[Freeipa-users] Ubuntu Samba Server Auth against IPA
Matt .
yamakasi.014 at gmail.com
Wed Aug 12 17:00:16 UTC 2015
HI GUys,
I'm testing this out and I think I almost setup, this on a CentOS samba server.
I'm using the ipa-adtrust way of Youeen but it seems we still need to
add (objectclass=sambaSamAccount)) ?
Info is welcome!
I will report back when I have it working.
Thanks!
Matt
2015-08-10 11:16 GMT+02:00 Christopher Lamb <christopher.lamb at ch.ibm.com>:
> The next route I will try - is the one Youeen took, using ipa-adtrust
>
>
>
> From: "Matt ." <yamakasi.014 at gmail.com>
> To: Christopher Lamb/Switzerland/IBM at IBMCH,
> "freeipa-users at redhat.com" <freeipa-users at redhat.com>
> Date: 10.08.2015 10:03
> Subject: Re: [Freeipa-users] Ubuntu Samba Server Auth against IPA
>
>
>
> Hi Chris,
>
> Okay this is good to hear.
>
> But don't we want a IPA managed Scheme ?
>
> When I did a "ipa-adtrust-install --add-sids" it also wanted a local
> installed Samba and I wonder why.
>
> Good that we make some progres on making it all clear.
>
> Cheers,
>
> Matt
>
> 2015-08-10 6:12 GMT+02:00 Christopher Lamb <christopher.lamb at ch.ibm.com>:
>> ldapsam + the samba extensions, pretty much as described in the
> Techslaves
>> article. Once I have a draft for the wiki page, I will mail you.
>>
>>
>>
>> From: "Matt ." <yamakasi.014 at gmail.com>
>> To: Christopher Lamb/Switzerland/IBM at IBMCH,
>> "freeipa-users at redhat.com" <freeipa-users at redhat.com>
>> Date: 09.08.2015 21:17
>> Subject: Re: [Freeipa-users] Ubuntu Samba Server Auth against IPA
>>
>>
>>
>> Hi,
>>
>> Yes I know about "anything" but which way did you use now ?
>>
>>
>>
>> 2015-08-09 20:56 GMT+02:00 Christopher Lamb
> <christopher.lamb at ch.ibm.com>:
>>> Hi Matt
>>>
>>> I am on OEL 7.1. - so anything that works on that should be good for
> RHEL
>>> and Centos 7.x
>>>
>>> I intend to add a how-to to the FreeIPA Wiki over the next few days. As
>> we
>>> have suggested earlier, we will likely end up with several, one for each
>> of
>>> the possible integration paths.
>>>
>>> Chris
>>>
>>>
>>>
>>>
>>>
>>> From: "Matt ." <yamakasi.014 at gmail.com>
>>> To: Christopher Lamb/Switzerland/IBM at IBMCH,
>>> "freeipa-users at redhat.com" <freeipa-users at redhat.com>
>>> Date: 09.08.2015 16:45
>>> Subject: Re: [Freeipa-users] Ubuntu Samba Server Auth against IPA
>>>
>>>
>>>
>>> Hi Chris,
>>>
>>> This sounds great!
>>>
>>> What are you using now, both CentOS ? So Samba and FreeIPA ?
>>>
>>> Maybe it's good to explain which way you used now in steps too, so we
>>> can combine or create multiple howto's ?
>>>
>>> At least we are going somewhere!
>>>
>>> Thanks,
>>>
>>> Matt
>>>
>>> 2015-08-09 14:54 GMT+02:00 Christopher Lamb
>> <christopher.lamb at ch.ibm.com>:
>>>> Hi Matt
>>>>
>>>> My test integration of FreeIPA 4.x and Samba 4.x with the "good old
>> Samba
>>>> Schema extensions) is up and working, almost flawlessly.
>>>>
>>>> I can add users and groups via the FreeIPA CLI, and they get the
> correct
>>>> ObjectClasses / attributes required for Samba.
>>>>
>>>> So far I have not yet bothered to try the extensions to the WebUI,
>>> because
>>>> it is currently giving me the classic "Your session has expired. Please
>>>> re-login." error which renders the WebUI useless.
>>>>
>>>> The only problem I have so far encountered managing Samba / FreeIPA
>> users
>>>> via FreeIPA CLI commands is with the handling of the attribute
>>>> sambaPwdLastSet. This is the subject of an existing thread, also
> updated
>>>> today.
>>>>
>>>> There is also an existing alternative to hacking group.py, using "Class
>>> of
>>>> Service" (Cos) documented in this thread from February 2015
>>>>
>> https://www.redhat.com/archives/freeipa-users/2015-February/msg00172.html
>>> .
>>>> I have not yet tried it, but it sounds reasonable.
>>>>
>>>> Chris
>>>>
>>>>
>>>>
>>>>
>>>>
>>>> From: "Matt ." <yamakasi.014 at gmail.com>
>>>> To: Christopher Lamb/Switzerland/IBM at IBMCH
>>>> Cc: "freeipa-users at redhat.com" <freeipa-users at redhat.com>, Youenn
>>>> PIOLET <piolet.y at gmail.com>
>>>> Date: 06.08.2015 16:19
>>>> Subject: Re: [Freeipa-users] Ubuntu Samba Server Auth against
> IPA
>>>>
>>>>
>>>>
>>>> Hi Chris,
>>>>
>>>> OK, than we might create two different versions of the wiki, I think
>>>> this is nice.
>>>>
>>>> I'm still figuring out why I get that:
>>>>
>>>> IPA Error 4205: ObjectclassViolation
>>>>
>>>> missing attribute "sambaGroupType" required by object class
>>>> "sambaGroupMapping"
>>>>
>>>> Matt
>>>>
>>>> 2015-08-06 16:09 GMT+02:00 Christopher Lamb
>>> <christopher.lamb at ch.ibm.com>:
>>>>> Hi Matt
>>>>>
>>>>> As far as I can make out, there are at least 2 viable Samba / FreeIPA
>>>>> integration paths.
>>>>>
>>>>> The route I took is suited where there is no Active Directory
> involved:
>>>> In
>>>>> my case all the Windows, OSX and Linux clients are islands that sit on
>>>> the
>>>>> same network.
>>>>>
>>>>> The route that Youenn has taken (unless I have got completely the
> wrong
>>>> end
>>>>> of the stick) requires Active Directory in the architecture.
>>>>>
>>>>> Chris
>>>>>
>>>>>
>>>>>
>>>>> From: "Matt ." <yamakasi.014 at gmail.com>
>>>>> To: Youenn PIOLET <piolet.y at gmail.com>
>>>>> Cc: Christopher Lamb/Switzerland/IBM at IBMCH,
>>>>> "freeipa-users at redhat.com" <freeipa-users at redhat.com>
>>>>> Date: 06.08.2015 14:42
>>>>> Subject: Re: [Freeipa-users] Ubuntu Samba Server Auth against
>> IPA
>>>>>
>>>>>
>>>>>
>>>>> Hi,
>>>>>
>>>>> OK, this sounds already quite logical, but I'm still refering to the
>>>>> old howto we found earlier, does that one still apply somewhere or not
>>>>> at all ?
>>>>>
>>>>> Thanks,
>>>>>
>>>>> Matt
>>>>>
>>>>>
>>>>>
>>>>> 2015-08-06 12:23 GMT+02:00 Youenn PIOLET <piolet.y at gmail.com>:
>>>>>> Hey guys,
>>>>>>
>>>>>> I'll try to make a tutorial soon, sorry I'm quite in a rush these
>>>> days :)
>>>>>>
>>>>>> General idea:
>>>>>>
>>>>>> On FreeIPA (4.1)
>>>>>> - `ipa-adtrust-install --add-sids` (creates ipaNTsecurityidentifier
>>>>>> attribude, also known as SID)
>>>>>> - regenerate each user password to build ipaNTHash attribute, not
> here
>>>> by
>>>>>> default on users
>>>>>> - use your ldap browser to check ipaNTHash values are here on user
>>>>> objects
>>>>>> - create a CIFS service for your samba server
>>>>>> - Create user roles/permissions as described here:
>>>>>>
>>>>>
>>>>
>>>
>>
> http://freeipa-users.redhat.narkive.com/ez2uKpFS/authenticate-samba-3-or-4-with-freeipa
>
>>
>>>
>>>>
>>>>>
>>>>>> so that CIFS service will be able to read ipaNTsecurityidentifier and
>>>>>> ipaNTHash attributes in LDAP (ACI)
>>>>>> - SCP ipasam.so module to your cifs server (this is the magic
> trick) :
>>>>> scp
>>>>>> /usr/lib64/samba/pdb/ipasam.so
>>>>>> root at samba-server.domain:/usr/lib64/samba/pdb/ You can also try to
>>>>> recompile
>>>>>> it.
>>>>>>
>>>>>> On SAMBA Server side (CentOS 7...)
>>>>>> - Install server keytab file for CIFS
>>>>>> - check ipasam.so is here.
>>>>>> - check you can read password hash in LDAP with `ldapsearch -Y GSSAPI
>>>>>> uid=admin ipaNTHash` thanks to kerberos
>>>>>> - make your smb.conf following the linked thread and restart service
>>>>>>
>>>>>> I don't know if it works in Ubuntu. I know sssd has evolved quickly
>> and
>>>>>> ipasam may use quite recent functionalities, the best is to just try.
>>>> You
>>>>>> can read in previous thread : "If you insist on Ubuntu you need to
> get
>>>>>> ipasam somewhere, most likely to compile it yourself".
>>>>>>
>>>>>> Make sure your user has ipaNTHash attribute :)
>>>>>>
>>>>>> You may want to debug authentication on samba server, I usually do
>>> this:
>>>>>> `tail -f /var/log/samba/log* | grep <username>
>>>>>>
>>>>>> Cheers
>>>>>> --
>>>>>> Youenn Piolet
>>>>>> piolet.y at gmail.com
>>>>>>
>>>>>>
>>>>>> 2015-08-05 17:40 GMT+02:00 Matt . <yamakasi.014 at gmail.com>:
>>>>>>>
>>>>>>> Hi,
>>>>>>>
>>>>>>> This sounds great to me too, but a howto would help to make it more
>>>>>>> clear about what you have done here. The thread confuses me a little
>>>>>>> bit.
>>>>>>>
>>>>>>> Can you paste your commands so we can test out too and report back ?
>>>>>>>
>>>>>>> Thanks!
>>>>>>>
>>>>>>> Matt
>>>>>>>
>>>>>>> 2015-08-05 15:18 GMT+02:00 Christopher Lamb
>>>>> <christopher.lamb at ch.ibm.com>:
>>>>>>> > Hi Youenn
>>>>>>> >
>>>>>>> > Good news that you have got an integration working
>>>>>>> >
>>>>>>> > Now you have got it going, and the solution is fresh in your mind,
>>>> how
>>>>>>> > about adding a How-to page on this solution to the FreeIPA wiki?
>>>>>>> >
>>>>>>> > Chris
>>>>>>> >
>>>>>>> >
>>>>>>> >
>>>>>>> > From: Youenn PIOLET <piolet.y at gmail.com>
>>>>>>> > To: "Matt ." <yamakasi.014 at gmail.com>
>>>>>>> > Cc: Christopher Lamb/Switzerland/IBM at IBMCH,
>>>>>>> > "freeipa-users at redhat.com" <freeipa-users at redhat.com>
>>>>>>> > Date: 05.08.2015 14:51
>>>>>>> > Subject: Re: [Freeipa-users] Ubuntu Samba Server Auth
>> against
>>>>> IPA
>>>>>>> >
>>>>>>> >
>>>>>>> >
>>>>>>> > Hi guys,
>>>>>>> >
>>>>>>> > Thank you so much your previous answers.
>>>>>>> > I realised my SID were stored in ipaNTsecurityidentifier, thanks
> to
>>>>>>> > ipa-adtrust-install --add-sids
>>>>>>> >
>>>>>>> > I found an other way to configure smb here:
>>>>>>> >
>>>>>>> >
>>>>>
>>>>
>>>
>>
> http://freeipa-users.redhat.narkive.com/ez2uKpFS/authenticate-samba-3-or-4-with-freeipa
>
>>
>>>
>>>>
>>>>>
>>>>>>> > It works perfectly.
>>>>>>> >
>>>>>>> > I'm using module ipasam.so I have manually scp to the samba
> server,
>>>>>>> > Samba is set to use kerberos + ldapsam via this ipasam module.
>>>>>>> > Following the instructions, I created a user role allowing service
>>>>>>> > principal to read ipaNTHash value from the LDAP.
>>>>>>> > ipaNTHash are generated each time a user changes his password.
>>>>>>> > Authentication works perfectly on Windows 7, 8 and 10.
>>>>>>> >
>>>>>>> > For more details, the previously linked thread is quite clear.
>>>>>>> >
>>>>>>> > Cheers
>>>>>>> >
>>>>>>> > --
>>>>>>> > Youenn Piolet
>>>>>>> > piolet.y at gmail.com
>>>>>>> >
>>>>>>> >
>>>>>>> > 2015-08-05 11:10 GMT+02:00 Matt . <yamakasi.014 at gmail.com>:
>>>>>>> > Hi Chris.
>>>>>>> >
>>>>>>> > Yes, Apache Studio did that but I was not sure why it complained
>>> it
>>>>>>> > was "already" there.
>>>>>>> >
>>>>>>> > I'm still getting:
>>>>>>> >
>>>>>>> > IPA Error 4205: ObjectclassViolation
>>>>>>> >
>>>>>>> > missing attribute "sambaGroupType" required by object class
>>>>>>> > "sambaGroupMapping"
>>>>>>> >
>>>>>>> > When adding a user.
>>>>>>> >
>>>>>>> > I also see "class" as fielname under my "Last name", this is not
>>> OK
>>>>>>> > also.
>>>>>>> >
>>>>>>> >
>>>>>>> >
>>>>>>> > We sure need to make some howto, I think we can nail this
> down :)
>>>>>>> >
>>>>>>> > Thanks for the heads up!
>>>>>>> >
>>>>>>> > Matthijs
>>>>>>> >
>>>>>>> > 2015-08-05 7:51 GMT+02:00 Christopher Lamb
>>>>>>> > <christopher.lamb at ch.ibm.com>:
>>>>>>> > > Hi Matt
>>>>>>> > >
>>>>>>> > > If I use Apache Directory Studio to add an attribute
>>>>> ipaCustomFields
>>>>>>> > to
>>>>>>> > > cn=ipaConfig,cn=etc, the operation it performs is a modify, as
>>>>> shown
>>>>>>> > below:
>>>>>>> > >
>>>>>>> > > #!RESULT OK
>>>>>>> > > #!CONNECTION ldap://xxx-ldap2.my.silly.example.com:yyy
>>>>>>> > > #!DATE 2015-08-05T05:45:04.608
>>>>>>> > > dn: cn=ipaConfig,cn=etc,dc=my,dc=silly,dc=example,dc=com
>>>>>>> > > changetype: modify
>>>>>>> > > add: ipaCustomFields
>>>>>>> > > ipaCustomFields: Samba Group Type,sambagrouptype,true
>>>>>>> > >
>>>>>>> > > After that I then have a visible attribute ipaCustomFields as
>>>>>>> > expected.
>>>>>>> > >
>>>>>>> > > When adding the attribute, the wizard offered me
>>>> "ipaCustomFields"
>>>>>>> > as
>>>>>>> > > attribute type in a drop down list.
>>>>>>> > >
>>>>>>> > > Once we get this cracked, we really must write a how-to on the
>>>>>>> > FreeIPA
>>>>>>> > > Wiki.
>>>>>>> > >
>>>>>>> > > Chris
>>>>>>> > >
>>>>>>> > >
>>>>>>> > >
>>>>>>> > > From: Christopher Lamb/Switzerland/IBM at IBMCH
>>>>>>> > > To: "Matt ." <yamakasi.014 at gmail.com>
>>>>>>> > > Cc: "freeipa-users at redhat.com" <freeipa-users at redhat.com>
>>>>>>> > > Date: 05.08.2015 07:31
>>>>>>> > > Subject: Re: [Freeipa-users] Ubuntu Samba Server Auth
>>>>> against
>>>>>>> > IPA
>>>>>>> > > Sent by: freeipa-users-bounces at redhat.com
>>>>>>> > >
>>>>>>> > >
>>>>>>> > >
>>>>>>> > > Hi Matt
>>>>>>> > >
>>>>>>> > > I also got the same result at that step, but can see nothing
> in
>>>>>>> > Apache
>>>>>>> > > Directory Studio.
>>>>>>> > >
>>>>>>> > > As I am using existing Samba / FreeIPA groups migrated across,
>>>>> they
>>>>>>> > > probably were migrated with all the required attributes.
>>>>>>> > >
>>>>>>> > > Looking more closely at that LDIF: I wonder should it not be:
>>>>>>> > >
>>>>>>> > > ldapmodify -Y GSSAPI <<EOF
>>>>>>> > > dn: cn=ipaconfig,cn=etc,dc=domain,dc=tld
>>>>>>> > > changetype: modify
>>>>>>> > > add: ipaCustomFields
>>>>>>> > > ipaCustomFields: "Samba Group Type,sambagrouptype,true"
>>>>>>> > > EOF
>>>>>>> > >
>>>>>>> > > i.e. changetype: modify, instead of changetype add ?
>>>>>>> > >
>>>>>>> > > I don't want to play around with my prod directory - I will
>>> setup
>>>>> an
>>>>>>> > EL
>>>>>>> > 7.1
>>>>>>> > > VM and install FreeIPA 4.x and Samba 4.x That will allow me to
>>>>> play
>>>>>>> > around
>>>>>>> > > more destructively.
>>>>>>> > >
>>>>>>> > > Chris
>>>>>>> > >
>>>>>>> > >
>>>>>>> > >
>>>>>>> > >
>>>>>>> > >
>>>>>>> > > From: "Matt ." <yamakasi.014 at gmail.com>
>>>>>>> > > To: Christopher Lamb/Switzerland/IBM at IBMCH
>>>>>>> > > Cc: Youenn PIOLET <piolet.y at gmail.com>, "
>>>>>>> > freeipa-users at redhat.com"
>>>>>>> > > <freeipa-users at redhat.com>
>>>>>>> > > Date: 05.08.2015 01:01
>>>>>>> > > Subject: Re: [Freeipa-users] Ubuntu Samba
>> Server
>>>>>>> > Auth
>>>>>>> > against IPA
>>>>>>> > >
>>>>>>> > >
>>>>>>> > >
>>>>>>> > > Hi Chris,
>>>>>>> > >
>>>>>>> > > I'm at the right path, but my issue is that:
>>>>>>> > >
>>>>>>> > > ldapmodify -Y GSSAPI <<EOF
>>>>>>> > > dn: cn=ipaconfig,cn=etc,dc=domain,dc=tld
>>>>>>> > > changetype: add
>>>>>>> > > add: ipaCustomFields
>>>>>>> > > ipaCustomFields: "Samba Group Type,sambagrouptype,true"
>>>>>>> > > EOF
>>>>>>> > >
>>>>>>> > > Does say it exists, my ldap explorer doesn't show it, and when
>> I
>>>>> add
>>>>>>> > > it manually as an attribute it still fails when I add a user
> on
>>>>> this
>>>>>>> > > sambagrouptype as it's needed by the other attributes
>>>>>>> > >
>>>>>>> > > So that is my issue I think so far.
>>>>>>> > >
>>>>>>> > > Any clue about that ?
>>>>>>> > >
>>>>>>> > > No problem "you don't know something or are no guru" we are
> all
>>>>>>> > > learning! :)
>>>>>>> > >
>>>>>>> > > Cheers,
>>>>>>> > >
>>>>>>> > > Matt
>>>>>>> > >
>>>>>>> > >
>>>>>>> > > 2015-08-04 21:22 GMT+02:00 Christopher Lamb <
>>>>>>> > christopher.lamb at ch.ibm.com>:
>>>>>>> > >> Hi Matt, Youeen
>>>>>>> > >>
>>>>>>> > >> Just to set the background properly, I did not invent this
>>>>> process.
>>>>>>> > I
>>>>>>> > > know
>>>>>>> > >> only a little about FreeIPA, and almost nothing about Samba,
>>> but
>>>>> I
>>>>>>> > guess
>>>>>>> > > I
>>>>>>> > >> was lucky enough to get the integration working on a Sunday
>>>>>>> > afternoon.
>>>>>>> > (I
>>>>>>> > >> did have an older FreeIPA 3.x / Samba 3.x installation as a
>>>>>>> > reference).
>>>>>>> > >>
>>>>>>> > >> It sounds like we need to step back, and look at the test
> user
>>>>> and
>>>>>>> > group
>>>>>>> > > in
>>>>>>> > >> the FreeIPA LDAP tree. I find using an LDAP browser makes
> this
>>>>> much
>>>>>>> > > easier.
>>>>>>> > >>
>>>>>>> > >> My FreeIPA / Samba Users have the following Samba extensions
>> in
>>>>>>> > FreeIPA
>>>>>>> > >> (cn=accounts, cn=users):
>>>>>>> > >>
>>>>>>> > >> * objectClass: sambasamaccount
>>>>>>> > >>
>>>>>>> > >> * Attributes: sambaSID, sambaNTPassword, sambaPwdLastSet
>>>>>>> > >>
>>>>>>> > >> My FreeIPA / Samba Groups have the following Samba extensions
>>> in
>>>>>>> > FreeIPA
>>>>>>> > >> (cn=accounts, cn=groups):
>>>>>>> > >>
>>>>>>> > >> * objectClass: sambaGroupMapping
>>>>>>> > >>
>>>>>>> > >> * Attributes: sambaGroupType, sambaSID
>>>>>>> > >>
>>>>>>> > >> The Users must belong to one or more of the samba groups that
>>>> you
>>>>>>> > have
>>>>>>> > >> setup.
>>>>>>> > >>
>>>>>>> > >> If you don't have something similar to the above (which
> sounds
>>>>> like
>>>>>>> > it
>>>>>>> > is
>>>>>>> > >> the case), then something went wrong applying the extensions.
>>> It
>>>>>>> > would
>>>>>>> > be
>>>>>>> > >> worth testing comparing a new user / group created post
> adding
>>>>> the
>>>>>>> > >> extensions to a previous existing user.
>>>>>>> > >>
>>>>>>> > >> i.e.
>>>>>>> > >> are the extensions missing on existing users / groups?
>>>>>>> > >> are the extensions missing on new users / groups?
>>>>>>> > >>
>>>>>>> > >> Cheers
>>>>>>> > >>
>>>>>>> > >> Chris
>>>>>>> > >>
>>>>>>> > >>
>>>>>>> > >>
>>>>>>> > >>
>>>>>>> > >>
>>>>>>> > >> From: Youenn PIOLET <piolet.y at gmail.com>
>>>>>>> > >> To: "Matt ." <yamakasi.014 at gmail.com>
>>>>>>> > >> Cc: Christopher Lamb/Switzerland/IBM at IBMCH,
>>>>>>> > >> "freeipa-users at redhat.com"
>>>> <freeipa-users at redhat.com>
>>>>>>> > >> Date: 04.08.2015 18:56
>>>>>>> > >> Subject: Re: [Freeipa-users] Ubuntu Samba Server Auth
>>>>>>> > against
>>>>>>> > IPA
>>>>>>> > >>
>>>>>>> > >>
>>>>>>> > >>
>>>>>>> > >> Hi there,
>>>>>>> > >>
>>>>>>> > >> I have difficulties to follow you at this point :)
>>>>>>> > >> Here is what I've done and what I've understood:
>>>>>>> > >>
>>>>>>> > >> ## SMB Side
>>>>>>> > >> - Testparm OK
>>>>>>> > >> - I've got the same NT_STATUS_NO_SUCH_USER when I try to
>>>> connect.
>>>>>>> > >> - pdbedit -Lv output is all successfull but I can see there
> is
>>> a
>>>>>>> > filter :
>>>>>>> > >> (&(uid=*)(objectclass=sambaSamAccount). In LDAP, the users
>>> don't
>>>>>>> > have
>>>>>>> > >> sambaSamAccount.
>>>>>>> > >>
>>>>>>> > >> ## LDAP / FreeIPA side
>>>>>>> > >> - Since SMB server uses LDAP, I did ipa-adtrust-install on my
>>>>>>> > FreeIPA
>>>>>>> > >> server to get samba LDAP extensions.
>>>>>>> > >> - I can see samba classes exist in LDAP but are not used on
> my
>>>>>>> > group
>>>>>>> > >> objects nor my user objects
>>>>>>> > >> - I have add sambaSamAccount in FreeIPA default user classes,
>>>>>>> > >> and sambaGroupMapping to default group classes. In that state
>> I
>>>>>>> > can't
>>>>>>> > >> create user nor groups anymore, as new samba attributes are
>>>>> needed
>>>>>>> > for
>>>>>>> > >> instantiation.
>>>>>>> > >> - I have add in etc ipaCustomFields: 'Samba Group
>>>>>>> > > Type,sambagrouptype,true'
>>>>>>> > >> but I don't get what it does.
>>>>>>> > >> - I tried to add the samba.js plugin. It works, and adds the
>>>>>>> > "local"
>>>>>>> > > option
>>>>>>> > >> when creating a group in FreeIPA, supposed to set
>>> sambagrouptype
>>>>> to
>>>>>>> > 4
>>>>>>> > or
>>>>>>> > > 2
>>>>>>> > >> (domain). It doesn't work and tells that sambagrouptype
>>>> attribute
>>>>>>> > doesn't
>>>>>>> > >> exist (but it should now I put sambaGroupType class by
>>>>> default...)
>>>>>>> > >>
>>>>>>> > >> ## Questions
>>>>>>> > >> 0) Can I ask samba not to search sambaSamAccount and use
>> unix /
>>>>>>> > posix
>>>>>>> > >> instead? I guess no.
>>>>>>> > >> 1) How to generate the user/group SIDs ? They are requested
> to
>>>>> add
>>>>>>> > >> sambaSamAccount classes.
>>>>>>> > >> This article doesn't seem relevant since we don't use domain
>>>>>>> > controller
>>>>>>> > >>
>>>>>>> > >
>>>>>>> >
>>>>>>> >
>>>>>
>>>>
>>>
>>
> http://docs.fedoraproject.org/en-US/Fedora/17/html/FreeIPA_Guide/cifs.html
>>>>>>> >
>>>>>>> > >> and netgetlocalsid returns an error.
>>>>>>> > >> 2) How to fix samba.js plugin?
>>>>>>> > >> 3) I guess an equivalent of samba.js is needed for user
>>>> creation,
>>>>>>> > where
>>>>>>> > > can
>>>>>>> > >> I find it?
>>>>>>> > >> 4) Is your setup working with Windows 8 / Windows 10 and not
>>>> only
>>>>>>> > Windows
>>>>>>> > >> 7?
>>>>>>> > >>
>>>>>>> > >> Thanks a lot for your previous and future answers
>>>>>>> > >>
>>>>>>> > >> --
>>>>>>> > >> Youenn Piolet
>>>>>>> > >> piolet.y at gmail.com
>>>>>>> > >>
>>>>>>> > >>
>>>>>>> > >> 2015-08-04 17:55 GMT+02:00 Matt . <yamakasi.014 at gmail.com>:
>>>>>>> > >> Hi,
>>>>>>> > >>
>>>>>>> > >> Yes, log is anonymised.
>>>>>>> > >>
>>>>>>> > >> It's strange, my user doesn't have a SambaPwdLastSet, also
>>>> when
>>>>> I
>>>>>>> > >> change it's password it doesn't get it in ldap.
>>>>>>> > >>
>>>>>>> > >> There must be something going wrong I guess.
>>>>>>> > >>
>>>>>>> > >> Matt
>>>>>>> > >>
>>>>>>> > >> 2015-08-04 17:45 GMT+02:00 Christopher Lamb
>>>>>>> > > <christopher.lamb at ch.ibm.com
>>>>>>> > >> >:
>>>>>>> > >> > Hi Matt
>>>>>>> > >> >
>>>>>>> > >> > I assume [username] is a real username, identical to that
>>> in
>>>>>>> > the
>>>>>>> > >> FreeIPA
>>>>>>> > >> > cn=accounts, cn=users tree? (i.e. you anonymised the log
>>>>>>> > extract).
>>>>>>> > >> >
>>>>>>> > >> > You user should be a member of the appropriate samba
>> groups
>>>>>>> > that
>>>>>>> > you
>>>>>>> > >> setup
>>>>>>> > >> > in FreeIPA.
>>>>>>> > >> >
>>>>>>> > >> > You should check that the user attribute SambaPwdLastSet
>> is
>>>>> set
>>>>>>> > to
>>>>>>> > a
>>>>>>> > >> > positive value (e.g. 1). If not you get an error in the
>>>> Samba
>>>>>>> > logs
>>>>>>> > -
>>>>>>> > > I
>>>>>>> > >> > would need to play around again with a test user to find
>>> out
>>>>>>> > the
>>>>>>> > > exact
>>>>>>> > >> > error.
>>>>>>> > >> >
>>>>>>> > >> > I don't understand what you mean about syncing the users
>>>>> local,
>>>>>>> > but
>>>>>>> > > we
>>>>>>> > >> did
>>>>>>> > >> > not need to do anything like that.
>>>>>>> > >> >
>>>>>>> > >> > Chris
>>>>>>> > >> >
>>>>>>> > >> >
>>>>>>> > >> >
>>>>>>> > >> >
>>>>>>> > >> > From: "Matt ." <yamakasi.014 at gmail.com>
>>>>>>> > >> > To: Christopher Lamb/Switzerland/IBM at IBMCH
>>>>>>> > >> > Cc: "freeipa-users at redhat.com"
>>>> <freeipa-users at redhat.com>
>>>>>>> > >> > Date: 04.08.2015 15:33
>>>>>>> > >> > Subject: Re: [Freeipa-users] Ubuntu Samba Server
>>> Auth
>>>>>>> > against
>>>>>>> > >> IPA
>>>>>>> > >> >
>>>>>>> > >> >
>>>>>>> > >> >
>>>>>>> > >> > Hi Chris,
>>>>>>> > >> >
>>>>>>> > >> > A puppet run added another passdb backend, that was
>> causing
>>>>> my
>>>>>>> > issue.
>>>>>>> > >> >
>>>>>>> > >> > What I still experience is:
>>>>>>> > >> >
>>>>>>> > >> >
>>>>>>> > >> > [2015/08/04 15:29:45.477783, 3]
>>>>>>> > >> > ../source3/auth/check_samsec.c:399(check_sam_security)
>>>>>>> > >> > check_sam_security: Couldn't find user 'username' in
>>>>> passdb.
>>>>>>> > >> > [2015/08/04 15:29:45.478026, 2]
>>>>>>> > >> > ../source3/auth/auth.c:288(auth_check_ntlm_password)
>>>>>>> > >> > check_ntlm_password: Authentication for user
> [username]
>>>> ->
>>>>>>> > >> > [username] FAILED with error NT_STATUS_NO_SUCH_USER
>>>>>>> > >> >
>>>>>>> > >> >
>>>>>>> > >> > I also wonder if I shall still sync the users local, or
> is
>>>> it
>>>>>>> > > needed ?
>>>>>>> > >> >
>>>>>>> > >> > Thanks again,
>>>>>>> > >> >
>>>>>>> > >> > Matt
>>>>>>> > >> >
>>>>>>> > >> > 2015-08-04 14:16 GMT+02:00 Christopher Lamb <
>>>>>>> > >> christopher.lamb at ch.ibm.com>:
>>>>>>> > >> >> Hi Matt
>>>>>>> > >> >>
>>>>>>> > >> >> From our smb.conf file:
>>>>>>> > >> >>
>>>>>>> > >> >> [global]
>>>>>>> > >> >> security = user
>>>>>>> > >> >> passdb backend =
>>>>>>> > ldapsam:ldap://xxx-ldap2.my.silly.example.com
>>>>>>> > >> >> ldap suffix = dc=my,dc=silly,dc=example,dc=com
>>>>>>> > >> >> ldap admin dn = cn=Directory Manager
>>>>>>> > >> >>
>>>>>>> > >> >> So yes, we use Directory Manager, it works for us. I
> have
>>>>> not
>>>>>>> > tried
>>>>>>> > >> with
>>>>>>> > >> > a
>>>>>>> > >> >> less powerful user, but it is conceivable that a lesser
>>>> user
>>>>>>> > may
>>>>>>> > not
>>>>>>> > >> see
>>>>>>> > >> >> all the required attributes, resulting in "no such user"
>>>>>>> > errors.
>>>>>>> > >> >>
>>>>>>> > >> >> Chris
>>>>>>> > >> >>
>>>>>>> > >> >>
>>>>>>> > >> >>
>>>>>>> > >> >>
>>>>>>> > >> >> From: "Matt ." <yamakasi.014 at gmail.com>
>>>>>>> > >> >> To: Christopher Lamb/Switzerland/IBM at IBMCH
>>>>>>> > >> >> Cc: "freeipa-users at redhat.com"
>>>>> <freeipa-users at redhat.com>
>>>>>>> > >> >> Date: 04.08.2015 13:32
>>>>>>> > >> >> Subject: Re: [Freeipa-users] Ubuntu Samba Server
>>>> Auth
>>>>>>> > against
>>>>>>> > >> IPA
>>>>>>> > >> >>
>>>>>>> > >> >>
>>>>>>> > >> >>
>>>>>>> > >> >> Hi Chris,
>>>>>>> > >> >>
>>>>>>> > >> >> Thanks for the heads up, indeed local is 4 I see now
> when
>>> I
>>>>>>> > add a
>>>>>>> > >> >> group from the GUI, great thanks!
>>>>>>> > >> >>
>>>>>>> > >> >> But do you use Directory Manager as ldap admin user or
>>> some
>>>>>>> > other
>>>>>>> > >> >> admin account ?
>>>>>>> > >> >>
>>>>>>> > >> >> I'm not sure id DM is needed and it should get that deep
>>>>> into
>>>>>>> > IPA.
>>>>>>> > >> >> Also when starting samba it cannot find "such user" as
>>> that
>>>>>>> > sounds
>>>>>>> > >> >> quite known as it has no UID.
>>>>>>> > >> >>
>>>>>>> > >> >> From your config I see you use DM, this should work ?
>>>>>>> > >> >>
>>>>>>> > >> >> Thanks!
>>>>>>> > >> >>
>>>>>>> > >> >>
>>>>>>> > >> >> Matt
>>>>>>> > >> >>
>>>>>>> > >> >>
>>>>>>> > >> >
>>>>>>> > >> >
>>>>>>> > >> >
>>>>>>> > >> >
>>>>>>> > >>
>>>>>>> > >> --
>>>>>>> > >> Manage your subscription for the Freeipa-users mailing
> list:
>>>>>>> > >> https://www.redhat.com/mailman/listinfo/freeipa-users
>>>>>>> > >> Go to http://freeipa.org for more info on the project
>>>>>>> > >>
>>>>>>> > >>
>>>>>>> > >>
>>>>>>> > >
>>>>>>> > >
>>>>>>> > >
>>>>>>> > >
>>>>>>> > > --
>>>>>>> > > Manage your subscription for the Freeipa-users mailing list:
>>>>>>> > > https://www.redhat.com/mailman/listinfo/freeipa-users
>>>>>>> > > Go to http://freeipa.org for more info on the project
>>>>>>> > >
>>>>>>> > >
>>>>>>> > >
>>>>>>> > >
>>>>>>> >
>>>>>>> > --
>>>>>>> > Manage your subscription for the Freeipa-users mailing list:
>>>>>>> > https://www.redhat.com/mailman/listinfo/freeipa-users
>>>>>>> > Go to http://freeipa.org for more info on the project
>>>>>>> >
>>>>>>> >
>>>>>>> >
>>>>>>
>>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>
>>>>
>>>>
>>>>
>>>
>>>
>>>
>>>
>>
>>
>>
>>
>
>
>
>
More information about the Freeipa-users
mailing list