seen similar requests and success stories, but no actual steps on how to do it.<br><br>Info: <br>FreeIPA v3.0.0-42 running on CentOS 6.6.<br>FreeNAS 9.2.1.9 (can use 9.3 if easier, was trying to get it working before dealing with certs).<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>Any help is appreciated.<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>Thanks,<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>-Chris<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p></div></div><p class=MsoNormal><o:p> </o:p></p></div></div><p class=MsoNormal><span class=hoenzb><span style='color:#888888'>--</span></span><span style='color:#888888'><br><span class=hoenzb>Manage your subscription for the Freeipa-users mailing list:</span><br><span class=hoenzb><a href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a></span><br><span class=hoenzb>Go to <a href="http://freeipa.org" target="_blank">http://freeipa.org</a> for more info on the project</span></span><o:p></o:p></p></blockquote></div><p class=MsoNormal><o:p> </o:p></p></div></div></div><p class=MsoNormal><o:p> </o:p></p></div></div></body></html>