[Freeipa-users] Ubuntu Samba Server Auth against IPA
Matt .
yamakasi.014 at gmail.com
Thu Aug 13 11:09:31 UTC 2015
Hi,
I might have found somthing which I already seen in the logs.
I did a smbpasswd my username on the samba server, it connects to ldap
very well. I give my new password and get the following:
smbldap_search_ext: base => [dc=my,dc=domain], filter =>
[(&(objectClass=ipaNTGroupAttrs)(|(ipaNTSecurityIdentifier=S-1----my--sid---)))],
scope => [2]
Attribute [displayName] not found.
Could not retrieve 'displayName' attribute from cn=Default SMB
Group,cn=groups,cn=accounts,dc=my,dc=domain
Sid S-1----my--sid--- -> MYDOMAIN\Default SMB Group(2)
So something is missing!
Thanks so far guys!
Cheers,
Matt
2015-08-13 12:02 GMT+02:00 Matt . <yamakasi.014 at gmail.com>:
> Hi Youenn,
>
> OK thanks! this takes me a little but futher now and I see some good
> stuff in my logging.
>
> I'm testing on a Windows 10 Machine which is not member of an AD or
> so, so that might be my issue for now ?
>
> When testing on the samba box itself as my user I get:
>
>
> [myusername at smb-01 ~]$ smbclient //smb-01.domain.local/shares
>
> ...
> Checking NTLMSSP password for MSP\myusername failed: NT_STATUS_WRONG_PASSWORD
> ...
> SPNEGO login failed: NT_STATUS_WRONG_PASSWORD
>
>
> Maybe I have an issue with encrypted passwords ?
>
>
> When we have this all working, I think we have a howto :D
>
> Thanks!
>
> Matt
>
> 2015-08-13 10:53 GMT+02:00 Youenn PIOLET <piolet.y at gmail.com>:
>> Hi Matt
>>
>> - CentOS : Did you copy ipasam.so and change your smb.conf accordingly?
>> sambaSamAccount is not needed anymore that way.
>> - Default IPA Way : won't work if your Windows is not part of a domain
>> controller. DOMAIN\username may work for some users using Windows 7 - not 8
>> nor 10 (it did for me but I was the only one at the office... quite useless)
>>
>> This config may work on your CentOS (for the ipasam way):
>> workgroup = TEST
>> realm = TEST.NET
>> kerberos method = dedicated keytab
>> dedicated keytab file = FILE:/<.....>/samba.keytab
>> create krb5 conf = no
>> security = user
>> encrypt passwords = true
>> passdb backend = ipasam:ldaps://youripa.test.net
>> ldapsam:trusted = yes
>> ldapsuffix = test.net
>> ldap user suffix = cn=users,cn=accounts
>> ldap group suffix = cn=groups,cn=accounts
>>
>>
>> --
>> Youenn Piolet
>> piolet.y at gmail.com
>>
>>
>> 2015-08-12 22:15 GMT+02:00 Matt . <yamakasi.014 at gmail.com>:
>>>
>>> Hi,
>>>
>>> OK the default IPA way works great actually when testing it as described
>>> here:
>>>
>>> http://www.freeipa.org/page/Howto/Integrating_a_Samba_File_Server_With_IPA
>>>
>>> On the samba server I can auth and see my share where I want to connect
>>> to.
>>>
>>> The issue is, on Windows I cannot auth, even when I do DOMAIN\username
>>> as username
>>>
>>> So, the IPA way should work.
>>>
>>> Any comments here ?
>>>
>>> Cheers,
>>>
>>> Matt
>>>
>>> 2015-08-12 19:00 GMT+02:00 Matt . <yamakasi.014 at gmail.com>:
>>> > HI GUys,
>>> >
>>> > I'm testing this out and I think I almost setup, this on a CentOS samba
>>> > server.
>>> >
>>> > I'm using the ipa-adtrust way of Youeen but it seems we still need to
>>> > add (objectclass=sambaSamAccount)) ?
>>> >
>>> > Info is welcome!
>>> >
>>> > I will report back when I have it working.
>>> >
>>> > Thanks!
>>> >
>>> > Matt
>>> >
>>> > 2015-08-10 11:16 GMT+02:00 Christopher Lamb
>>> > <christopher.lamb at ch.ibm.com>:
>>> >> The next route I will try - is the one Youeen took, using ipa-adtrust
>>> >>
>>> >>
>>> >>
>>> >> From: "Matt ." <yamakasi.014 at gmail.com>
>>> >> To: Christopher Lamb/Switzerland/IBM at IBMCH,
>>> >> "freeipa-users at redhat.com" <freeipa-users at redhat.com>
>>> >> Date: 10.08.2015 10:03
>>> >> Subject: Re: [Freeipa-users] Ubuntu Samba Server Auth against
>>> >> IPA
>>> >>
>>> >>
>>> >>
>>> >> Hi Chris,
>>> >>
>>> >> Okay this is good to hear.
>>> >>
>>> >> But don't we want a IPA managed Scheme ?
>>> >>
>>> >> When I did a "ipa-adtrust-install --add-sids" it also wanted a local
>>> >> installed Samba and I wonder why.
>>> >>
>>> >> Good that we make some progres on making it all clear.
>>> >>
>>> >> Cheers,
>>> >>
>>> >> Matt
>>> >>
>>> >> 2015-08-10 6:12 GMT+02:00 Christopher Lamb
>>> >> <christopher.lamb at ch.ibm.com>:
>>> >>> ldapsam + the samba extensions, pretty much as described in the
>>> >> Techslaves
>>> >>> article. Once I have a draft for the wiki page, I will mail you.
>>> >>>
>>> >>>
>>> >>>
>>> >>> From: "Matt ." <yamakasi.014 at gmail.com>
>>> >>> To: Christopher Lamb/Switzerland/IBM at IBMCH,
>>> >>> "freeipa-users at redhat.com" <freeipa-users at redhat.com>
>>> >>> Date: 09.08.2015 21:17
>>> >>> Subject: Re: [Freeipa-users] Ubuntu Samba Server Auth against
>>> >>> IPA
>>> >>>
>>> >>>
>>> >>>
>>> >>> Hi,
>>> >>>
>>> >>> Yes I know about "anything" but which way did you use now ?
>>> >>>
>>> >>>
>>> >>>
>>> >>> 2015-08-09 20:56 GMT+02:00 Christopher Lamb
>>> >> <christopher.lamb at ch.ibm.com>:
>>> >>>> Hi Matt
>>> >>>>
>>> >>>> I am on OEL 7.1. - so anything that works on that should be good for
>>> >> RHEL
>>> >>>> and Centos 7.x
>>> >>>>
>>> >>>> I intend to add a how-to to the FreeIPA Wiki over the next few days.
>>> >>>> As
>>> >>> we
>>> >>>> have suggested earlier, we will likely end up with several, one for
>>> >>>> each
>>> >>> of
>>> >>>> the possible integration paths.
>>> >>>>
>>> >>>> Chris
>>> >>>>
>>> >>>>
>>> >>>>
>>> >>>>
>>> >>>>
>>> >>>> From: "Matt ." <yamakasi.014 at gmail.com>
>>> >>>> To: Christopher Lamb/Switzerland/IBM at IBMCH,
>>> >>>> "freeipa-users at redhat.com" <freeipa-users at redhat.com>
>>> >>>> Date: 09.08.2015 16:45
>>> >>>> Subject: Re: [Freeipa-users] Ubuntu Samba Server Auth against
>>> >>>> IPA
>>> >>>>
>>> >>>>
>>> >>>>
>>> >>>> Hi Chris,
>>> >>>>
>>> >>>> This sounds great!
>>> >>>>
>>> >>>> What are you using now, both CentOS ? So Samba and FreeIPA ?
>>> >>>>
>>> >>>> Maybe it's good to explain which way you used now in steps too, so we
>>> >>>> can combine or create multiple howto's ?
>>> >>>>
>>> >>>> At least we are going somewhere!
>>> >>>>
>>> >>>> Thanks,
>>> >>>>
>>> >>>> Matt
>>> >>>>
>>> >>>> 2015-08-09 14:54 GMT+02:00 Christopher Lamb
>>> >>> <christopher.lamb at ch.ibm.com>:
>>> >>>>> Hi Matt
>>> >>>>>
>>> >>>>> My test integration of FreeIPA 4.x and Samba 4.x with the "good old
>>> >>> Samba
>>> >>>>> Schema extensions) is up and working, almost flawlessly.
>>> >>>>>
>>> >>>>> I can add users and groups via the FreeIPA CLI, and they get the
>>> >> correct
>>> >>>>> ObjectClasses / attributes required for Samba.
>>> >>>>>
>>> >>>>> So far I have not yet bothered to try the extensions to the WebUI,
>>> >>>> because
>>> >>>>> it is currently giving me the classic "Your session has expired.
>>> >>>>> Please
>>> >>>>> re-login." error which renders the WebUI useless.
>>> >>>>>
>>> >>>>> The only problem I have so far encountered managing Samba / FreeIPA
>>> >>> users
>>> >>>>> via FreeIPA CLI commands is with the handling of the attribute
>>> >>>>> sambaPwdLastSet. This is the subject of an existing thread, also
>>> >> updated
>>> >>>>> today.
>>> >>>>>
>>> >>>>> There is also an existing alternative to hacking group.py, using
>>> >>>>> "Class
>>> >>>> of
>>> >>>>> Service" (Cos) documented in this thread from February 2015
>>> >>>>>
>>> >>>
>>> >>> https://www.redhat.com/archives/freeipa-users/2015-February/msg00172.html
>>> >>>> .
>>> >>>>> I have not yet tried it, but it sounds reasonable.
>>> >>>>>
>>> >>>>> Chris
>>> >>>>>
>>> >>>>>
>>> >>>>>
>>> >>>>>
>>> >>>>>
>>> >>>>> From: "Matt ." <yamakasi.014 at gmail.com>
>>> >>>>> To: Christopher Lamb/Switzerland/IBM at IBMCH
>>> >>>>> Cc: "freeipa-users at redhat.com" <freeipa-users at redhat.com>,
>>> >>>>> Youenn
>>> >>>>> PIOLET <piolet.y at gmail.com>
>>> >>>>> Date: 06.08.2015 16:19
>>> >>>>> Subject: Re: [Freeipa-users] Ubuntu Samba Server Auth against
>>> >> IPA
>>> >>>>>
>>> >>>>>
>>> >>>>>
>>> >>>>> Hi Chris,
>>> >>>>>
>>> >>>>> OK, than we might create two different versions of the wiki, I think
>>> >>>>> this is nice.
>>> >>>>>
>>> >>>>> I'm still figuring out why I get that:
>>> >>>>>
>>> >>>>> IPA Error 4205: ObjectclassViolation
>>> >>>>>
>>> >>>>> missing attribute "sambaGroupType" required by object class
>>> >>>>> "sambaGroupMapping"
>>> >>>>>
>>> >>>>> Matt
>>> >>>>>
>>> >>>>> 2015-08-06 16:09 GMT+02:00 Christopher Lamb
>>> >>>> <christopher.lamb at ch.ibm.com>:
>>> >>>>>> Hi Matt
>>> >>>>>>
>>> >>>>>> As far as I can make out, there are at least 2 viable Samba /
>>> >>>>>> FreeIPA
>>> >>>>>> integration paths.
>>> >>>>>>
>>> >>>>>> The route I took is suited where there is no Active Directory
>>> >> involved:
>>> >>>>> In
>>> >>>>>> my case all the Windows, OSX and Linux clients are islands that sit
>>> >>>>>> on
>>> >>>>> the
>>> >>>>>> same network.
>>> >>>>>>
>>> >>>>>> The route that Youenn has taken (unless I have got completely the
>>> >> wrong
>>> >>>>> end
>>> >>>>>> of the stick) requires Active Directory in the architecture.
>>> >>>>>>
>>> >>>>>> Chris
>>> >>>>>>
>>> >>>>>>
>>> >>>>>>
>>> >>>>>> From: "Matt ." <yamakasi.014 at gmail.com>
>>> >>>>>> To: Youenn PIOLET <piolet.y at gmail.com>
>>> >>>>>> Cc: Christopher Lamb/Switzerland/IBM at IBMCH,
>>> >>>>>> "freeipa-users at redhat.com" <freeipa-users at redhat.com>
>>> >>>>>> Date: 06.08.2015 14:42
>>> >>>>>> Subject: Re: [Freeipa-users] Ubuntu Samba Server Auth
>>> >>>>>> against
>>> >>> IPA
>>> >>>>>>
>>> >>>>>>
>>> >>>>>>
>>> >>>>>> Hi,
>>> >>>>>>
>>> >>>>>> OK, this sounds already quite logical, but I'm still refering to
>>> >>>>>> the
>>> >>>>>> old howto we found earlier, does that one still apply somewhere or
>>> >>>>>> not
>>> >>>>>> at all ?
>>> >>>>>>
>>> >>>>>> Thanks,
>>> >>>>>>
>>> >>>>>> Matt
>>> >>>>>>
>>> >>>>>>
>>> >>>>>>
>>> >>>>>> 2015-08-06 12:23 GMT+02:00 Youenn PIOLET <piolet.y at gmail.com>:
>>> >>>>>>> Hey guys,
>>> >>>>>>>
>>> >>>>>>> I'll try to make a tutorial soon, sorry I'm quite in a rush these
>>> >>>>> days :)
>>> >>>>>>>
>>> >>>>>>> General idea:
>>> >>>>>>>
>>> >>>>>>> On FreeIPA (4.1)
>>> >>>>>>> - `ipa-adtrust-install --add-sids` (creates
>>> >>>>>>> ipaNTsecurityidentifier
>>> >>>>>>> attribude, also known as SID)
>>> >>>>>>> - regenerate each user password to build ipaNTHash attribute, not
>>> >> here
>>> >>>>> by
>>> >>>>>>> default on users
>>> >>>>>>> - use your ldap browser to check ipaNTHash values are here on user
>>> >>>>>> objects
>>> >>>>>>> - create a CIFS service for your samba server
>>> >>>>>>> - Create user roles/permissions as described here:
>>> >>>>>>>
>>> >>>>>>
>>> >>>>>
>>> >>>>
>>> >>>
>>> >>
>>> >> http://freeipa-users.redhat.narkive.com/ez2uKpFS/authenticate-samba-3-or-4-with-freeipa
>>> >>
>>> >>>
>>> >>>>
>>> >>>>>
>>> >>>>>>
>>> >>>>>>> so that CIFS service will be able to read ipaNTsecurityidentifier
>>> >>>>>>> and
>>> >>>>>>> ipaNTHash attributes in LDAP (ACI)
>>> >>>>>>> - SCP ipasam.so module to your cifs server (this is the magic
>>> >> trick) :
>>> >>>>>> scp
>>> >>>>>>> /usr/lib64/samba/pdb/ipasam.so
>>> >>>>>>> root at samba-server.domain:/usr/lib64/samba/pdb/ You can also try to
>>> >>>>>> recompile
>>> >>>>>>> it.
>>> >>>>>>>
>>> >>>>>>> On SAMBA Server side (CentOS 7...)
>>> >>>>>>> - Install server keytab file for CIFS
>>> >>>>>>> - check ipasam.so is here.
>>> >>>>>>> - check you can read password hash in LDAP with `ldapsearch -Y
>>> >>>>>>> GSSAPI
>>> >>>>>>> uid=admin ipaNTHash` thanks to kerberos
>>> >>>>>>> - make your smb.conf following the linked thread and restart
>>> >>>>>>> service
>>> >>>>>>>
>>> >>>>>>> I don't know if it works in Ubuntu. I know sssd has evolved
>>> >>>>>>> quickly
>>> >>> and
>>> >>>>>>> ipasam may use quite recent functionalities, the best is to just
>>> >>>>>>> try.
>>> >>>>> You
>>> >>>>>>> can read in previous thread : "If you insist on Ubuntu you need to
>>> >> get
>>> >>>>>>> ipasam somewhere, most likely to compile it yourself".
>>> >>>>>>>
>>> >>>>>>> Make sure your user has ipaNTHash attribute :)
>>> >>>>>>>
>>> >>>>>>> You may want to debug authentication on samba server, I usually do
>>> >>>> this:
>>> >>>>>>> `tail -f /var/log/samba/log* | grep <username>
>>> >>>>>>>
>>> >>>>>>> Cheers
>>> >>>>>>> --
>>> >>>>>>> Youenn Piolet
>>> >>>>>>> piolet.y at gmail.com
>>> >>>>>>>
>>> >>>>>>>
>>> >>>>>>> 2015-08-05 17:40 GMT+02:00 Matt . <yamakasi.014 at gmail.com>:
>>> >>>>>>>>
>>> >>>>>>>> Hi,
>>> >>>>>>>>
>>> >>>>>>>> This sounds great to me too, but a howto would help to make it
>>> >>>>>>>> more
>>> >>>>>>>> clear about what you have done here. The thread confuses me a
>>> >>>>>>>> little
>>> >>>>>>>> bit.
>>> >>>>>>>>
>>> >>>>>>>> Can you paste your commands so we can test out too and report
>>> >>>>>>>> back ?
>>> >>>>>>>>
>>> >>>>>>>> Thanks!
>>> >>>>>>>>
>>> >>>>>>>> Matt
>>> >>>>>>>>
>>> >>>>>>>> 2015-08-05 15:18 GMT+02:00 Christopher Lamb
>>> >>>>>> <christopher.lamb at ch.ibm.com>:
>>> >>>>>>>> > Hi Youenn
>>> >>>>>>>> >
>>> >>>>>>>> > Good news that you have got an integration working
>>> >>>>>>>> >
>>> >>>>>>>> > Now you have got it going, and the solution is fresh in your
>>> >>>>>>>> > mind,
>>> >>>>> how
>>> >>>>>>>> > about adding a How-to page on this solution to the FreeIPA
>>> >>>>>>>> > wiki?
>>> >>>>>>>> >
>>> >>>>>>>> > Chris
>>> >>>>>>>> >
>>> >>>>>>>> >
>>> >>>>>>>> >
>>> >>>>>>>> > From: Youenn PIOLET <piolet.y at gmail.com>
>>> >>>>>>>> > To: "Matt ." <yamakasi.014 at gmail.com>
>>> >>>>>>>> > Cc: Christopher Lamb/Switzerland/IBM at IBMCH,
>>> >>>>>>>> > "freeipa-users at redhat.com"
>>> >>>>>>>> > <freeipa-users at redhat.com>
>>> >>>>>>>> > Date: 05.08.2015 14:51
>>> >>>>>>>> > Subject: Re: [Freeipa-users] Ubuntu Samba Server Auth
>>> >>> against
>>> >>>>>> IPA
>>> >>>>>>>> >
>>> >>>>>>>> >
>>> >>>>>>>> >
>>> >>>>>>>> > Hi guys,
>>> >>>>>>>> >
>>> >>>>>>>> > Thank you so much your previous answers.
>>> >>>>>>>> > I realised my SID were stored in ipaNTsecurityidentifier,
>>> >>>>>>>> > thanks
>>> >> to
>>> >>>>>>>> > ipa-adtrust-install --add-sids
>>> >>>>>>>> >
>>> >>>>>>>> > I found an other way to configure smb here:
>>> >>>>>>>> >
>>> >>>>>>>> >
>>> >>>>>>
>>> >>>>>
>>> >>>>
>>> >>>
>>> >>
>>> >> http://freeipa-users.redhat.narkive.com/ez2uKpFS/authenticate-samba-3-or-4-with-freeipa
>>> >>
>>> >>>
>>> >>>>
>>> >>>>>
>>> >>>>>>
>>> >>>>>>>> > It works perfectly.
>>> >>>>>>>> >
>>> >>>>>>>> > I'm using module ipasam.so I have manually scp to the samba
>>> >> server,
>>> >>>>>>>> > Samba is set to use kerberos + ldapsam via this ipasam module.
>>> >>>>>>>> > Following the instructions, I created a user role allowing
>>> >>>>>>>> > service
>>> >>>>>>>> > principal to read ipaNTHash value from the LDAP.
>>> >>>>>>>> > ipaNTHash are generated each time a user changes his password.
>>> >>>>>>>> > Authentication works perfectly on Windows 7, 8 and 10.
>>> >>>>>>>> >
>>> >>>>>>>> > For more details, the previously linked thread is quite clear.
>>> >>>>>>>> >
>>> >>>>>>>> > Cheers
>>> >>>>>>>> >
>>> >>>>>>>> > --
>>> >>>>>>>> > Youenn Piolet
>>> >>>>>>>> > piolet.y at gmail.com
>>> >>>>>>>> >
>>> >>>>>>>> >
>>> >>>>>>>> > 2015-08-05 11:10 GMT+02:00 Matt . <yamakasi.014 at gmail.com>:
>>> >>>>>>>> > Hi Chris.
>>> >>>>>>>> >
>>> >>>>>>>> > Yes, Apache Studio did that but I was not sure why it
>>> >>>>>>>> > complained
>>> >>>> it
>>> >>>>>>>> > was "already" there.
>>> >>>>>>>> >
>>> >>>>>>>> > I'm still getting:
>>> >>>>>>>> >
>>> >>>>>>>> > IPA Error 4205: ObjectclassViolation
>>> >>>>>>>> >
>>> >>>>>>>> > missing attribute "sambaGroupType" required by object class
>>> >>>>>>>> > "sambaGroupMapping"
>>> >>>>>>>> >
>>> >>>>>>>> > When adding a user.
>>> >>>>>>>> >
>>> >>>>>>>> > I also see "class" as fielname under my "Last name", this is
>>> >>>>>>>> > not
>>> >>>> OK
>>> >>>>>>>> > also.
>>> >>>>>>>> >
>>> >>>>>>>> >
>>> >>>>>>>> >
>>> >>>>>>>> > We sure need to make some howto, I think we can nail this
>>> >> down :)
>>> >>>>>>>> >
>>> >>>>>>>> > Thanks for the heads up!
>>> >>>>>>>> >
>>> >>>>>>>> > Matthijs
>>> >>>>>>>> >
>>> >>>>>>>> > 2015-08-05 7:51 GMT+02:00 Christopher Lamb
>>> >>>>>>>> > <christopher.lamb at ch.ibm.com>:
>>> >>>>>>>> > > Hi Matt
>>> >>>>>>>> > >
>>> >>>>>>>> > > If I use Apache Directory Studio to add an attribute
>>> >>>>>> ipaCustomFields
>>> >>>>>>>> > to
>>> >>>>>>>> > > cn=ipaConfig,cn=etc, the operation it performs is a modify,
>>> >>>>>>>> > as
>>> >>>>>> shown
>>> >>>>>>>> > below:
>>> >>>>>>>> > >
>>> >>>>>>>> > > #!RESULT OK
>>> >>>>>>>> > > #!CONNECTION ldap://xxx-ldap2.my.silly.example.com:yyy
>>> >>>>>>>> > > #!DATE 2015-08-05T05:45:04.608
>>> >>>>>>>> > > dn: cn=ipaConfig,cn=etc,dc=my,dc=silly,dc=example,dc=com
>>> >>>>>>>> > > changetype: modify
>>> >>>>>>>> > > add: ipaCustomFields
>>> >>>>>>>> > > ipaCustomFields: Samba Group Type,sambagrouptype,true
>>> >>>>>>>> > >
>>> >>>>>>>> > > After that I then have a visible attribute ipaCustomFields
>>> >>>>>>>> > as
>>> >>>>>>>> > expected.
>>> >>>>>>>> > >
>>> >>>>>>>> > > When adding the attribute, the wizard offered me
>>> >>>>> "ipaCustomFields"
>>> >>>>>>>> > as
>>> >>>>>>>> > > attribute type in a drop down list.
>>> >>>>>>>> > >
>>> >>>>>>>> > > Once we get this cracked, we really must write a how-to on
>>> >>>>>>>> > the
>>> >>>>>>>> > FreeIPA
>>> >>>>>>>> > > Wiki.
>>> >>>>>>>> > >
>>> >>>>>>>> > > Chris
>>> >>>>>>>> > >
>>> >>>>>>>> > >
>>> >>>>>>>> > >
>>> >>>>>>>> > > From: Christopher Lamb/Switzerland/IBM at IBMCH
>>> >>>>>>>> > > To: "Matt ." <yamakasi.014 at gmail.com>
>>> >>>>>>>> > > Cc: "freeipa-users at redhat.com"
>>> >>>>>>>> > <freeipa-users at redhat.com>
>>> >>>>>>>> > > Date: 05.08.2015 07:31
>>> >>>>>>>> > > Subject: Re: [Freeipa-users] Ubuntu Samba Server
>>> >>>>>>>> > Auth
>>> >>>>>> against
>>> >>>>>>>> > IPA
>>> >>>>>>>> > > Sent by: freeipa-users-bounces at redhat.com
>>> >>>>>>>> > >
>>> >>>>>>>> > >
>>> >>>>>>>> > >
>>> >>>>>>>> > > Hi Matt
>>> >>>>>>>> > >
>>> >>>>>>>> > > I also got the same result at that step, but can see
>>> >>>>>>>> > nothing
>>> >> in
>>> >>>>>>>> > Apache
>>> >>>>>>>> > > Directory Studio.
>>> >>>>>>>> > >
>>> >>>>>>>> > > As I am using existing Samba / FreeIPA groups migrated
>>> >>>>>>>> > across,
>>> >>>>>> they
>>> >>>>>>>> > > probably were migrated with all the required attributes.
>>> >>>>>>>> > >
>>> >>>>>>>> > > Looking more closely at that LDIF: I wonder should it not
>>> >>>>>>>> > be:
>>> >>>>>>>> > >
>>> >>>>>>>> > > ldapmodify -Y GSSAPI <<EOF
>>> >>>>>>>> > > dn: cn=ipaconfig,cn=etc,dc=domain,dc=tld
>>> >>>>>>>> > > changetype: modify
>>> >>>>>>>> > > add: ipaCustomFields
>>> >>>>>>>> > > ipaCustomFields: "Samba Group Type,sambagrouptype,true"
>>> >>>>>>>> > > EOF
>>> >>>>>>>> > >
>>> >>>>>>>> > > i.e. changetype: modify, instead of changetype add ?
>>> >>>>>>>> > >
>>> >>>>>>>> > > I don't want to play around with my prod directory - I will
>>> >>>> setup
>>> >>>>>> an
>>> >>>>>>>> > EL
>>> >>>>>>>> > 7.1
>>> >>>>>>>> > > VM and install FreeIPA 4.x and Samba 4.x That will allow me
>>> >>>>>>>> > to
>>> >>>>>> play
>>> >>>>>>>> > around
>>> >>>>>>>> > > more destructively.
>>> >>>>>>>> > >
>>> >>>>>>>> > > Chris
>>> >>>>>>>> > >
>>> >>>>>>>> > >
>>> >>>>>>>> > >
>>> >>>>>>>> > >
>>> >>>>>>>> > >
>>> >>>>>>>> > > From: "Matt ." <yamakasi.014 at gmail.com>
>>> >>>>>>>> > > To: Christopher Lamb/Switzerland/IBM at IBMCH
>>> >>>>>>>> > > Cc: Youenn PIOLET <piolet.y at gmail.com>, "
>>> >>>>>>>> > freeipa-users at redhat.com"
>>> >>>>>>>> > > <freeipa-users at redhat.com>
>>> >>>>>>>> > > Date: 05.08.2015 01:01
>>> >>>>>>>> > > Subject: Re: [Freeipa-users] Ubuntu Samba
>>> >>> Server
>>> >>>>>>>> > Auth
>>> >>>>>>>> > against IPA
>>> >>>>>>>> > >
>>> >>>>>>>> > >
>>> >>>>>>>> > >
>>> >>>>>>>> > > Hi Chris,
>>> >>>>>>>> > >
>>> >>>>>>>> > > I'm at the right path, but my issue is that:
>>> >>>>>>>> > >
>>> >>>>>>>> > > ldapmodify -Y GSSAPI <<EOF
>>> >>>>>>>> > > dn: cn=ipaconfig,cn=etc,dc=domain,dc=tld
>>> >>>>>>>> > > changetype: add
>>> >>>>>>>> > > add: ipaCustomFields
>>> >>>>>>>> > > ipaCustomFields: "Samba Group Type,sambagrouptype,true"
>>> >>>>>>>> > > EOF
>>> >>>>>>>> > >
>>> >>>>>>>> > > Does say it exists, my ldap explorer doesn't show it, and
>>> >>>>>>>> > when
>>> >>> I
>>> >>>>>> add
>>> >>>>>>>> > > it manually as an attribute it still fails when I add a
>>> >>>>>>>> > user
>>> >> on
>>> >>>>>> this
>>> >>>>>>>> > > sambagrouptype as it's needed by the other attributes
>>> >>>>>>>> > >
>>> >>>>>>>> > > So that is my issue I think so far.
>>> >>>>>>>> > >
>>> >>>>>>>> > > Any clue about that ?
>>> >>>>>>>> > >
>>> >>>>>>>> > > No problem "you don't know something or are no guru" we are
>>> >> all
>>> >>>>>>>> > > learning! :)
>>> >>>>>>>> > >
>>> >>>>>>>> > > Cheers,
>>> >>>>>>>> > >
>>> >>>>>>>> > > Matt
>>> >>>>>>>> > >
>>> >>>>>>>> > >
>>> >>>>>>>> > > 2015-08-04 21:22 GMT+02:00 Christopher Lamb <
>>> >>>>>>>> > christopher.lamb at ch.ibm.com>:
>>> >>>>>>>> > >> Hi Matt, Youeen
>>> >>>>>>>> > >>
>>> >>>>>>>> > >> Just to set the background properly, I did not invent this
>>> >>>>>> process.
>>> >>>>>>>> > I
>>> >>>>>>>> > > know
>>> >>>>>>>> > >> only a little about FreeIPA, and almost nothing about
>>> >>>>>>>> > Samba,
>>> >>>> but
>>> >>>>>> I
>>> >>>>>>>> > guess
>>> >>>>>>>> > > I
>>> >>>>>>>> > >> was lucky enough to get the integration working on a
>>> >>>>>>>> > Sunday
>>> >>>>>>>> > afternoon.
>>> >>>>>>>> > (I
>>> >>>>>>>> > >> did have an older FreeIPA 3.x / Samba 3.x installation as
>>> >>>>>>>> > a
>>> >>>>>>>> > reference).
>>> >>>>>>>> > >>
>>> >>>>>>>> > >> It sounds like we need to step back, and look at the test
>>> >> user
>>> >>>>>> and
>>> >>>>>>>> > group
>>> >>>>>>>> > > in
>>> >>>>>>>> > >> the FreeIPA LDAP tree. I find using an LDAP browser makes
>>> >> this
>>> >>>>>> much
>>> >>>>>>>> > > easier.
>>> >>>>>>>> > >>
>>> >>>>>>>> > >> My FreeIPA / Samba Users have the following Samba
>>> >>>>>>>> > extensions
>>> >>> in
>>> >>>>>>>> > FreeIPA
>>> >>>>>>>> > >> (cn=accounts, cn=users):
>>> >>>>>>>> > >>
>>> >>>>>>>> > >> * objectClass: sambasamaccount
>>> >>>>>>>> > >>
>>> >>>>>>>> > >> * Attributes: sambaSID, sambaNTPassword, sambaPwdLastSet
>>> >>>>>>>> > >>
>>> >>>>>>>> > >> My FreeIPA / Samba Groups have the following Samba
>>> >>>>>>>> > extensions
>>> >>>> in
>>> >>>>>>>> > FreeIPA
>>> >>>>>>>> > >> (cn=accounts, cn=groups):
>>> >>>>>>>> > >>
>>> >>>>>>>> > >> * objectClass: sambaGroupMapping
>>> >>>>>>>> > >>
>>> >>>>>>>> > >> * Attributes: sambaGroupType, sambaSID
>>> >>>>>>>> > >>
>>> >>>>>>>> > >> The Users must belong to one or more of the samba groups
>>> >>>>>>>> > that
>>> >>>>> you
>>> >>>>>>>> > have
>>> >>>>>>>> > >> setup.
>>> >>>>>>>> > >>
>>> >>>>>>>> > >> If you don't have something similar to the above (which
>>> >> sounds
>>> >>>>>> like
>>> >>>>>>>> > it
>>> >>>>>>>> > is
>>> >>>>>>>> > >> the case), then something went wrong applying the
>>> >>>>>>>> > extensions.
>>> >>>> It
>>> >>>>>>>> > would
>>> >>>>>>>> > be
>>> >>>>>>>> > >> worth testing comparing a new user / group created post
>>> >> adding
>>> >>>>>> the
>>> >>>>>>>> > >> extensions to a previous existing user.
>>> >>>>>>>> > >>
>>> >>>>>>>> > >> i.e.
>>> >>>>>>>> > >> are the extensions missing on existing users / groups?
>>> >>>>>>>> > >> are the extensions missing on new users / groups?
>>> >>>>>>>> > >>
>>> >>>>>>>> > >> Cheers
>>> >>>>>>>> > >>
>>> >>>>>>>> > >> Chris
>>> >>>>>>>> > >>
>>> >>>>>>>> > >>
>>> >>>>>>>> > >>
>>> >>>>>>>> > >>
>>> >>>>>>>> > >>
>>> >>>>>>>> > >> From: Youenn PIOLET <piolet.y at gmail.com>
>>> >>>>>>>> > >> To: "Matt ." <yamakasi.014 at gmail.com>
>>> >>>>>>>> > >> Cc: Christopher Lamb/Switzerland/IBM at IBMCH,
>>> >>>>>>>> > >> "freeipa-users at redhat.com"
>>> >>>>> <freeipa-users at redhat.com>
>>> >>>>>>>> > >> Date: 04.08.2015 18:56
>>> >>>>>>>> > >> Subject: Re: [Freeipa-users] Ubuntu Samba Server
>>> >>>>>>>> > Auth
>>> >>>>>>>> > against
>>> >>>>>>>> > IPA
>>> >>>>>>>> > >>
>>> >>>>>>>> > >>
>>> >>>>>>>> > >>
>>> >>>>>>>> > >> Hi there,
>>> >>>>>>>> > >>
>>> >>>>>>>> > >> I have difficulties to follow you at this point :)
>>> >>>>>>>> > >> Here is what I've done and what I've understood:
>>> >>>>>>>> > >>
>>> >>>>>>>> > >> ## SMB Side
>>> >>>>>>>> > >> - Testparm OK
>>> >>>>>>>> > >> - I've got the same NT_STATUS_NO_SUCH_USER when I try to
>>> >>>>> connect.
>>> >>>>>>>> > >> - pdbedit -Lv output is all successfull but I can see
>>> >>>>>>>> > there
>>> >> is
>>> >>>> a
>>> >>>>>>>> > filter :
>>> >>>>>>>> > >> (&(uid=*)(objectclass=sambaSamAccount). In LDAP, the users
>>> >>>> don't
>>> >>>>>>>> > have
>>> >>>>>>>> > >> sambaSamAccount.
>>> >>>>>>>> > >>
>>> >>>>>>>> > >> ## LDAP / FreeIPA side
>>> >>>>>>>> > >> - Since SMB server uses LDAP, I did ipa-adtrust-install on
>>> >>>>>>>> > my
>>> >>>>>>>> > FreeIPA
>>> >>>>>>>> > >> server to get samba LDAP extensions.
>>> >>>>>>>> > >> - I can see samba classes exist in LDAP but are not used
>>> >>>>>>>> > on
>>> >> my
>>> >>>>>>>> > group
>>> >>>>>>>> > >> objects nor my user objects
>>> >>>>>>>> > >> - I have add sambaSamAccount in FreeIPA default user
>>> >>>>>>>> > classes,
>>> >>>>>>>> > >> and sambaGroupMapping to default group classes. In that
>>> >>>>>>>> > state
>>> >>> I
>>> >>>>>>>> > can't
>>> >>>>>>>> > >> create user nor groups anymore, as new samba attributes
>>> >>>>>>>> > are
>>> >>>>>> needed
>>> >>>>>>>> > for
>>> >>>>>>>> > >> instantiation.
>>> >>>>>>>> > >> - I have add in etc ipaCustomFields: 'Samba Group
>>> >>>>>>>> > > Type,sambagrouptype,true'
>>> >>>>>>>> > >> but I don't get what it does.
>>> >>>>>>>> > >> - I tried to add the samba.js plugin. It works, and adds
>>> >>>>>>>> > the
>>> >>>>>>>> > "local"
>>> >>>>>>>> > > option
>>> >>>>>>>> > >> when creating a group in FreeIPA, supposed to set
>>> >>>> sambagrouptype
>>> >>>>>> to
>>> >>>>>>>> > 4
>>> >>>>>>>> > or
>>> >>>>>>>> > > 2
>>> >>>>>>>> > >> (domain). It doesn't work and tells that sambagrouptype
>>> >>>>> attribute
>>> >>>>>>>> > doesn't
>>> >>>>>>>> > >> exist (but it should now I put sambaGroupType class by
>>> >>>>>> default...)
>>> >>>>>>>> > >>
>>> >>>>>>>> > >> ## Questions
>>> >>>>>>>> > >> 0) Can I ask samba not to search sambaSamAccount and use
>>> >>> unix /
>>> >>>>>>>> > posix
>>> >>>>>>>> > >> instead? I guess no.
>>> >>>>>>>> > >> 1) How to generate the user/group SIDs ? They are
>>> >>>>>>>> > requested
>>> >> to
>>> >>>>>> add
>>> >>>>>>>> > >> sambaSamAccount classes.
>>> >>>>>>>> > >> This article doesn't seem relevant since we don't use
>>> >>>>>>>> > domain
>>> >>>>>>>> > controller
>>> >>>>>>>> > >>
>>> >>>>>>>> > >
>>> >>>>>>>> >
>>> >>>>>>>> >
>>> >>>>>>
>>> >>>>>
>>> >>>>
>>> >>>
>>> >>
>>> >> http://docs.fedoraproject.org/en-US/Fedora/17/html/FreeIPA_Guide/cifs.html
>>> >>>>>>>> >
>>> >>>>>>>> > >> and netgetlocalsid returns an error.
>>> >>>>>>>> > >> 2) How to fix samba.js plugin?
>>> >>>>>>>> > >> 3) I guess an equivalent of samba.js is needed for user
>>> >>>>> creation,
>>> >>>>>>>> > where
>>> >>>>>>>> > > can
>>> >>>>>>>> > >> I find it?
>>> >>>>>>>> > >> 4) Is your setup working with Windows 8 / Windows 10 and
>>> >>>>>>>> > not
>>> >>>>> only
>>> >>>>>>>> > Windows
>>> >>>>>>>> > >> 7?
>>> >>>>>>>> > >>
>>> >>>>>>>> > >> Thanks a lot for your previous and future answers
>>> >>>>>>>> > >>
>>> >>>>>>>> > >> --
>>> >>>>>>>> > >> Youenn Piolet
>>> >>>>>>>> > >> piolet.y at gmail.com
>>> >>>>>>>> > >>
>>> >>>>>>>> > >>
>>> >>>>>>>> > >> 2015-08-04 17:55 GMT+02:00 Matt .
>>> >>>>>>>> > <yamakasi.014 at gmail.com>:
>>> >>>>>>>> > >> Hi,
>>> >>>>>>>> > >>
>>> >>>>>>>> > >> Yes, log is anonymised.
>>> >>>>>>>> > >>
>>> >>>>>>>> > >> It's strange, my user doesn't have a SambaPwdLastSet,
>>> >>>>>>>> > also
>>> >>>>> when
>>> >>>>>> I
>>> >>>>>>>> > >> change it's password it doesn't get it in ldap.
>>> >>>>>>>> > >>
>>> >>>>>>>> > >> There must be something going wrong I guess.
>>> >>>>>>>> > >>
>>> >>>>>>>> > >> Matt
>>> >>>>>>>> > >>
>>> >>>>>>>> > >> 2015-08-04 17:45 GMT+02:00 Christopher Lamb
>>> >>>>>>>> > > <christopher.lamb at ch.ibm.com
>>> >>>>>>>> > >> >:
>>> >>>>>>>> > >> > Hi Matt
>>> >>>>>>>> > >> >
>>> >>>>>>>> > >> > I assume [username] is a real username, identical to
>>> >>>>>>>> > that
>>> >>>> in
>>> >>>>>>>> > the
>>> >>>>>>>> > >> FreeIPA
>>> >>>>>>>> > >> > cn=accounts, cn=users tree? (i.e. you anonymised the
>>> >>>>>>>> > log
>>> >>>>>>>> > extract).
>>> >>>>>>>> > >> >
>>> >>>>>>>> > >> > You user should be a member of the appropriate samba
>>> >>> groups
>>> >>>>>>>> > that
>>> >>>>>>>> > you
>>> >>>>>>>> > >> setup
>>> >>>>>>>> > >> > in FreeIPA.
>>> >>>>>>>> > >> >
>>> >>>>>>>> > >> > You should check that the user attribute
>>> >>>>>>>> > SambaPwdLastSet
>>> >>> is
>>> >>>>>> set
>>> >>>>>>>> > to
>>> >>>>>>>> > a
>>> >>>>>>>> > >> > positive value (e.g. 1). If not you get an error in
>>> >>>>>>>> > the
>>> >>>>> Samba
>>> >>>>>>>> > logs
>>> >>>>>>>> > -
>>> >>>>>>>> > > I
>>> >>>>>>>> > >> > would need to play around again with a test user to
>>> >>>>>>>> > find
>>> >>>> out
>>> >>>>>>>> > the
>>> >>>>>>>> > > exact
>>> >>>>>>>> > >> > error.
>>> >>>>>>>> > >> >
>>> >>>>>>>> > >> > I don't understand what you mean about syncing the
>>> >>>>>>>> > users
>>> >>>>>> local,
>>> >>>>>>>> > but
>>> >>>>>>>> > > we
>>> >>>>>>>> > >> did
>>> >>>>>>>> > >> > not need to do anything like that.
>>> >>>>>>>> > >> >
>>> >>>>>>>> > >> > Chris
>>> >>>>>>>> > >> >
>>> >>>>>>>> > >> >
>>> >>>>>>>> > >> >
>>> >>>>>>>> > >> >
>>> >>>>>>>> > >> > From: "Matt ." <yamakasi.014 at gmail.com>
>>> >>>>>>>> > >> > To: Christopher Lamb/Switzerland/IBM at IBMCH
>>> >>>>>>>> > >> > Cc: "freeipa-users at redhat.com"
>>> >>>>> <freeipa-users at redhat.com>
>>> >>>>>>>> > >> > Date: 04.08.2015 15:33
>>> >>>>>>>> > >> > Subject: Re: [Freeipa-users] Ubuntu Samba
>>> >>>>>>>> > Server
>>> >>>> Auth
>>> >>>>>>>> > against
>>> >>>>>>>> > >> IPA
>>> >>>>>>>> > >> >
>>> >>>>>>>> > >> >
>>> >>>>>>>> > >> >
>>> >>>>>>>> > >> > Hi Chris,
>>> >>>>>>>> > >> >
>>> >>>>>>>> > >> > A puppet run added another passdb backend, that was
>>> >>> causing
>>> >>>>>> my
>>> >>>>>>>> > issue.
>>> >>>>>>>> > >> >
>>> >>>>>>>> > >> > What I still experience is:
>>> >>>>>>>> > >> >
>>> >>>>>>>> > >> >
>>> >>>>>>>> > >> > [2015/08/04 15:29:45.477783, 3]
>>> >>>>>>>> > >> > ../source3/auth/check_samsec.c:399(check_sam_security)
>>> >>>>>>>> > >> > check_sam_security: Couldn't find user 'username' in
>>> >>>>>> passdb.
>>> >>>>>>>> > >> > [2015/08/04 15:29:45.478026, 2]
>>> >>>>>>>> > >> > ../source3/auth/auth.c:288(auth_check_ntlm_password)
>>> >>>>>>>> > >> > check_ntlm_password: Authentication for user
>>> >> [username]
>>> >>>>> ->
>>> >>>>>>>> > >> > [username] FAILED with error NT_STATUS_NO_SUCH_USER
>>> >>>>>>>> > >> >
>>> >>>>>>>> > >> >
>>> >>>>>>>> > >> > I also wonder if I shall still sync the users local,
>>> >>>>>>>> > or
>>> >> is
>>> >>>>> it
>>> >>>>>>>> > > needed ?
>>> >>>>>>>> > >> >
>>> >>>>>>>> > >> > Thanks again,
>>> >>>>>>>> > >> >
>>> >>>>>>>> > >> > Matt
>>> >>>>>>>> > >> >
>>> >>>>>>>> > >> > 2015-08-04 14:16 GMT+02:00 Christopher Lamb <
>>> >>>>>>>> > >> christopher.lamb at ch.ibm.com>:
>>> >>>>>>>> > >> >> Hi Matt
>>> >>>>>>>> > >> >>
>>> >>>>>>>> > >> >> From our smb.conf file:
>>> >>>>>>>> > >> >>
>>> >>>>>>>> > >> >> [global]
>>> >>>>>>>> > >> >> security = user
>>> >>>>>>>> > >> >> passdb backend =
>>> >>>>>>>> > ldapsam:ldap://xxx-ldap2.my.silly.example.com
>>> >>>>>>>> > >> >> ldap suffix = dc=my,dc=silly,dc=example,dc=com
>>> >>>>>>>> > >> >> ldap admin dn = cn=Directory Manager
>>> >>>>>>>> > >> >>
>>> >>>>>>>> > >> >> So yes, we use Directory Manager, it works for us. I
>>> >> have
>>> >>>>>> not
>>> >>>>>>>> > tried
>>> >>>>>>>> > >> with
>>> >>>>>>>> > >> > a
>>> >>>>>>>> > >> >> less powerful user, but it is conceivable that a
>>> >>>>>>>> > lesser
>>> >>>>> user
>>> >>>>>>>> > may
>>> >>>>>>>> > not
>>> >>>>>>>> > >> see
>>> >>>>>>>> > >> >> all the required attributes, resulting in "no such
>>> >>>>>>>> > user"
>>> >>>>>>>> > errors.
>>> >>>>>>>> > >> >>
>>> >>>>>>>> > >> >> Chris
>>> >>>>>>>> > >> >>
>>> >>>>>>>> > >> >>
>>> >>>>>>>> > >> >>
>>> >>>>>>>> > >> >>
>>> >>>>>>>> > >> >> From: "Matt ." <yamakasi.014 at gmail.com>
>>> >>>>>>>> > >> >> To: Christopher Lamb/Switzerland/IBM at IBMCH
>>> >>>>>>>> > >> >> Cc: "freeipa-users at redhat.com"
>>> >>>>>> <freeipa-users at redhat.com>
>>> >>>>>>>> > >> >> Date: 04.08.2015 13:32
>>> >>>>>>>> > >> >> Subject: Re: [Freeipa-users] Ubuntu Samba
>>> >>>>>>>> > Server
>>> >>>>> Auth
>>> >>>>>>>> > against
>>> >>>>>>>> > >> IPA
>>> >>>>>>>> > >> >>
>>> >>>>>>>> > >> >>
>>> >>>>>>>> > >> >>
>>> >>>>>>>> > >> >> Hi Chris,
>>> >>>>>>>> > >> >>
>>> >>>>>>>> > >> >> Thanks for the heads up, indeed local is 4 I see now
>>> >> when
>>> >>>> I
>>> >>>>>>>> > add a
>>> >>>>>>>> > >> >> group from the GUI, great thanks!
>>> >>>>>>>> > >> >>
>>> >>>>>>>> > >> >> But do you use Directory Manager as ldap admin user
>>> >>>>>>>> > or
>>> >>>> some
>>> >>>>>>>> > other
>>> >>>>>>>> > >> >> admin account ?
>>> >>>>>>>> > >> >>
>>> >>>>>>>> > >> >> I'm not sure id DM is needed and it should get that
>>> >>>>>>>> > deep
>>> >>>>>> into
>>> >>>>>>>> > IPA.
>>> >>>>>>>> > >> >> Also when starting samba it cannot find "such user"
>>> >>>>>>>> > as
>>> >>>> that
>>> >>>>>>>> > sounds
>>> >>>>>>>> > >> >> quite known as it has no UID.
>>> >>>>>>>> > >> >>
>>> >>>>>>>> > >> >> From your config I see you use DM, this should work ?
>>> >>>>>>>> > >> >>
>>> >>>>>>>> > >> >> Thanks!
>>> >>>>>>>> > >> >>
>>> >>>>>>>> > >> >>
>>> >>>>>>>> > >> >> Matt
>>> >>>>>>>> > >> >>
>>> >>>>>>>> > >> >>
>>> >>>>>>>> > >> >
>>> >>>>>>>> > >> >
>>> >>>>>>>> > >> >
>>> >>>>>>>> > >> >
>>> >>>>>>>> > >>
>>> >>>>>>>> > >> --
>>> >>>>>>>> > >> Manage your subscription for the Freeipa-users mailing
>>> >> list:
>>> >>>>>>>> > >> https://www.redhat.com/mailman/listinfo/freeipa-users
>>> >>>>>>>> > >> Go to http://freeipa.org for more info on the project
>>> >>>>>>>> > >>
>>> >>>>>>>> > >>
>>> >>>>>>>> > >>
>>> >>>>>>>> > >
>>> >>>>>>>> > >
>>> >>>>>>>> > >
>>> >>>>>>>> > >
>>> >>>>>>>> > > --
>>> >>>>>>>> > > Manage your subscription for the Freeipa-users mailing
>>> >>>>>>>> > list:
>>> >>>>>>>> > > https://www.redhat.com/mailman/listinfo/freeipa-users
>>> >>>>>>>> > > Go to http://freeipa.org for more info on the project
>>> >>>>>>>> > >
>>> >>>>>>>> > >
>>> >>>>>>>> > >
>>> >>>>>>>> > >
>>> >>>>>>>> >
>>> >>>>>>>> > --
>>> >>>>>>>> > Manage your subscription for the Freeipa-users mailing list:
>>> >>>>>>>> > https://www.redhat.com/mailman/listinfo/freeipa-users
>>> >>>>>>>> > Go to http://freeipa.org for more info on the project
>>> >>>>>>>> >
>>> >>>>>>>> >
>>> >>>>>>>> >
>>> >>>>>>>
>>> >>>>>>>
>>> >>>>>>
>>> >>>>>>
>>> >>>>>>
>>> >>>>>>
>>> >>>>>
>>> >>>>>
>>> >>>>>
>>> >>>>>
>>> >>>>
>>> >>>>
>>> >>>>
>>> >>>>
>>> >>>
>>> >>>
>>> >>>
>>> >>>
>>> >>
>>> >>
>>> >>
>>> >>
>>
>>
More information about the Freeipa-users
mailing list