[Freeipa-users] Ubuntu Samba Server Auth against IPA
Matt .
yamakasi.014 at gmail.com
Wed Aug 12 20:15:01 UTC 2015
Hi,
OK the default IPA way works great actually when testing it as described here:
http://www.freeipa.org/page/Howto/Integrating_a_Samba_File_Server_With_IPA
On the samba server I can auth and see my share where I want to connect to.
The issue is, on Windows I cannot auth, even when I do DOMAIN\username
as username
So, the IPA way should work.
Any comments here ?
Cheers,
Matt
2015-08-12 19:00 GMT+02:00 Matt . <yamakasi.014 at gmail.com>:
> HI GUys,
>
> I'm testing this out and I think I almost setup, this on a CentOS samba server.
>
> I'm using the ipa-adtrust way of Youeen but it seems we still need to
> add (objectclass=sambaSamAccount)) ?
>
> Info is welcome!
>
> I will report back when I have it working.
>
> Thanks!
>
> Matt
>
> 2015-08-10 11:16 GMT+02:00 Christopher Lamb <christopher.lamb at ch.ibm.com>:
>> The next route I will try - is the one Youeen took, using ipa-adtrust
>>
>>
>>
>> From: "Matt ." <yamakasi.014 at gmail.com>
>> To: Christopher Lamb/Switzerland/IBM at IBMCH,
>> "freeipa-users at redhat.com" <freeipa-users at redhat.com>
>> Date: 10.08.2015 10:03
>> Subject: Re: [Freeipa-users] Ubuntu Samba Server Auth against IPA
>>
>>
>>
>> Hi Chris,
>>
>> Okay this is good to hear.
>>
>> But don't we want a IPA managed Scheme ?
>>
>> When I did a "ipa-adtrust-install --add-sids" it also wanted a local
>> installed Samba and I wonder why.
>>
>> Good that we make some progres on making it all clear.
>>
>> Cheers,
>>
>> Matt
>>
>> 2015-08-10 6:12 GMT+02:00 Christopher Lamb <christopher.lamb at ch.ibm.com>:
>>> ldapsam + the samba extensions, pretty much as described in the
>> Techslaves
>>> article. Once I have a draft for the wiki page, I will mail you.
>>>
>>>
>>>
>>> From: "Matt ." <yamakasi.014 at gmail.com>
>>> To: Christopher Lamb/Switzerland/IBM at IBMCH,
>>> "freeipa-users at redhat.com" <freeipa-users at redhat.com>
>>> Date: 09.08.2015 21:17
>>> Subject: Re: [Freeipa-users] Ubuntu Samba Server Auth against IPA
>>>
>>>
>>>
>>> Hi,
>>>
>>> Yes I know about "anything" but which way did you use now ?
>>>
>>>
>>>
>>> 2015-08-09 20:56 GMT+02:00 Christopher Lamb
>> <christopher.lamb at ch.ibm.com>:
>>>> Hi Matt
>>>>
>>>> I am on OEL 7.1. - so anything that works on that should be good for
>> RHEL
>>>> and Centos 7.x
>>>>
>>>> I intend to add a how-to to the FreeIPA Wiki over the next few days. As
>>> we
>>>> have suggested earlier, we will likely end up with several, one for each
>>> of
>>>> the possible integration paths.
>>>>
>>>> Chris
>>>>
>>>>
>>>>
>>>>
>>>>
>>>> From: "Matt ." <yamakasi.014 at gmail.com>
>>>> To: Christopher Lamb/Switzerland/IBM at IBMCH,
>>>> "freeipa-users at redhat.com" <freeipa-users at redhat.com>
>>>> Date: 09.08.2015 16:45
>>>> Subject: Re: [Freeipa-users] Ubuntu Samba Server Auth against IPA
>>>>
>>>>
>>>>
>>>> Hi Chris,
>>>>
>>>> This sounds great!
>>>>
>>>> What are you using now, both CentOS ? So Samba and FreeIPA ?
>>>>
>>>> Maybe it's good to explain which way you used now in steps too, so we
>>>> can combine or create multiple howto's ?
>>>>
>>>> At least we are going somewhere!
>>>>
>>>> Thanks,
>>>>
>>>> Matt
>>>>
>>>> 2015-08-09 14:54 GMT+02:00 Christopher Lamb
>>> <christopher.lamb at ch.ibm.com>:
>>>>> Hi Matt
>>>>>
>>>>> My test integration of FreeIPA 4.x and Samba 4.x with the "good old
>>> Samba
>>>>> Schema extensions) is up and working, almost flawlessly.
>>>>>
>>>>> I can add users and groups via the FreeIPA CLI, and they get the
>> correct
>>>>> ObjectClasses / attributes required for Samba.
>>>>>
>>>>> So far I have not yet bothered to try the extensions to the WebUI,
>>>> because
>>>>> it is currently giving me the classic "Your session has expired. Please
>>>>> re-login." error which renders the WebUI useless.
>>>>>
>>>>> The only problem I have so far encountered managing Samba / FreeIPA
>>> users
>>>>> via FreeIPA CLI commands is with the handling of the attribute
>>>>> sambaPwdLastSet. This is the subject of an existing thread, also
>> updated
>>>>> today.
>>>>>
>>>>> There is also an existing alternative to hacking group.py, using "Class
>>>> of
>>>>> Service" (Cos) documented in this thread from February 2015
>>>>>
>>> https://www.redhat.com/archives/freeipa-users/2015-February/msg00172.html
>>>> .
>>>>> I have not yet tried it, but it sounds reasonable.
>>>>>
>>>>> Chris
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>> From: "Matt ." <yamakasi.014 at gmail.com>
>>>>> To: Christopher Lamb/Switzerland/IBM at IBMCH
>>>>> Cc: "freeipa-users at redhat.com" <freeipa-users at redhat.com>, Youenn
>>>>> PIOLET <piolet.y at gmail.com>
>>>>> Date: 06.08.2015 16:19
>>>>> Subject: Re: [Freeipa-users] Ubuntu Samba Server Auth against
>> IPA
>>>>>
>>>>>
>>>>>
>>>>> Hi Chris,
>>>>>
>>>>> OK, than we might create two different versions of the wiki, I think
>>>>> this is nice.
>>>>>
>>>>> I'm still figuring out why I get that:
>>>>>
>>>>> IPA Error 4205: ObjectclassViolation
>>>>>
>>>>> missing attribute "sambaGroupType" required by object class
>>>>> "sambaGroupMapping"
>>>>>
>>>>> Matt
>>>>>
>>>>> 2015-08-06 16:09 GMT+02:00 Christopher Lamb
>>>> <christopher.lamb at ch.ibm.com>:
>>>>>> Hi Matt
>>>>>>
>>>>>> As far as I can make out, there are at least 2 viable Samba / FreeIPA
>>>>>> integration paths.
>>>>>>
>>>>>> The route I took is suited where there is no Active Directory
>> involved:
>>>>> In
>>>>>> my case all the Windows, OSX and Linux clients are islands that sit on
>>>>> the
>>>>>> same network.
>>>>>>
>>>>>> The route that Youenn has taken (unless I have got completely the
>> wrong
>>>>> end
>>>>>> of the stick) requires Active Directory in the architecture.
>>>>>>
>>>>>> Chris
>>>>>>
>>>>>>
>>>>>>
>>>>>> From: "Matt ." <yamakasi.014 at gmail.com>
>>>>>> To: Youenn PIOLET <piolet.y at gmail.com>
>>>>>> Cc: Christopher Lamb/Switzerland/IBM at IBMCH,
>>>>>> "freeipa-users at redhat.com" <freeipa-users at redhat.com>
>>>>>> Date: 06.08.2015 14:42
>>>>>> Subject: Re: [Freeipa-users] Ubuntu Samba Server Auth against
>>> IPA
>>>>>>
>>>>>>
>>>>>>
>>>>>> Hi,
>>>>>>
>>>>>> OK, this sounds already quite logical, but I'm still refering to the
>>>>>> old howto we found earlier, does that one still apply somewhere or not
>>>>>> at all ?
>>>>>>
>>>>>> Thanks,
>>>>>>
>>>>>> Matt
>>>>>>
>>>>>>
>>>>>>
>>>>>> 2015-08-06 12:23 GMT+02:00 Youenn PIOLET <piolet.y at gmail.com>:
>>>>>>> Hey guys,
>>>>>>>
>>>>>>> I'll try to make a tutorial soon, sorry I'm quite in a rush these
>>>>> days :)
>>>>>>>
>>>>>>> General idea:
>>>>>>>
>>>>>>> On FreeIPA (4.1)
>>>>>>> - `ipa-adtrust-install --add-sids` (creates ipaNTsecurityidentifier
>>>>>>> attribude, also known as SID)
>>>>>>> - regenerate each user password to build ipaNTHash attribute, not
>> here
>>>>> by
>>>>>>> default on users
>>>>>>> - use your ldap browser to check ipaNTHash values are here on user
>>>>>> objects
>>>>>>> - create a CIFS service for your samba server
>>>>>>> - Create user roles/permissions as described here:
>>>>>>>
>>>>>>
>>>>>
>>>>
>>>
>> http://freeipa-users.redhat.narkive.com/ez2uKpFS/authenticate-samba-3-or-4-with-freeipa
>>
>>>
>>>>
>>>>>
>>>>>>
>>>>>>> so that CIFS service will be able to read ipaNTsecurityidentifier and
>>>>>>> ipaNTHash attributes in LDAP (ACI)
>>>>>>> - SCP ipasam.so module to your cifs server (this is the magic
>> trick) :
>>>>>> scp
>>>>>>> /usr/lib64/samba/pdb/ipasam.so
>>>>>>> root at samba-server.domain:/usr/lib64/samba/pdb/ You can also try to
>>>>>> recompile
>>>>>>> it.
>>>>>>>
>>>>>>> On SAMBA Server side (CentOS 7...)
>>>>>>> - Install server keytab file for CIFS
>>>>>>> - check ipasam.so is here.
>>>>>>> - check you can read password hash in LDAP with `ldapsearch -Y GSSAPI
>>>>>>> uid=admin ipaNTHash` thanks to kerberos
>>>>>>> - make your smb.conf following the linked thread and restart service
>>>>>>>
>>>>>>> I don't know if it works in Ubuntu. I know sssd has evolved quickly
>>> and
>>>>>>> ipasam may use quite recent functionalities, the best is to just try.
>>>>> You
>>>>>>> can read in previous thread : "If you insist on Ubuntu you need to
>> get
>>>>>>> ipasam somewhere, most likely to compile it yourself".
>>>>>>>
>>>>>>> Make sure your user has ipaNTHash attribute :)
>>>>>>>
>>>>>>> You may want to debug authentication on samba server, I usually do
>>>> this:
>>>>>>> `tail -f /var/log/samba/log* | grep <username>
>>>>>>>
>>>>>>> Cheers
>>>>>>> --
>>>>>>> Youenn Piolet
>>>>>>> piolet.y at gmail.com
>>>>>>>
>>>>>>>
>>>>>>> 2015-08-05 17:40 GMT+02:00 Matt . <yamakasi.014 at gmail.com>:
>>>>>>>>
>>>>>>>> Hi,
>>>>>>>>
>>>>>>>> This sounds great to me too, but a howto would help to make it more
>>>>>>>> clear about what you have done here. The thread confuses me a little
>>>>>>>> bit.
>>>>>>>>
>>>>>>>> Can you paste your commands so we can test out too and report back ?
>>>>>>>>
>>>>>>>> Thanks!
>>>>>>>>
>>>>>>>> Matt
>>>>>>>>
>>>>>>>> 2015-08-05 15:18 GMT+02:00 Christopher Lamb
>>>>>> <christopher.lamb at ch.ibm.com>:
>>>>>>>> > Hi Youenn
>>>>>>>> >
>>>>>>>> > Good news that you have got an integration working
>>>>>>>> >
>>>>>>>> > Now you have got it going, and the solution is fresh in your mind,
>>>>> how
>>>>>>>> > about adding a How-to page on this solution to the FreeIPA wiki?
>>>>>>>> >
>>>>>>>> > Chris
>>>>>>>> >
>>>>>>>> >
>>>>>>>> >
>>>>>>>> > From: Youenn PIOLET <piolet.y at gmail.com>
>>>>>>>> > To: "Matt ." <yamakasi.014 at gmail.com>
>>>>>>>> > Cc: Christopher Lamb/Switzerland/IBM at IBMCH,
>>>>>>>> > "freeipa-users at redhat.com" <freeipa-users at redhat.com>
>>>>>>>> > Date: 05.08.2015 14:51
>>>>>>>> > Subject: Re: [Freeipa-users] Ubuntu Samba Server Auth
>>> against
>>>>>> IPA
>>>>>>>> >
>>>>>>>> >
>>>>>>>> >
>>>>>>>> > Hi guys,
>>>>>>>> >
>>>>>>>> > Thank you so much your previous answers.
>>>>>>>> > I realised my SID were stored in ipaNTsecurityidentifier, thanks
>> to
>>>>>>>> > ipa-adtrust-install --add-sids
>>>>>>>> >
>>>>>>>> > I found an other way to configure smb here:
>>>>>>>> >
>>>>>>>> >
>>>>>>
>>>>>
>>>>
>>>
>> http://freeipa-users.redhat.narkive.com/ez2uKpFS/authenticate-samba-3-or-4-with-freeipa
>>
>>>
>>>>
>>>>>
>>>>>>
>>>>>>>> > It works perfectly.
>>>>>>>> >
>>>>>>>> > I'm using module ipasam.so I have manually scp to the samba
>> server,
>>>>>>>> > Samba is set to use kerberos + ldapsam via this ipasam module.
>>>>>>>> > Following the instructions, I created a user role allowing service
>>>>>>>> > principal to read ipaNTHash value from the LDAP.
>>>>>>>> > ipaNTHash are generated each time a user changes his password.
>>>>>>>> > Authentication works perfectly on Windows 7, 8 and 10.
>>>>>>>> >
>>>>>>>> > For more details, the previously linked thread is quite clear.
>>>>>>>> >
>>>>>>>> > Cheers
>>>>>>>> >
>>>>>>>> > --
>>>>>>>> > Youenn Piolet
>>>>>>>> > piolet.y at gmail.com
>>>>>>>> >
>>>>>>>> >
>>>>>>>> > 2015-08-05 11:10 GMT+02:00 Matt . <yamakasi.014 at gmail.com>:
>>>>>>>> > Hi Chris.
>>>>>>>> >
>>>>>>>> > Yes, Apache Studio did that but I was not sure why it complained
>>>> it
>>>>>>>> > was "already" there.
>>>>>>>> >
>>>>>>>> > I'm still getting:
>>>>>>>> >
>>>>>>>> > IPA Error 4205: ObjectclassViolation
>>>>>>>> >
>>>>>>>> > missing attribute "sambaGroupType" required by object class
>>>>>>>> > "sambaGroupMapping"
>>>>>>>> >
>>>>>>>> > When adding a user.
>>>>>>>> >
>>>>>>>> > I also see "class" as fielname under my "Last name", this is not
>>>> OK
>>>>>>>> > also.
>>>>>>>> >
>>>>>>>> >
>>>>>>>> >
>>>>>>>> > We sure need to make some howto, I think we can nail this
>> down :)
>>>>>>>> >
>>>>>>>> > Thanks for the heads up!
>>>>>>>> >
>>>>>>>> > Matthijs
>>>>>>>> >
>>>>>>>> > 2015-08-05 7:51 GMT+02:00 Christopher Lamb
>>>>>>>> > <christopher.lamb at ch.ibm.com>:
>>>>>>>> > > Hi Matt
>>>>>>>> > >
>>>>>>>> > > If I use Apache Directory Studio to add an attribute
>>>>>> ipaCustomFields
>>>>>>>> > to
>>>>>>>> > > cn=ipaConfig,cn=etc, the operation it performs is a modify, as
>>>>>> shown
>>>>>>>> > below:
>>>>>>>> > >
>>>>>>>> > > #!RESULT OK
>>>>>>>> > > #!CONNECTION ldap://xxx-ldap2.my.silly.example.com:yyy
>>>>>>>> > > #!DATE 2015-08-05T05:45:04.608
>>>>>>>> > > dn: cn=ipaConfig,cn=etc,dc=my,dc=silly,dc=example,dc=com
>>>>>>>> > > changetype: modify
>>>>>>>> > > add: ipaCustomFields
>>>>>>>> > > ipaCustomFields: Samba Group Type,sambagrouptype,true
>>>>>>>> > >
>>>>>>>> > > After that I then have a visible attribute ipaCustomFields as
>>>>>>>> > expected.
>>>>>>>> > >
>>>>>>>> > > When adding the attribute, the wizard offered me
>>>>> "ipaCustomFields"
>>>>>>>> > as
>>>>>>>> > > attribute type in a drop down list.
>>>>>>>> > >
>>>>>>>> > > Once we get this cracked, we really must write a how-to on the
>>>>>>>> > FreeIPA
>>>>>>>> > > Wiki.
>>>>>>>> > >
>>>>>>>> > > Chris
>>>>>>>> > >
>>>>>>>> > >
>>>>>>>> > >
>>>>>>>> > > From: Christopher Lamb/Switzerland/IBM at IBMCH
>>>>>>>> > > To: "Matt ." <yamakasi.014 at gmail.com>
>>>>>>>> > > Cc: "freeipa-users at redhat.com" <freeipa-users at redhat.com>
>>>>>>>> > > Date: 05.08.2015 07:31
>>>>>>>> > > Subject: Re: [Freeipa-users] Ubuntu Samba Server Auth
>>>>>> against
>>>>>>>> > IPA
>>>>>>>> > > Sent by: freeipa-users-bounces at redhat.com
>>>>>>>> > >
>>>>>>>> > >
>>>>>>>> > >
>>>>>>>> > > Hi Matt
>>>>>>>> > >
>>>>>>>> > > I also got the same result at that step, but can see nothing
>> in
>>>>>>>> > Apache
>>>>>>>> > > Directory Studio.
>>>>>>>> > >
>>>>>>>> > > As I am using existing Samba / FreeIPA groups migrated across,
>>>>>> they
>>>>>>>> > > probably were migrated with all the required attributes.
>>>>>>>> > >
>>>>>>>> > > Looking more closely at that LDIF: I wonder should it not be:
>>>>>>>> > >
>>>>>>>> > > ldapmodify -Y GSSAPI <<EOF
>>>>>>>> > > dn: cn=ipaconfig,cn=etc,dc=domain,dc=tld
>>>>>>>> > > changetype: modify
>>>>>>>> > > add: ipaCustomFields
>>>>>>>> > > ipaCustomFields: "Samba Group Type,sambagrouptype,true"
>>>>>>>> > > EOF
>>>>>>>> > >
>>>>>>>> > > i.e. changetype: modify, instead of changetype add ?
>>>>>>>> > >
>>>>>>>> > > I don't want to play around with my prod directory - I will
>>>> setup
>>>>>> an
>>>>>>>> > EL
>>>>>>>> > 7.1
>>>>>>>> > > VM and install FreeIPA 4.x and Samba 4.x That will allow me to
>>>>>> play
>>>>>>>> > around
>>>>>>>> > > more destructively.
>>>>>>>> > >
>>>>>>>> > > Chris
>>>>>>>> > >
>>>>>>>> > >
>>>>>>>> > >
>>>>>>>> > >
>>>>>>>> > >
>>>>>>>> > > From: "Matt ." <yamakasi.014 at gmail.com>
>>>>>>>> > > To: Christopher Lamb/Switzerland/IBM at IBMCH
>>>>>>>> > > Cc: Youenn PIOLET <piolet.y at gmail.com>, "
>>>>>>>> > freeipa-users at redhat.com"
>>>>>>>> > > <freeipa-users at redhat.com>
>>>>>>>> > > Date: 05.08.2015 01:01
>>>>>>>> > > Subject: Re: [Freeipa-users] Ubuntu Samba
>>> Server
>>>>>>>> > Auth
>>>>>>>> > against IPA
>>>>>>>> > >
>>>>>>>> > >
>>>>>>>> > >
>>>>>>>> > > Hi Chris,
>>>>>>>> > >
>>>>>>>> > > I'm at the right path, but my issue is that:
>>>>>>>> > >
>>>>>>>> > > ldapmodify -Y GSSAPI <<EOF
>>>>>>>> > > dn: cn=ipaconfig,cn=etc,dc=domain,dc=tld
>>>>>>>> > > changetype: add
>>>>>>>> > > add: ipaCustomFields
>>>>>>>> > > ipaCustomFields: "Samba Group Type,sambagrouptype,true"
>>>>>>>> > > EOF
>>>>>>>> > >
>>>>>>>> > > Does say it exists, my ldap explorer doesn't show it, and when
>>> I
>>>>>> add
>>>>>>>> > > it manually as an attribute it still fails when I add a user
>> on
>>>>>> this
>>>>>>>> > > sambagrouptype as it's needed by the other attributes
>>>>>>>> > >
>>>>>>>> > > So that is my issue I think so far.
>>>>>>>> > >
>>>>>>>> > > Any clue about that ?
>>>>>>>> > >
>>>>>>>> > > No problem "you don't know something or are no guru" we are
>> all
>>>>>>>> > > learning! :)
>>>>>>>> > >
>>>>>>>> > > Cheers,
>>>>>>>> > >
>>>>>>>> > > Matt
>>>>>>>> > >
>>>>>>>> > >
>>>>>>>> > > 2015-08-04 21:22 GMT+02:00 Christopher Lamb <
>>>>>>>> > christopher.lamb at ch.ibm.com>:
>>>>>>>> > >> Hi Matt, Youeen
>>>>>>>> > >>
>>>>>>>> > >> Just to set the background properly, I did not invent this
>>>>>> process.
>>>>>>>> > I
>>>>>>>> > > know
>>>>>>>> > >> only a little about FreeIPA, and almost nothing about Samba,
>>>> but
>>>>>> I
>>>>>>>> > guess
>>>>>>>> > > I
>>>>>>>> > >> was lucky enough to get the integration working on a Sunday
>>>>>>>> > afternoon.
>>>>>>>> > (I
>>>>>>>> > >> did have an older FreeIPA 3.x / Samba 3.x installation as a
>>>>>>>> > reference).
>>>>>>>> > >>
>>>>>>>> > >> It sounds like we need to step back, and look at the test
>> user
>>>>>> and
>>>>>>>> > group
>>>>>>>> > > in
>>>>>>>> > >> the FreeIPA LDAP tree. I find using an LDAP browser makes
>> this
>>>>>> much
>>>>>>>> > > easier.
>>>>>>>> > >>
>>>>>>>> > >> My FreeIPA / Samba Users have the following Samba extensions
>>> in
>>>>>>>> > FreeIPA
>>>>>>>> > >> (cn=accounts, cn=users):
>>>>>>>> > >>
>>>>>>>> > >> * objectClass: sambasamaccount
>>>>>>>> > >>
>>>>>>>> > >> * Attributes: sambaSID, sambaNTPassword, sambaPwdLastSet
>>>>>>>> > >>
>>>>>>>> > >> My FreeIPA / Samba Groups have the following Samba extensions
>>>> in
>>>>>>>> > FreeIPA
>>>>>>>> > >> (cn=accounts, cn=groups):
>>>>>>>> > >>
>>>>>>>> > >> * objectClass: sambaGroupMapping
>>>>>>>> > >>
>>>>>>>> > >> * Attributes: sambaGroupType, sambaSID
>>>>>>>> > >>
>>>>>>>> > >> The Users must belong to one or more of the samba groups that
>>>>> you
>>>>>>>> > have
>>>>>>>> > >> setup.
>>>>>>>> > >>
>>>>>>>> > >> If you don't have something similar to the above (which
>> sounds
>>>>>> like
>>>>>>>> > it
>>>>>>>> > is
>>>>>>>> > >> the case), then something went wrong applying the extensions.
>>>> It
>>>>>>>> > would
>>>>>>>> > be
>>>>>>>> > >> worth testing comparing a new user / group created post
>> adding
>>>>>> the
>>>>>>>> > >> extensions to a previous existing user.
>>>>>>>> > >>
>>>>>>>> > >> i.e.
>>>>>>>> > >> are the extensions missing on existing users / groups?
>>>>>>>> > >> are the extensions missing on new users / groups?
>>>>>>>> > >>
>>>>>>>> > >> Cheers
>>>>>>>> > >>
>>>>>>>> > >> Chris
>>>>>>>> > >>
>>>>>>>> > >>
>>>>>>>> > >>
>>>>>>>> > >>
>>>>>>>> > >>
>>>>>>>> > >> From: Youenn PIOLET <piolet.y at gmail.com>
>>>>>>>> > >> To: "Matt ." <yamakasi.014 at gmail.com>
>>>>>>>> > >> Cc: Christopher Lamb/Switzerland/IBM at IBMCH,
>>>>>>>> > >> "freeipa-users at redhat.com"
>>>>> <freeipa-users at redhat.com>
>>>>>>>> > >> Date: 04.08.2015 18:56
>>>>>>>> > >> Subject: Re: [Freeipa-users] Ubuntu Samba Server Auth
>>>>>>>> > against
>>>>>>>> > IPA
>>>>>>>> > >>
>>>>>>>> > >>
>>>>>>>> > >>
>>>>>>>> > >> Hi there,
>>>>>>>> > >>
>>>>>>>> > >> I have difficulties to follow you at this point :)
>>>>>>>> > >> Here is what I've done and what I've understood:
>>>>>>>> > >>
>>>>>>>> > >> ## SMB Side
>>>>>>>> > >> - Testparm OK
>>>>>>>> > >> - I've got the same NT_STATUS_NO_SUCH_USER when I try to
>>>>> connect.
>>>>>>>> > >> - pdbedit -Lv output is all successfull but I can see there
>> is
>>>> a
>>>>>>>> > filter :
>>>>>>>> > >> (&(uid=*)(objectclass=sambaSamAccount). In LDAP, the users
>>>> don't
>>>>>>>> > have
>>>>>>>> > >> sambaSamAccount.
>>>>>>>> > >>
>>>>>>>> > >> ## LDAP / FreeIPA side
>>>>>>>> > >> - Since SMB server uses LDAP, I did ipa-adtrust-install on my
>>>>>>>> > FreeIPA
>>>>>>>> > >> server to get samba LDAP extensions.
>>>>>>>> > >> - I can see samba classes exist in LDAP but are not used on
>> my
>>>>>>>> > group
>>>>>>>> > >> objects nor my user objects
>>>>>>>> > >> - I have add sambaSamAccount in FreeIPA default user classes,
>>>>>>>> > >> and sambaGroupMapping to default group classes. In that state
>>> I
>>>>>>>> > can't
>>>>>>>> > >> create user nor groups anymore, as new samba attributes are
>>>>>> needed
>>>>>>>> > for
>>>>>>>> > >> instantiation.
>>>>>>>> > >> - I have add in etc ipaCustomFields: 'Samba Group
>>>>>>>> > > Type,sambagrouptype,true'
>>>>>>>> > >> but I don't get what it does.
>>>>>>>> > >> - I tried to add the samba.js plugin. It works, and adds the
>>>>>>>> > "local"
>>>>>>>> > > option
>>>>>>>> > >> when creating a group in FreeIPA, supposed to set
>>>> sambagrouptype
>>>>>> to
>>>>>>>> > 4
>>>>>>>> > or
>>>>>>>> > > 2
>>>>>>>> > >> (domain). It doesn't work and tells that sambagrouptype
>>>>> attribute
>>>>>>>> > doesn't
>>>>>>>> > >> exist (but it should now I put sambaGroupType class by
>>>>>> default...)
>>>>>>>> > >>
>>>>>>>> > >> ## Questions
>>>>>>>> > >> 0) Can I ask samba not to search sambaSamAccount and use
>>> unix /
>>>>>>>> > posix
>>>>>>>> > >> instead? I guess no.
>>>>>>>> > >> 1) How to generate the user/group SIDs ? They are requested
>> to
>>>>>> add
>>>>>>>> > >> sambaSamAccount classes.
>>>>>>>> > >> This article doesn't seem relevant since we don't use domain
>>>>>>>> > controller
>>>>>>>> > >>
>>>>>>>> > >
>>>>>>>> >
>>>>>>>> >
>>>>>>
>>>>>
>>>>
>>>
>> http://docs.fedoraproject.org/en-US/Fedora/17/html/FreeIPA_Guide/cifs.html
>>>>>>>> >
>>>>>>>> > >> and netgetlocalsid returns an error.
>>>>>>>> > >> 2) How to fix samba.js plugin?
>>>>>>>> > >> 3) I guess an equivalent of samba.js is needed for user
>>>>> creation,
>>>>>>>> > where
>>>>>>>> > > can
>>>>>>>> > >> I find it?
>>>>>>>> > >> 4) Is your setup working with Windows 8 / Windows 10 and not
>>>>> only
>>>>>>>> > Windows
>>>>>>>> > >> 7?
>>>>>>>> > >>
>>>>>>>> > >> Thanks a lot for your previous and future answers
>>>>>>>> > >>
>>>>>>>> > >> --
>>>>>>>> > >> Youenn Piolet
>>>>>>>> > >> piolet.y at gmail.com
>>>>>>>> > >>
>>>>>>>> > >>
>>>>>>>> > >> 2015-08-04 17:55 GMT+02:00 Matt . <yamakasi.014 at gmail.com>:
>>>>>>>> > >> Hi,
>>>>>>>> > >>
>>>>>>>> > >> Yes, log is anonymised.
>>>>>>>> > >>
>>>>>>>> > >> It's strange, my user doesn't have a SambaPwdLastSet, also
>>>>> when
>>>>>> I
>>>>>>>> > >> change it's password it doesn't get it in ldap.
>>>>>>>> > >>
>>>>>>>> > >> There must be something going wrong I guess.
>>>>>>>> > >>
>>>>>>>> > >> Matt
>>>>>>>> > >>
>>>>>>>> > >> 2015-08-04 17:45 GMT+02:00 Christopher Lamb
>>>>>>>> > > <christopher.lamb at ch.ibm.com
>>>>>>>> > >> >:
>>>>>>>> > >> > Hi Matt
>>>>>>>> > >> >
>>>>>>>> > >> > I assume [username] is a real username, identical to that
>>>> in
>>>>>>>> > the
>>>>>>>> > >> FreeIPA
>>>>>>>> > >> > cn=accounts, cn=users tree? (i.e. you anonymised the log
>>>>>>>> > extract).
>>>>>>>> > >> >
>>>>>>>> > >> > You user should be a member of the appropriate samba
>>> groups
>>>>>>>> > that
>>>>>>>> > you
>>>>>>>> > >> setup
>>>>>>>> > >> > in FreeIPA.
>>>>>>>> > >> >
>>>>>>>> > >> > You should check that the user attribute SambaPwdLastSet
>>> is
>>>>>> set
>>>>>>>> > to
>>>>>>>> > a
>>>>>>>> > >> > positive value (e.g. 1). If not you get an error in the
>>>>> Samba
>>>>>>>> > logs
>>>>>>>> > -
>>>>>>>> > > I
>>>>>>>> > >> > would need to play around again with a test user to find
>>>> out
>>>>>>>> > the
>>>>>>>> > > exact
>>>>>>>> > >> > error.
>>>>>>>> > >> >
>>>>>>>> > >> > I don't understand what you mean about syncing the users
>>>>>> local,
>>>>>>>> > but
>>>>>>>> > > we
>>>>>>>> > >> did
>>>>>>>> > >> > not need to do anything like that.
>>>>>>>> > >> >
>>>>>>>> > >> > Chris
>>>>>>>> > >> >
>>>>>>>> > >> >
>>>>>>>> > >> >
>>>>>>>> > >> >
>>>>>>>> > >> > From: "Matt ." <yamakasi.014 at gmail.com>
>>>>>>>> > >> > To: Christopher Lamb/Switzerland/IBM at IBMCH
>>>>>>>> > >> > Cc: "freeipa-users at redhat.com"
>>>>> <freeipa-users at redhat.com>
>>>>>>>> > >> > Date: 04.08.2015 15:33
>>>>>>>> > >> > Subject: Re: [Freeipa-users] Ubuntu Samba Server
>>>> Auth
>>>>>>>> > against
>>>>>>>> > >> IPA
>>>>>>>> > >> >
>>>>>>>> > >> >
>>>>>>>> > >> >
>>>>>>>> > >> > Hi Chris,
>>>>>>>> > >> >
>>>>>>>> > >> > A puppet run added another passdb backend, that was
>>> causing
>>>>>> my
>>>>>>>> > issue.
>>>>>>>> > >> >
>>>>>>>> > >> > What I still experience is:
>>>>>>>> > >> >
>>>>>>>> > >> >
>>>>>>>> > >> > [2015/08/04 15:29:45.477783, 3]
>>>>>>>> > >> > ../source3/auth/check_samsec.c:399(check_sam_security)
>>>>>>>> > >> > check_sam_security: Couldn't find user 'username' in
>>>>>> passdb.
>>>>>>>> > >> > [2015/08/04 15:29:45.478026, 2]
>>>>>>>> > >> > ../source3/auth/auth.c:288(auth_check_ntlm_password)
>>>>>>>> > >> > check_ntlm_password: Authentication for user
>> [username]
>>>>> ->
>>>>>>>> > >> > [username] FAILED with error NT_STATUS_NO_SUCH_USER
>>>>>>>> > >> >
>>>>>>>> > >> >
>>>>>>>> > >> > I also wonder if I shall still sync the users local, or
>> is
>>>>> it
>>>>>>>> > > needed ?
>>>>>>>> > >> >
>>>>>>>> > >> > Thanks again,
>>>>>>>> > >> >
>>>>>>>> > >> > Matt
>>>>>>>> > >> >
>>>>>>>> > >> > 2015-08-04 14:16 GMT+02:00 Christopher Lamb <
>>>>>>>> > >> christopher.lamb at ch.ibm.com>:
>>>>>>>> > >> >> Hi Matt
>>>>>>>> > >> >>
>>>>>>>> > >> >> From our smb.conf file:
>>>>>>>> > >> >>
>>>>>>>> > >> >> [global]
>>>>>>>> > >> >> security = user
>>>>>>>> > >> >> passdb backend =
>>>>>>>> > ldapsam:ldap://xxx-ldap2.my.silly.example.com
>>>>>>>> > >> >> ldap suffix = dc=my,dc=silly,dc=example,dc=com
>>>>>>>> > >> >> ldap admin dn = cn=Directory Manager
>>>>>>>> > >> >>
>>>>>>>> > >> >> So yes, we use Directory Manager, it works for us. I
>> have
>>>>>> not
>>>>>>>> > tried
>>>>>>>> > >> with
>>>>>>>> > >> > a
>>>>>>>> > >> >> less powerful user, but it is conceivable that a lesser
>>>>> user
>>>>>>>> > may
>>>>>>>> > not
>>>>>>>> > >> see
>>>>>>>> > >> >> all the required attributes, resulting in "no such user"
>>>>>>>> > errors.
>>>>>>>> > >> >>
>>>>>>>> > >> >> Chris
>>>>>>>> > >> >>
>>>>>>>> > >> >>
>>>>>>>> > >> >>
>>>>>>>> > >> >>
>>>>>>>> > >> >> From: "Matt ." <yamakasi.014 at gmail.com>
>>>>>>>> > >> >> To: Christopher Lamb/Switzerland/IBM at IBMCH
>>>>>>>> > >> >> Cc: "freeipa-users at redhat.com"
>>>>>> <freeipa-users at redhat.com>
>>>>>>>> > >> >> Date: 04.08.2015 13:32
>>>>>>>> > >> >> Subject: Re: [Freeipa-users] Ubuntu Samba Server
>>>>> Auth
>>>>>>>> > against
>>>>>>>> > >> IPA
>>>>>>>> > >> >>
>>>>>>>> > >> >>
>>>>>>>> > >> >>
>>>>>>>> > >> >> Hi Chris,
>>>>>>>> > >> >>
>>>>>>>> > >> >> Thanks for the heads up, indeed local is 4 I see now
>> when
>>>> I
>>>>>>>> > add a
>>>>>>>> > >> >> group from the GUI, great thanks!
>>>>>>>> > >> >>
>>>>>>>> > >> >> But do you use Directory Manager as ldap admin user or
>>>> some
>>>>>>>> > other
>>>>>>>> > >> >> admin account ?
>>>>>>>> > >> >>
>>>>>>>> > >> >> I'm not sure id DM is needed and it should get that deep
>>>>>> into
>>>>>>>> > IPA.
>>>>>>>> > >> >> Also when starting samba it cannot find "such user" as
>>>> that
>>>>>>>> > sounds
>>>>>>>> > >> >> quite known as it has no UID.
>>>>>>>> > >> >>
>>>>>>>> > >> >> From your config I see you use DM, this should work ?
>>>>>>>> > >> >>
>>>>>>>> > >> >> Thanks!
>>>>>>>> > >> >>
>>>>>>>> > >> >>
>>>>>>>> > >> >> Matt
>>>>>>>> > >> >>
>>>>>>>> > >> >>
>>>>>>>> > >> >
>>>>>>>> > >> >
>>>>>>>> > >> >
>>>>>>>> > >> >
>>>>>>>> > >>
>>>>>>>> > >> --
>>>>>>>> > >> Manage your subscription for the Freeipa-users mailing
>> list:
>>>>>>>> > >> https://www.redhat.com/mailman/listinfo/freeipa-users
>>>>>>>> > >> Go to http://freeipa.org for more info on the project
>>>>>>>> > >>
>>>>>>>> > >>
>>>>>>>> > >>
>>>>>>>> > >
>>>>>>>> > >
>>>>>>>> > >
>>>>>>>> > >
>>>>>>>> > > --
>>>>>>>> > > Manage your subscription for the Freeipa-users mailing list:
>>>>>>>> > > https://www.redhat.com/mailman/listinfo/freeipa-users
>>>>>>>> > > Go to http://freeipa.org for more info on the project
>>>>>>>> > >
>>>>>>>> > >
>>>>>>>> > >
>>>>>>>> > >
>>>>>>>> >
>>>>>>>> > --
>>>>>>>> > Manage your subscription for the Freeipa-users mailing list:
>>>>>>>> > https://www.redhat.com/mailman/listinfo/freeipa-users
>>>>>>>> > Go to http://freeipa.org for more info on the project
>>>>>>>> >
>>>>>>>> >
>>>>>>>> >
>>>>>>>
>>>>>>>
>>>>>>
>>>>>>
>>>>>>
>>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>
>>>>
>>>>
>>>>
>>>
>>>
>>>
>>>
>>
>>
>>
>>
More information about the Freeipa-users
mailing list