[Freeipa-users] Ubuntu Samba Server Auth against IPA
Matt .
yamakasi.014 at gmail.com
Sun Aug 9 14:45:41 UTC 2015
Hi Chris,
This sounds great!
What are you using now, both CentOS ? So Samba and FreeIPA ?
Maybe it's good to explain which way you used now in steps too, so we
can combine or create multiple howto's ?
At least we are going somewhere!
Thanks,
Matt
2015-08-09 14:54 GMT+02:00 Christopher Lamb <christopher.lamb at ch.ibm.com>:
> Hi Matt
>
> My test integration of FreeIPA 4.x and Samba 4.x with the "good old Samba
> Schema extensions) is up and working, almost flawlessly.
>
> I can add users and groups via the FreeIPA CLI, and they get the correct
> ObjectClasses / attributes required for Samba.
>
> So far I have not yet bothered to try the extensions to the WebUI, because
> it is currently giving me the classic "Your session has expired. Please
> re-login." error which renders the WebUI useless.
>
> The only problem I have so far encountered managing Samba / FreeIPA users
> via FreeIPA CLI commands is with the handling of the attribute
> sambaPwdLastSet. This is the subject of an existing thread, also updated
> today.
>
> There is also an existing alternative to hacking group.py, using "Class of
> Service" (Cos) documented in this thread from February 2015
> https://www.redhat.com/archives/freeipa-users/2015-February/msg00172.html.
> I have not yet tried it, but it sounds reasonable.
>
> Chris
>
>
>
>
>
> From: "Matt ." <yamakasi.014 at gmail.com>
> To: Christopher Lamb/Switzerland/IBM at IBMCH
> Cc: "freeipa-users at redhat.com" <freeipa-users at redhat.com>, Youenn
> PIOLET <piolet.y at gmail.com>
> Date: 06.08.2015 16:19
> Subject: Re: [Freeipa-users] Ubuntu Samba Server Auth against IPA
>
>
>
> Hi Chris,
>
> OK, than we might create two different versions of the wiki, I think
> this is nice.
>
> I'm still figuring out why I get that:
>
> IPA Error 4205: ObjectclassViolation
>
> missing attribute "sambaGroupType" required by object class
> "sambaGroupMapping"
>
> Matt
>
> 2015-08-06 16:09 GMT+02:00 Christopher Lamb <christopher.lamb at ch.ibm.com>:
>> Hi Matt
>>
>> As far as I can make out, there are at least 2 viable Samba / FreeIPA
>> integration paths.
>>
>> The route I took is suited where there is no Active Directory involved:
> In
>> my case all the Windows, OSX and Linux clients are islands that sit on
> the
>> same network.
>>
>> The route that Youenn has taken (unless I have got completely the wrong
> end
>> of the stick) requires Active Directory in the architecture.
>>
>> Chris
>>
>>
>>
>> From: "Matt ." <yamakasi.014 at gmail.com>
>> To: Youenn PIOLET <piolet.y at gmail.com>
>> Cc: Christopher Lamb/Switzerland/IBM at IBMCH,
>> "freeipa-users at redhat.com" <freeipa-users at redhat.com>
>> Date: 06.08.2015 14:42
>> Subject: Re: [Freeipa-users] Ubuntu Samba Server Auth against IPA
>>
>>
>>
>> Hi,
>>
>> OK, this sounds already quite logical, but I'm still refering to the
>> old howto we found earlier, does that one still apply somewhere or not
>> at all ?
>>
>> Thanks,
>>
>> Matt
>>
>>
>>
>> 2015-08-06 12:23 GMT+02:00 Youenn PIOLET <piolet.y at gmail.com>:
>>> Hey guys,
>>>
>>> I'll try to make a tutorial soon, sorry I'm quite in a rush these
> days :)
>>>
>>> General idea:
>>>
>>> On FreeIPA (4.1)
>>> - `ipa-adtrust-install --add-sids` (creates ipaNTsecurityidentifier
>>> attribude, also known as SID)
>>> - regenerate each user password to build ipaNTHash attribute, not here
> by
>>> default on users
>>> - use your ldap browser to check ipaNTHash values are here on user
>> objects
>>> - create a CIFS service for your samba server
>>> - Create user roles/permissions as described here:
>>>
>>
> http://freeipa-users.redhat.narkive.com/ez2uKpFS/authenticate-samba-3-or-4-with-freeipa
>
>>
>>> so that CIFS service will be able to read ipaNTsecurityidentifier and
>>> ipaNTHash attributes in LDAP (ACI)
>>> - SCP ipasam.so module to your cifs server (this is the magic trick) :
>> scp
>>> /usr/lib64/samba/pdb/ipasam.so
>>> root at samba-server.domain:/usr/lib64/samba/pdb/ You can also try to
>> recompile
>>> it.
>>>
>>> On SAMBA Server side (CentOS 7...)
>>> - Install server keytab file for CIFS
>>> - check ipasam.so is here.
>>> - check you can read password hash in LDAP with `ldapsearch -Y GSSAPI
>>> uid=admin ipaNTHash` thanks to kerberos
>>> - make your smb.conf following the linked thread and restart service
>>>
>>> I don't know if it works in Ubuntu. I know sssd has evolved quickly and
>>> ipasam may use quite recent functionalities, the best is to just try.
> You
>>> can read in previous thread : "If you insist on Ubuntu you need to get
>>> ipasam somewhere, most likely to compile it yourself".
>>>
>>> Make sure your user has ipaNTHash attribute :)
>>>
>>> You may want to debug authentication on samba server, I usually do this:
>>> `tail -f /var/log/samba/log* | grep <username>
>>>
>>> Cheers
>>> --
>>> Youenn Piolet
>>> piolet.y at gmail.com
>>>
>>>
>>> 2015-08-05 17:40 GMT+02:00 Matt . <yamakasi.014 at gmail.com>:
>>>>
>>>> Hi,
>>>>
>>>> This sounds great to me too, but a howto would help to make it more
>>>> clear about what you have done here. The thread confuses me a little
>>>> bit.
>>>>
>>>> Can you paste your commands so we can test out too and report back ?
>>>>
>>>> Thanks!
>>>>
>>>> Matt
>>>>
>>>> 2015-08-05 15:18 GMT+02:00 Christopher Lamb
>> <christopher.lamb at ch.ibm.com>:
>>>> > Hi Youenn
>>>> >
>>>> > Good news that you have got an integration working
>>>> >
>>>> > Now you have got it going, and the solution is fresh in your mind,
> how
>>>> > about adding a How-to page on this solution to the FreeIPA wiki?
>>>> >
>>>> > Chris
>>>> >
>>>> >
>>>> >
>>>> > From: Youenn PIOLET <piolet.y at gmail.com>
>>>> > To: "Matt ." <yamakasi.014 at gmail.com>
>>>> > Cc: Christopher Lamb/Switzerland/IBM at IBMCH,
>>>> > "freeipa-users at redhat.com" <freeipa-users at redhat.com>
>>>> > Date: 05.08.2015 14:51
>>>> > Subject: Re: [Freeipa-users] Ubuntu Samba Server Auth against
>> IPA
>>>> >
>>>> >
>>>> >
>>>> > Hi guys,
>>>> >
>>>> > Thank you so much your previous answers.
>>>> > I realised my SID were stored in ipaNTsecurityidentifier, thanks to
>>>> > ipa-adtrust-install --add-sids
>>>> >
>>>> > I found an other way to configure smb here:
>>>> >
>>>> >
>>
> http://freeipa-users.redhat.narkive.com/ez2uKpFS/authenticate-samba-3-or-4-with-freeipa
>
>>
>>>> > It works perfectly.
>>>> >
>>>> > I'm using module ipasam.so I have manually scp to the samba server,
>>>> > Samba is set to use kerberos + ldapsam via this ipasam module.
>>>> > Following the instructions, I created a user role allowing service
>>>> > principal to read ipaNTHash value from the LDAP.
>>>> > ipaNTHash are generated each time a user changes his password.
>>>> > Authentication works perfectly on Windows 7, 8 and 10.
>>>> >
>>>> > For more details, the previously linked thread is quite clear.
>>>> >
>>>> > Cheers
>>>> >
>>>> > --
>>>> > Youenn Piolet
>>>> > piolet.y at gmail.com
>>>> >
>>>> >
>>>> > 2015-08-05 11:10 GMT+02:00 Matt . <yamakasi.014 at gmail.com>:
>>>> > Hi Chris.
>>>> >
>>>> > Yes, Apache Studio did that but I was not sure why it complained it
>>>> > was "already" there.
>>>> >
>>>> > I'm still getting:
>>>> >
>>>> > IPA Error 4205: ObjectclassViolation
>>>> >
>>>> > missing attribute "sambaGroupType" required by object class
>>>> > "sambaGroupMapping"
>>>> >
>>>> > When adding a user.
>>>> >
>>>> > I also see "class" as fielname under my "Last name", this is not OK
>>>> > also.
>>>> >
>>>> >
>>>> >
>>>> > We sure need to make some howto, I think we can nail this down :)
>>>> >
>>>> > Thanks for the heads up!
>>>> >
>>>> > Matthijs
>>>> >
>>>> > 2015-08-05 7:51 GMT+02:00 Christopher Lamb
>>>> > <christopher.lamb at ch.ibm.com>:
>>>> > > Hi Matt
>>>> > >
>>>> > > If I use Apache Directory Studio to add an attribute
>> ipaCustomFields
>>>> > to
>>>> > > cn=ipaConfig,cn=etc, the operation it performs is a modify, as
>> shown
>>>> > below:
>>>> > >
>>>> > > #!RESULT OK
>>>> > > #!CONNECTION ldap://xxx-ldap2.my.silly.example.com:yyy
>>>> > > #!DATE 2015-08-05T05:45:04.608
>>>> > > dn: cn=ipaConfig,cn=etc,dc=my,dc=silly,dc=example,dc=com
>>>> > > changetype: modify
>>>> > > add: ipaCustomFields
>>>> > > ipaCustomFields: Samba Group Type,sambagrouptype,true
>>>> > >
>>>> > > After that I then have a visible attribute ipaCustomFields as
>>>> > expected.
>>>> > >
>>>> > > When adding the attribute, the wizard offered me
> "ipaCustomFields"
>>>> > as
>>>> > > attribute type in a drop down list.
>>>> > >
>>>> > > Once we get this cracked, we really must write a how-to on the
>>>> > FreeIPA
>>>> > > Wiki.
>>>> > >
>>>> > > Chris
>>>> > >
>>>> > >
>>>> > >
>>>> > > From: Christopher Lamb/Switzerland/IBM at IBMCH
>>>> > > To: "Matt ." <yamakasi.014 at gmail.com>
>>>> > > Cc: "freeipa-users at redhat.com" <freeipa-users at redhat.com>
>>>> > > Date: 05.08.2015 07:31
>>>> > > Subject: Re: [Freeipa-users] Ubuntu Samba Server Auth
>> against
>>>> > IPA
>>>> > > Sent by: freeipa-users-bounces at redhat.com
>>>> > >
>>>> > >
>>>> > >
>>>> > > Hi Matt
>>>> > >
>>>> > > I also got the same result at that step, but can see nothing in
>>>> > Apache
>>>> > > Directory Studio.
>>>> > >
>>>> > > As I am using existing Samba / FreeIPA groups migrated across,
>> they
>>>> > > probably were migrated with all the required attributes.
>>>> > >
>>>> > > Looking more closely at that LDIF: I wonder should it not be:
>>>> > >
>>>> > > ldapmodify -Y GSSAPI <<EOF
>>>> > > dn: cn=ipaconfig,cn=etc,dc=domain,dc=tld
>>>> > > changetype: modify
>>>> > > add: ipaCustomFields
>>>> > > ipaCustomFields: "Samba Group Type,sambagrouptype,true"
>>>> > > EOF
>>>> > >
>>>> > > i.e. changetype: modify, instead of changetype add ?
>>>> > >
>>>> > > I don't want to play around with my prod directory - I will setup
>> an
>>>> > EL
>>>> > 7.1
>>>> > > VM and install FreeIPA 4.x and Samba 4.x That will allow me to
>> play
>>>> > around
>>>> > > more destructively.
>>>> > >
>>>> > > Chris
>>>> > >
>>>> > >
>>>> > >
>>>> > >
>>>> > >
>>>> > > From: "Matt ." <yamakasi.014 at gmail.com>
>>>> > > To: Christopher Lamb/Switzerland/IBM at IBMCH
>>>> > > Cc: Youenn PIOLET <piolet.y at gmail.com>, "
>>>> > freeipa-users at redhat.com"
>>>> > > <freeipa-users at redhat.com>
>>>> > > Date: 05.08.2015 01:01
>>>> > > Subject: Re: [Freeipa-users] Ubuntu Samba Server
>>>> > Auth
>>>> > against IPA
>>>> > >
>>>> > >
>>>> > >
>>>> > > Hi Chris,
>>>> > >
>>>> > > I'm at the right path, but my issue is that:
>>>> > >
>>>> > > ldapmodify -Y GSSAPI <<EOF
>>>> > > dn: cn=ipaconfig,cn=etc,dc=domain,dc=tld
>>>> > > changetype: add
>>>> > > add: ipaCustomFields
>>>> > > ipaCustomFields: "Samba Group Type,sambagrouptype,true"
>>>> > > EOF
>>>> > >
>>>> > > Does say it exists, my ldap explorer doesn't show it, and when I
>> add
>>>> > > it manually as an attribute it still fails when I add a user on
>> this
>>>> > > sambagrouptype as it's needed by the other attributes
>>>> > >
>>>> > > So that is my issue I think so far.
>>>> > >
>>>> > > Any clue about that ?
>>>> > >
>>>> > > No problem "you don't know something or are no guru" we are all
>>>> > > learning! :)
>>>> > >
>>>> > > Cheers,
>>>> > >
>>>> > > Matt
>>>> > >
>>>> > >
>>>> > > 2015-08-04 21:22 GMT+02:00 Christopher Lamb <
>>>> > christopher.lamb at ch.ibm.com>:
>>>> > >> Hi Matt, Youeen
>>>> > >>
>>>> > >> Just to set the background properly, I did not invent this
>> process.
>>>> > I
>>>> > > know
>>>> > >> only a little about FreeIPA, and almost nothing about Samba, but
>> I
>>>> > guess
>>>> > > I
>>>> > >> was lucky enough to get the integration working on a Sunday
>>>> > afternoon.
>>>> > (I
>>>> > >> did have an older FreeIPA 3.x / Samba 3.x installation as a
>>>> > reference).
>>>> > >>
>>>> > >> It sounds like we need to step back, and look at the test user
>> and
>>>> > group
>>>> > > in
>>>> > >> the FreeIPA LDAP tree. I find using an LDAP browser makes this
>> much
>>>> > > easier.
>>>> > >>
>>>> > >> My FreeIPA / Samba Users have the following Samba extensions in
>>>> > FreeIPA
>>>> > >> (cn=accounts, cn=users):
>>>> > >>
>>>> > >> * objectClass: sambasamaccount
>>>> > >>
>>>> > >> * Attributes: sambaSID, sambaNTPassword, sambaPwdLastSet
>>>> > >>
>>>> > >> My FreeIPA / Samba Groups have the following Samba extensions in
>>>> > FreeIPA
>>>> > >> (cn=accounts, cn=groups):
>>>> > >>
>>>> > >> * objectClass: sambaGroupMapping
>>>> > >>
>>>> > >> * Attributes: sambaGroupType, sambaSID
>>>> > >>
>>>> > >> The Users must belong to one or more of the samba groups that
> you
>>>> > have
>>>> > >> setup.
>>>> > >>
>>>> > >> If you don't have something similar to the above (which sounds
>> like
>>>> > it
>>>> > is
>>>> > >> the case), then something went wrong applying the extensions. It
>>>> > would
>>>> > be
>>>> > >> worth testing comparing a new user / group created post adding
>> the
>>>> > >> extensions to a previous existing user.
>>>> > >>
>>>> > >> i.e.
>>>> > >> are the extensions missing on existing users / groups?
>>>> > >> are the extensions missing on new users / groups?
>>>> > >>
>>>> > >> Cheers
>>>> > >>
>>>> > >> Chris
>>>> > >>
>>>> > >>
>>>> > >>
>>>> > >>
>>>> > >>
>>>> > >> From: Youenn PIOLET <piolet.y at gmail.com>
>>>> > >> To: "Matt ." <yamakasi.014 at gmail.com>
>>>> > >> Cc: Christopher Lamb/Switzerland/IBM at IBMCH,
>>>> > >> "freeipa-users at redhat.com"
> <freeipa-users at redhat.com>
>>>> > >> Date: 04.08.2015 18:56
>>>> > >> Subject: Re: [Freeipa-users] Ubuntu Samba Server Auth
>>>> > against
>>>> > IPA
>>>> > >>
>>>> > >>
>>>> > >>
>>>> > >> Hi there,
>>>> > >>
>>>> > >> I have difficulties to follow you at this point :)
>>>> > >> Here is what I've done and what I've understood:
>>>> > >>
>>>> > >> ## SMB Side
>>>> > >> - Testparm OK
>>>> > >> - I've got the same NT_STATUS_NO_SUCH_USER when I try to
> connect.
>>>> > >> - pdbedit -Lv output is all successfull but I can see there is a
>>>> > filter :
>>>> > >> (&(uid=*)(objectclass=sambaSamAccount). In LDAP, the users don't
>>>> > have
>>>> > >> sambaSamAccount.
>>>> > >>
>>>> > >> ## LDAP / FreeIPA side
>>>> > >> - Since SMB server uses LDAP, I did ipa-adtrust-install on my
>>>> > FreeIPA
>>>> > >> server to get samba LDAP extensions.
>>>> > >> - I can see samba classes exist in LDAP but are not used on my
>>>> > group
>>>> > >> objects nor my user objects
>>>> > >> - I have add sambaSamAccount in FreeIPA default user classes,
>>>> > >> and sambaGroupMapping to default group classes. In that state I
>>>> > can't
>>>> > >> create user nor groups anymore, as new samba attributes are
>> needed
>>>> > for
>>>> > >> instantiation.
>>>> > >> - I have add in etc ipaCustomFields: 'Samba Group
>>>> > > Type,sambagrouptype,true'
>>>> > >> but I don't get what it does.
>>>> > >> - I tried to add the samba.js plugin. It works, and adds the
>>>> > "local"
>>>> > > option
>>>> > >> when creating a group in FreeIPA, supposed to set sambagrouptype
>> to
>>>> > 4
>>>> > or
>>>> > > 2
>>>> > >> (domain). It doesn't work and tells that sambagrouptype
> attribute
>>>> > doesn't
>>>> > >> exist (but it should now I put sambaGroupType class by
>> default...)
>>>> > >>
>>>> > >> ## Questions
>>>> > >> 0) Can I ask samba not to search sambaSamAccount and use unix /
>>>> > posix
>>>> > >> instead? I guess no.
>>>> > >> 1) How to generate the user/group SIDs ? They are requested to
>> add
>>>> > >> sambaSamAccount classes.
>>>> > >> This article doesn't seem relevant since we don't use domain
>>>> > controller
>>>> > >>
>>>> > >
>>>> >
>>>> >
>>
> http://docs.fedoraproject.org/en-US/Fedora/17/html/FreeIPA_Guide/cifs.html
>>>> >
>>>> > >> and netgetlocalsid returns an error.
>>>> > >> 2) How to fix samba.js plugin?
>>>> > >> 3) I guess an equivalent of samba.js is needed for user
> creation,
>>>> > where
>>>> > > can
>>>> > >> I find it?
>>>> > >> 4) Is your setup working with Windows 8 / Windows 10 and not
> only
>>>> > Windows
>>>> > >> 7?
>>>> > >>
>>>> > >> Thanks a lot for your previous and future answers
>>>> > >>
>>>> > >> --
>>>> > >> Youenn Piolet
>>>> > >> piolet.y at gmail.com
>>>> > >>
>>>> > >>
>>>> > >> 2015-08-04 17:55 GMT+02:00 Matt . <yamakasi.014 at gmail.com>:
>>>> > >> Hi,
>>>> > >>
>>>> > >> Yes, log is anonymised.
>>>> > >>
>>>> > >> It's strange, my user doesn't have a SambaPwdLastSet, also
> when
>> I
>>>> > >> change it's password it doesn't get it in ldap.
>>>> > >>
>>>> > >> There must be something going wrong I guess.
>>>> > >>
>>>> > >> Matt
>>>> > >>
>>>> > >> 2015-08-04 17:45 GMT+02:00 Christopher Lamb
>>>> > > <christopher.lamb at ch.ibm.com
>>>> > >> >:
>>>> > >> > Hi Matt
>>>> > >> >
>>>> > >> > I assume [username] is a real username, identical to that in
>>>> > the
>>>> > >> FreeIPA
>>>> > >> > cn=accounts, cn=users tree? (i.e. you anonymised the log
>>>> > extract).
>>>> > >> >
>>>> > >> > You user should be a member of the appropriate samba groups
>>>> > that
>>>> > you
>>>> > >> setup
>>>> > >> > in FreeIPA.
>>>> > >> >
>>>> > >> > You should check that the user attribute SambaPwdLastSet is
>> set
>>>> > to
>>>> > a
>>>> > >> > positive value (e.g. 1). If not you get an error in the
> Samba
>>>> > logs
>>>> > -
>>>> > > I
>>>> > >> > would need to play around again with a test user to find out
>>>> > the
>>>> > > exact
>>>> > >> > error.
>>>> > >> >
>>>> > >> > I don't understand what you mean about syncing the users
>> local,
>>>> > but
>>>> > > we
>>>> > >> did
>>>> > >> > not need to do anything like that.
>>>> > >> >
>>>> > >> > Chris
>>>> > >> >
>>>> > >> >
>>>> > >> >
>>>> > >> >
>>>> > >> > From: "Matt ." <yamakasi.014 at gmail.com>
>>>> > >> > To: Christopher Lamb/Switzerland/IBM at IBMCH
>>>> > >> > Cc: "freeipa-users at redhat.com"
> <freeipa-users at redhat.com>
>>>> > >> > Date: 04.08.2015 15:33
>>>> > >> > Subject: Re: [Freeipa-users] Ubuntu Samba Server Auth
>>>> > against
>>>> > >> IPA
>>>> > >> >
>>>> > >> >
>>>> > >> >
>>>> > >> > Hi Chris,
>>>> > >> >
>>>> > >> > A puppet run added another passdb backend, that was causing
>> my
>>>> > issue.
>>>> > >> >
>>>> > >> > What I still experience is:
>>>> > >> >
>>>> > >> >
>>>> > >> > [2015/08/04 15:29:45.477783, 3]
>>>> > >> > ../source3/auth/check_samsec.c:399(check_sam_security)
>>>> > >> > check_sam_security: Couldn't find user 'username' in
>> passdb.
>>>> > >> > [2015/08/04 15:29:45.478026, 2]
>>>> > >> > ../source3/auth/auth.c:288(auth_check_ntlm_password)
>>>> > >> > check_ntlm_password: Authentication for user [username]
> ->
>>>> > >> > [username] FAILED with error NT_STATUS_NO_SUCH_USER
>>>> > >> >
>>>> > >> >
>>>> > >> > I also wonder if I shall still sync the users local, or is
> it
>>>> > > needed ?
>>>> > >> >
>>>> > >> > Thanks again,
>>>> > >> >
>>>> > >> > Matt
>>>> > >> >
>>>> > >> > 2015-08-04 14:16 GMT+02:00 Christopher Lamb <
>>>> > >> christopher.lamb at ch.ibm.com>:
>>>> > >> >> Hi Matt
>>>> > >> >>
>>>> > >> >> From our smb.conf file:
>>>> > >> >>
>>>> > >> >> [global]
>>>> > >> >> security = user
>>>> > >> >> passdb backend =
>>>> > ldapsam:ldap://xxx-ldap2.my.silly.example.com
>>>> > >> >> ldap suffix = dc=my,dc=silly,dc=example,dc=com
>>>> > >> >> ldap admin dn = cn=Directory Manager
>>>> > >> >>
>>>> > >> >> So yes, we use Directory Manager, it works for us. I have
>> not
>>>> > tried
>>>> > >> with
>>>> > >> > a
>>>> > >> >> less powerful user, but it is conceivable that a lesser
> user
>>>> > may
>>>> > not
>>>> > >> see
>>>> > >> >> all the required attributes, resulting in "no such user"
>>>> > errors.
>>>> > >> >>
>>>> > >> >> Chris
>>>> > >> >>
>>>> > >> >>
>>>> > >> >>
>>>> > >> >>
>>>> > >> >> From: "Matt ." <yamakasi.014 at gmail.com>
>>>> > >> >> To: Christopher Lamb/Switzerland/IBM at IBMCH
>>>> > >> >> Cc: "freeipa-users at redhat.com"
>> <freeipa-users at redhat.com>
>>>> > >> >> Date: 04.08.2015 13:32
>>>> > >> >> Subject: Re: [Freeipa-users] Ubuntu Samba Server
> Auth
>>>> > against
>>>> > >> IPA
>>>> > >> >>
>>>> > >> >>
>>>> > >> >>
>>>> > >> >> Hi Chris,
>>>> > >> >>
>>>> > >> >> Thanks for the heads up, indeed local is 4 I see now when I
>>>> > add a
>>>> > >> >> group from the GUI, great thanks!
>>>> > >> >>
>>>> > >> >> But do you use Directory Manager as ldap admin user or some
>>>> > other
>>>> > >> >> admin account ?
>>>> > >> >>
>>>> > >> >> I'm not sure id DM is needed and it should get that deep
>> into
>>>> > IPA.
>>>> > >> >> Also when starting samba it cannot find "such user" as that
>>>> > sounds
>>>> > >> >> quite known as it has no UID.
>>>> > >> >>
>>>> > >> >> From your config I see you use DM, this should work ?
>>>> > >> >>
>>>> > >> >> Thanks!
>>>> > >> >>
>>>> > >> >>
>>>> > >> >> Matt
>>>> > >> >>
>>>> > >> >>
>>>> > >> >
>>>> > >> >
>>>> > >> >
>>>> > >> >
>>>> > >>
>>>> > >> --
>>>> > >> Manage your subscription for the Freeipa-users mailing list:
>>>> > >> https://www.redhat.com/mailman/listinfo/freeipa-users
>>>> > >> Go to http://freeipa.org for more info on the project
>>>> > >>
>>>> > >>
>>>> > >>
>>>> > >
>>>> > >
>>>> > >
>>>> > >
>>>> > > --
>>>> > > Manage your subscription for the Freeipa-users mailing list:
>>>> > > https://www.redhat.com/mailman/listinfo/freeipa-users
>>>> > > Go to http://freeipa.org for more info on the project
>>>> > >
>>>> > >
>>>> > >
>>>> > >
>>>> >
>>>> > --
>>>> > Manage your subscription for the Freeipa-users mailing list:
>>>> > https://www.redhat.com/mailman/listinfo/freeipa-users
>>>> > Go to http://freeipa.org for more info on the project
>>>> >
>>>> >
>>>> >
>>>
>>>
>>
>>
>>
>>
>
>
>
>
More information about the Freeipa-users
mailing list