[Freeipa-users] Ubuntu Samba Server Auth against IPA
Matt .
yamakasi.014 at gmail.com
Thu Aug 20 06:12:32 UTC 2015
HI Guys,
Anyone still a working clue/test here ?
I didn't came further as it seems there need to be some domain join /
match following the freeipa devs.
Thanks!
Matt
2015-08-13 13:09 GMT+02:00 Matt . <yamakasi.014 at gmail.com>:
> Hi,
>
> I might have found somthing which I already seen in the logs.
>
> I did a smbpasswd my username on the samba server, it connects to ldap
> very well. I give my new password and get the following:
>
> smbldap_search_ext: base => [dc=my,dc=domain], filter =>
> [(&(objectClass=ipaNTGroupAttrs)(|(ipaNTSecurityIdentifier=S-1----my--sid---)))],
> scope => [2]
> Attribute [displayName] not found.
> Could not retrieve 'displayName' attribute from cn=Default SMB
> Group,cn=groups,cn=accounts,dc=my,dc=domain
> Sid S-1----my--sid--- -> MYDOMAIN\Default SMB Group(2)
>
> So something is missing!
>
> Thanks so far guys!
>
> Cheers,
>
> Matt
>
> 2015-08-13 12:02 GMT+02:00 Matt . <yamakasi.014 at gmail.com>:
>> Hi Youenn,
>>
>> OK thanks! this takes me a little but futher now and I see some good
>> stuff in my logging.
>>
>> I'm testing on a Windows 10 Machine which is not member of an AD or
>> so, so that might be my issue for now ?
>>
>> When testing on the samba box itself as my user I get:
>>
>>
>> [myusername at smb-01 ~]$ smbclient //smb-01.domain.local/shares
>>
>> ...
>> Checking NTLMSSP password for MSP\myusername failed: NT_STATUS_WRONG_PASSWORD
>> ...
>> SPNEGO login failed: NT_STATUS_WRONG_PASSWORD
>>
>>
>> Maybe I have an issue with encrypted passwords ?
>>
>>
>> When we have this all working, I think we have a howto :D
>>
>> Thanks!
>>
>> Matt
>>
>> 2015-08-13 10:53 GMT+02:00 Youenn PIOLET <piolet.y at gmail.com>:
>>> Hi Matt
>>>
>>> - CentOS : Did you copy ipasam.so and change your smb.conf accordingly?
>>> sambaSamAccount is not needed anymore that way.
>>> - Default IPA Way : won't work if your Windows is not part of a domain
>>> controller. DOMAIN\username may work for some users using Windows 7 - not 8
>>> nor 10 (it did for me but I was the only one at the office... quite useless)
>>>
>>> This config may work on your CentOS (for the ipasam way):
>>> workgroup = TEST
>>> realm = TEST.NET
>>> kerberos method = dedicated keytab
>>> dedicated keytab file = FILE:/<.....>/samba.keytab
>>> create krb5 conf = no
>>> security = user
>>> encrypt passwords = true
>>> passdb backend = ipasam:ldaps://youripa.test.net
>>> ldapsam:trusted = yes
>>> ldapsuffix = test.net
>>> ldap user suffix = cn=users,cn=accounts
>>> ldap group suffix = cn=groups,cn=accounts
>>>
>>>
>>> --
>>> Youenn Piolet
>>> piolet.y at gmail.com
>>>
>>>
>>> 2015-08-12 22:15 GMT+02:00 Matt . <yamakasi.014 at gmail.com>:
>>>>
>>>> Hi,
>>>>
>>>> OK the default IPA way works great actually when testing it as described
>>>> here:
>>>>
>>>> http://www.freeipa.org/page/Howto/Integrating_a_Samba_File_Server_With_IPA
>>>>
>>>> On the samba server I can auth and see my share where I want to connect
>>>> to.
>>>>
>>>> The issue is, on Windows I cannot auth, even when I do DOMAIN\username
>>>> as username
>>>>
>>>> So, the IPA way should work.
>>>>
>>>> Any comments here ?
>>>>
>>>> Cheers,
>>>>
>>>> Matt
>>>>
>>>> 2015-08-12 19:00 GMT+02:00 Matt . <yamakasi.014 at gmail.com>:
>>>> > HI GUys,
>>>> >
>>>> > I'm testing this out and I think I almost setup, this on a CentOS samba
>>>> > server.
>>>> >
>>>> > I'm using the ipa-adtrust way of Youeen but it seems we still need to
>>>> > add (objectclass=sambaSamAccount)) ?
>>>> >
>>>> > Info is welcome!
>>>> >
>>>> > I will report back when I have it working.
>>>> >
>>>> > Thanks!
>>>> >
>>>> > Matt
>>>> >
>>>> > 2015-08-10 11:16 GMT+02:00 Christopher Lamb
>>>> > <christopher.lamb at ch.ibm.com>:
>>>> >> The next route I will try - is the one Youeen took, using ipa-adtrust
>>>> >>
>>>> >>
>>>> >>
>>>> >> From: "Matt ." <yamakasi.014 at gmail.com>
>>>> >> To: Christopher Lamb/Switzerland/IBM at IBMCH,
>>>> >> "freeipa-users at redhat.com" <freeipa-users at redhat.com>
>>>> >> Date: 10.08.2015 10:03
>>>> >> Subject: Re: [Freeipa-users] Ubuntu Samba Server Auth against
>>>> >> IPA
>>>> >>
>>>> >>
>>>> >>
>>>> >> Hi Chris,
>>>> >>
>>>> >> Okay this is good to hear.
>>>> >>
>>>> >> But don't we want a IPA managed Scheme ?
>>>> >>
>>>> >> When I did a "ipa-adtrust-install --add-sids" it also wanted a local
>>>> >> installed Samba and I wonder why.
>>>> >>
>>>> >> Good that we make some progres on making it all clear.
>>>> >>
>>>> >> Cheers,
>>>> >>
>>>> >> Matt
>>>> >>
>>>> >> 2015-08-10 6:12 GMT+02:00 Christopher Lamb
>>>> >> <christopher.lamb at ch.ibm.com>:
>>>> >>> ldapsam + the samba extensions, pretty much as described in the
>>>> >> Techslaves
>>>> >>> article. Once I have a draft for the wiki page, I will mail you.
>>>> >>>
>>>> >>>
>>>> >>>
>>>> >>> From: "Matt ." <yamakasi.014 at gmail.com>
>>>> >>> To: Christopher Lamb/Switzerland/IBM at IBMCH,
>>>> >>> "freeipa-users at redhat.com" <freeipa-users at redhat.com>
>>>> >>> Date: 09.08.2015 21:17
>>>> >>> Subject: Re: [Freeipa-users] Ubuntu Samba Server Auth against
>>>> >>> IPA
>>>> >>>
>>>> >>>
>>>> >>>
>>>> >>> Hi,
>>>> >>>
>>>> >>> Yes I know about "anything" but which way did you use now ?
>>>> >>>
>>>> >>>
>>>> >>>
>>>> >>> 2015-08-09 20:56 GMT+02:00 Christopher Lamb
>>>> >> <christopher.lamb at ch.ibm.com>:
>>>> >>>> Hi Matt
>>>> >>>>
>>>> >>>> I am on OEL 7.1. - so anything that works on that should be good for
>>>> >> RHEL
>>>> >>>> and Centos 7.x
>>>> >>>>
>>>> >>>> I intend to add a how-to to the FreeIPA Wiki over the next few days.
>>>> >>>> As
>>>> >>> we
>>>> >>>> have suggested earlier, we will likely end up with several, one for
>>>> >>>> each
>>>> >>> of
>>>> >>>> the possible integration paths.
>>>> >>>>
>>>> >>>> Chris
>>>> >>>>
>>>> >>>>
>>>> >>>>
>>>> >>>>
>>>> >>>>
>>>> >>>> From: "Matt ." <yamakasi.014 at gmail.com>
>>>> >>>> To: Christopher Lamb/Switzerland/IBM at IBMCH,
>>>> >>>> "freeipa-users at redhat.com" <freeipa-users at redhat.com>
>>>> >>>> Date: 09.08.2015 16:45
>>>> >>>> Subject: Re: [Freeipa-users] Ubuntu Samba Server Auth against
>>>> >>>> IPA
>>>> >>>>
>>>> >>>>
>>>> >>>>
>>>> >>>> Hi Chris,
>>>> >>>>
>>>> >>>> This sounds great!
>>>> >>>>
>>>> >>>> What are you using now, both CentOS ? So Samba and FreeIPA ?
>>>> >>>>
>>>> >>>> Maybe it's good to explain which way you used now in steps too, so we
>>>> >>>> can combine or create multiple howto's ?
>>>> >>>>
>>>> >>>> At least we are going somewhere!
>>>> >>>>
>>>> >>>> Thanks,
>>>> >>>>
>>>> >>>> Matt
>>>> >>>>
>>>> >>>> 2015-08-09 14:54 GMT+02:00 Christopher Lamb
>>>> >>> <christopher.lamb at ch.ibm.com>:
>>>> >>>>> Hi Matt
>>>> >>>>>
>>>> >>>>> My test integration of FreeIPA 4.x and Samba 4.x with the "good old
>>>> >>> Samba
>>>> >>>>> Schema extensions) is up and working, almost flawlessly.
>>>> >>>>>
>>>> >>>>> I can add users and groups via the FreeIPA CLI, and they get the
>>>> >> correct
>>>> >>>>> ObjectClasses / attributes required for Samba.
>>>> >>>>>
>>>> >>>>> So far I have not yet bothered to try the extensions to the WebUI,
>>>> >>>> because
>>>> >>>>> it is currently giving me the classic "Your session has expired.
>>>> >>>>> Please
>>>> >>>>> re-login." error which renders the WebUI useless.
>>>> >>>>>
>>>> >>>>> The only problem I have so far encountered managing Samba / FreeIPA
>>>> >>> users
>>>> >>>>> via FreeIPA CLI commands is with the handling of the attribute
>>>> >>>>> sambaPwdLastSet. This is the subject of an existing thread, also
>>>> >> updated
>>>> >>>>> today.
>>>> >>>>>
>>>> >>>>> There is also an existing alternative to hacking group.py, using
>>>> >>>>> "Class
>>>> >>>> of
>>>> >>>>> Service" (Cos) documented in this thread from February 2015
>>>> >>>>>
>>>> >>>
>>>> >>> https://www.redhat.com/archives/freeipa-users/2015-February/msg00172.html
>>>> >>>> .
>>>> >>>>> I have not yet tried it, but it sounds reasonable.
>>>> >>>>>
>>>> >>>>> Chris
>>>> >>>>>
>>>> >>>>>
>>>> >>>>>
>>>> >>>>>
>>>> >>>>>
>>>> >>>>> From: "Matt ." <yamakasi.014 at gmail.com>
>>>> >>>>> To: Christopher Lamb/Switzerland/IBM at IBMCH
>>>> >>>>> Cc: "freeipa-users at redhat.com" <freeipa-users at redhat.com>,
>>>> >>>>> Youenn
>>>> >>>>> PIOLET <piolet.y at gmail.com>
>>>> >>>>> Date: 06.08.2015 16:19
>>>> >>>>> Subject: Re: [Freeipa-users] Ubuntu Samba Server Auth against
>>>> >> IPA
>>>> >>>>>
>>>> >>>>>
>>>> >>>>>
>>>> >>>>> Hi Chris,
>>>> >>>>>
>>>> >>>>> OK, than we might create two different versions of the wiki, I think
>>>> >>>>> this is nice.
>>>> >>>>>
>>>> >>>>> I'm still figuring out why I get that:
>>>> >>>>>
>>>> >>>>> IPA Error 4205: ObjectclassViolation
>>>> >>>>>
>>>> >>>>> missing attribute "sambaGroupType" required by object class
>>>> >>>>> "sambaGroupMapping"
>>>> >>>>>
>>>> >>>>> Matt
>>>> >>>>>
>>>> >>>>> 2015-08-06 16:09 GMT+02:00 Christopher Lamb
>>>> >>>> <christopher.lamb at ch.ibm.com>:
>>>> >>>>>> Hi Matt
>>>> >>>>>>
>>>> >>>>>> As far as I can make out, there are at least 2 viable Samba /
>>>> >>>>>> FreeIPA
>>>> >>>>>> integration paths.
>>>> >>>>>>
>>>> >>>>>> The route I took is suited where there is no Active Directory
>>>> >> involved:
>>>> >>>>> In
>>>> >>>>>> my case all the Windows, OSX and Linux clients are islands that sit
>>>> >>>>>> on
>>>> >>>>> the
>>>> >>>>>> same network.
>>>> >>>>>>
>>>> >>>>>> The route that Youenn has taken (unless I have got completely the
>>>> >> wrong
>>>> >>>>> end
>>>> >>>>>> of the stick) requires Active Directory in the architecture.
>>>> >>>>>>
>>>> >>>>>> Chris
>>>> >>>>>>
>>>> >>>>>>
>>>> >>>>>>
>>>> >>>>>> From: "Matt ." <yamakasi.014 at gmail.com>
>>>> >>>>>> To: Youenn PIOLET <piolet.y at gmail.com>
>>>> >>>>>> Cc: Christopher Lamb/Switzerland/IBM at IBMCH,
>>>> >>>>>> "freeipa-users at redhat.com" <freeipa-users at redhat.com>
>>>> >>>>>> Date: 06.08.2015 14:42
>>>> >>>>>> Subject: Re: [Freeipa-users] Ubuntu Samba Server Auth
>>>> >>>>>> against
>>>> >>> IPA
>>>> >>>>>>
>>>> >>>>>>
>>>> >>>>>>
>>>> >>>>>> Hi,
>>>> >>>>>>
>>>> >>>>>> OK, this sounds already quite logical, but I'm still refering to
>>>> >>>>>> the
>>>> >>>>>> old howto we found earlier, does that one still apply somewhere or
>>>> >>>>>> not
>>>> >>>>>> at all ?
>>>> >>>>>>
>>>> >>>>>> Thanks,
>>>> >>>>>>
>>>> >>>>>> Matt
>>>> >>>>>>
>>>> >>>>>>
>>>> >>>>>>
>>>> >>>>>> 2015-08-06 12:23 GMT+02:00 Youenn PIOLET <piolet.y at gmail.com>:
>>>> >>>>>>> Hey guys,
>>>> >>>>>>>
>>>> >>>>>>> I'll try to make a tutorial soon, sorry I'm quite in a rush these
>>>> >>>>> days :)
>>>> >>>>>>>
>>>> >>>>>>> General idea:
>>>> >>>>>>>
>>>> >>>>>>> On FreeIPA (4.1)
>>>> >>>>>>> - `ipa-adtrust-install --add-sids` (creates
>>>> >>>>>>> ipaNTsecurityidentifier
>>>> >>>>>>> attribude, also known as SID)
>>>> >>>>>>> - regenerate each user password to build ipaNTHash attribute, not
>>>> >> here
>>>> >>>>> by
>>>> >>>>>>> default on users
>>>> >>>>>>> - use your ldap browser to check ipaNTHash values are here on user
>>>> >>>>>> objects
>>>> >>>>>>> - create a CIFS service for your samba server
>>>> >>>>>>> - Create user roles/permissions as described here:
>>>> >>>>>>>
>>>> >>>>>>
>>>> >>>>>
>>>> >>>>
>>>> >>>
>>>> >>
>>>> >> http://freeipa-users.redhat.narkive.com/ez2uKpFS/authenticate-samba-3-or-4-with-freeipa
>>>> >>
>>>> >>>
>>>> >>>>
>>>> >>>>>
>>>> >>>>>>
>>>> >>>>>>> so that CIFS service will be able to read ipaNTsecurityidentifier
>>>> >>>>>>> and
>>>> >>>>>>> ipaNTHash attributes in LDAP (ACI)
>>>> >>>>>>> - SCP ipasam.so module to your cifs server (this is the magic
>>>> >> trick) :
>>>> >>>>>> scp
>>>> >>>>>>> /usr/lib64/samba/pdb/ipasam.so
>>>> >>>>>>> root at samba-server.domain:/usr/lib64/samba/pdb/ You can also try to
>>>> >>>>>> recompile
>>>> >>>>>>> it.
>>>> >>>>>>>
>>>> >>>>>>> On SAMBA Server side (CentOS 7...)
>>>> >>>>>>> - Install server keytab file for CIFS
>>>> >>>>>>> - check ipasam.so is here.
>>>> >>>>>>> - check you can read password hash in LDAP with `ldapsearch -Y
>>>> >>>>>>> GSSAPI
>>>> >>>>>>> uid=admin ipaNTHash` thanks to kerberos
>>>> >>>>>>> - make your smb.conf following the linked thread and restart
>>>> >>>>>>> service
>>>> >>>>>>>
>>>> >>>>>>> I don't know if it works in Ubuntu. I know sssd has evolved
>>>> >>>>>>> quickly
>>>> >>> and
>>>> >>>>>>> ipasam may use quite recent functionalities, the best is to just
>>>> >>>>>>> try.
>>>> >>>>> You
>>>> >>>>>>> can read in previous thread : "If you insist on Ubuntu you need to
>>>> >> get
>>>> >>>>>>> ipasam somewhere, most likely to compile it yourself".
>>>> >>>>>>>
>>>> >>>>>>> Make sure your user has ipaNTHash attribute :)
>>>> >>>>>>>
>>>> >>>>>>> You may want to debug authentication on samba server, I usually do
>>>> >>>> this:
>>>> >>>>>>> `tail -f /var/log/samba/log* | grep <username>
>>>> >>>>>>>
>>>> >>>>>>> Cheers
>>>> >>>>>>> --
>>>> >>>>>>> Youenn Piolet
>>>> >>>>>>> piolet.y at gmail.com
>>>> >>>>>>>
>>>> >>>>>>>
>>>> >>>>>>> 2015-08-05 17:40 GMT+02:00 Matt . <yamakasi.014 at gmail.com>:
>>>> >>>>>>>>
>>>> >>>>>>>> Hi,
>>>> >>>>>>>>
>>>> >>>>>>>> This sounds great to me too, but a howto would help to make it
>>>> >>>>>>>> more
>>>> >>>>>>>> clear about what you have done here. The thread confuses me a
>>>> >>>>>>>> little
>>>> >>>>>>>> bit.
>>>> >>>>>>>>
>>>> >>>>>>>> Can you paste your commands so we can test out too and report
>>>> >>>>>>>> back ?
>>>> >>>>>>>>
>>>> >>>>>>>> Thanks!
>>>> >>>>>>>>
>>>> >>>>>>>> Matt
>>>> >>>>>>>>
>>>> >>>>>>>> 2015-08-05 15:18 GMT+02:00 Christopher Lamb
>>>> >>>>>> <christopher.lamb at ch.ibm.com>:
>>>> >>>>>>>> > Hi Youenn
>>>> >>>>>>>> >
>>>> >>>>>>>> > Good news that you have got an integration working
>>>> >>>>>>>> >
>>>> >>>>>>>> > Now you have got it going, and the solution is fresh in your
>>>> >>>>>>>> > mind,
>>>> >>>>> how
>>>> >>>>>>>> > about adding a How-to page on this solution to the FreeIPA
>>>> >>>>>>>> > wiki?
>>>> >>>>>>>> >
>>>> >>>>>>>> > Chris
>>>> >>>>>>>> >
>>>> >>>>>>>> >
>>>> >>>>>>>> >
>>>> >>>>>>>> > From: Youenn PIOLET <piolet.y at gmail.com>
>>>> >>>>>>>> > To: "Matt ." <yamakasi.014 at gmail.com>
>>>> >>>>>>>> > Cc: Christopher Lamb/Switzerland/IBM at IBMCH,
>>>> >>>>>>>> > "freeipa-users at redhat.com"
>>>> >>>>>>>> > <freeipa-users at redhat.com>
>>>> >>>>>>>> > Date: 05.08.2015 14:51
>>>> >>>>>>>> > Subject: Re: [Freeipa-users] Ubuntu Samba Server Auth
>>>> >>> against
>>>> >>>>>> IPA
>>>> >>>>>>>> >
>>>> >>>>>>>> >
>>>> >>>>>>>> >
>>>> >>>>>>>> > Hi guys,
>>>> >>>>>>>> >
>>>> >>>>>>>> > Thank you so much your previous answers.
>>>> >>>>>>>> > I realised my SID were stored in ipaNTsecurityidentifier,
>>>> >>>>>>>> > thanks
>>>> >> to
>>>> >>>>>>>> > ipa-adtrust-install --add-sids
>>>> >>>>>>>> >
>>>> >>>>>>>> > I found an other way to configure smb here:
>>>> >>>>>>>> >
>>>> >>>>>>>> >
>>>> >>>>>>
>>>> >>>>>
>>>> >>>>
>>>> >>>
>>>> >>
>>>> >> http://freeipa-users.redhat.narkive.com/ez2uKpFS/authenticate-samba-3-or-4-with-freeipa
>>>> >>
>>>> >>>
>>>> >>>>
>>>> >>>>>
>>>> >>>>>>
>>>> >>>>>>>> > It works perfectly.
>>>> >>>>>>>> >
>>>> >>>>>>>> > I'm using module ipasam.so I have manually scp to the samba
>>>> >> server,
>>>> >>>>>>>> > Samba is set to use kerberos + ldapsam via this ipasam module.
>>>> >>>>>>>> > Following the instructions, I created a user role allowing
>>>> >>>>>>>> > service
>>>> >>>>>>>> > principal to read ipaNTHash value from the LDAP.
>>>> >>>>>>>> > ipaNTHash are generated each time a user changes his password.
>>>> >>>>>>>> > Authentication works perfectly on Windows 7, 8 and 10.
>>>> >>>>>>>> >
>>>> >>>>>>>> > For more details, the previously linked thread is quite clear.
>>>> >>>>>>>> >
>>>> >>>>>>>> > Cheers
>>>> >>>>>>>> >
>>>> >>>>>>>> > --
>>>> >>>>>>>> > Youenn Piolet
>>>> >>>>>>>> > piolet.y at gmail.com
>>>> >>>>>>>> >
>>>> >>>>>>>> >
>>>> >>>>>>>> > 2015-08-05 11:10 GMT+02:00 Matt . <yamakasi.014 at gmail.com>:
>>>> >>>>>>>> > Hi Chris.
>>>> >>>>>>>> >
>>>> >>>>>>>> > Yes, Apache Studio did that but I was not sure why it
>>>> >>>>>>>> > complained
>>>> >>>> it
>>>> >>>>>>>> > was "already" there.
>>>> >>>>>>>> >
>>>> >>>>>>>> > I'm still getting:
>>>> >>>>>>>> >
>>>> >>>>>>>> > IPA Error 4205: ObjectclassViolation
>>>> >>>>>>>> >
>>>> >>>>>>>> > missing attribute "sambaGroupType" required by object class
>>>> >>>>>>>> > "sambaGroupMapping"
>>>> >>>>>>>> >
>>>> >>>>>>>> > When adding a user.
>>>> >>>>>>>> >
>>>> >>>>>>>> > I also see "class" as fielname under my "Last name", this is
>>>> >>>>>>>> > not
>>>> >>>> OK
>>>> >>>>>>>> > also.
>>>> >>>>>>>> >
>>>> >>>>>>>> >
>>>> >>>>>>>> >
>>>> >>>>>>>> > We sure need to make some howto, I think we can nail this
>>>> >> down :)
>>>> >>>>>>>> >
>>>> >>>>>>>> > Thanks for the heads up!
>>>> >>>>>>>> >
>>>> >>>>>>>> > Matthijs
>>>> >>>>>>>> >
>>>> >>>>>>>> > 2015-08-05 7:51 GMT+02:00 Christopher Lamb
>>>> >>>>>>>> > <christopher.lamb at ch.ibm.com>:
>>>> >>>>>>>> > > Hi Matt
>>>> >>>>>>>> > >
>>>> >>>>>>>> > > If I use Apache Directory Studio to add an attribute
>>>> >>>>>> ipaCustomFields
>>>> >>>>>>>> > to
>>>> >>>>>>>> > > cn=ipaConfig,cn=etc, the operation it performs is a modify,
>>>> >>>>>>>> > as
>>>> >>>>>> shown
>>>> >>>>>>>> > below:
>>>> >>>>>>>> > >
>>>> >>>>>>>> > > #!RESULT OK
>>>> >>>>>>>> > > #!CONNECTION ldap://xxx-ldap2.my.silly.example.com:yyy
>>>> >>>>>>>> > > #!DATE 2015-08-05T05:45:04.608
>>>> >>>>>>>> > > dn: cn=ipaConfig,cn=etc,dc=my,dc=silly,dc=example,dc=com
>>>> >>>>>>>> > > changetype: modify
>>>> >>>>>>>> > > add: ipaCustomFields
>>>> >>>>>>>> > > ipaCustomFields: Samba Group Type,sambagrouptype,true
>>>> >>>>>>>> > >
>>>> >>>>>>>> > > After that I then have a visible attribute ipaCustomFields
>>>> >>>>>>>> > as
>>>> >>>>>>>> > expected.
>>>> >>>>>>>> > >
>>>> >>>>>>>> > > When adding the attribute, the wizard offered me
>>>> >>>>> "ipaCustomFields"
>>>> >>>>>>>> > as
>>>> >>>>>>>> > > attribute type in a drop down list.
>>>> >>>>>>>> > >
>>>> >>>>>>>> > > Once we get this cracked, we really must write a how-to on
>>>> >>>>>>>> > the
>>>> >>>>>>>> > FreeIPA
>>>> >>>>>>>> > > Wiki.
>>>> >>>>>>>> > >
>>>> >>>>>>>> > > Chris
>>>> >>>>>>>> > >
>>>> >>>>>>>> > >
>>>> >>>>>>>> > >
>>>> >>>>>>>> > > From: Christopher Lamb/Switzerland/IBM at IBMCH
>>>> >>>>>>>> > > To: "Matt ." <yamakasi.014 at gmail.com>
>>>> >>>>>>>> > > Cc: "freeipa-users at redhat.com"
>>>> >>>>>>>> > <freeipa-users at redhat.com>
>>>> >>>>>>>> > > Date: 05.08.2015 07:31
>>>> >>>>>>>> > > Subject: Re: [Freeipa-users] Ubuntu Samba Server
>>>> >>>>>>>> > Auth
>>>> >>>>>> against
>>>> >>>>>>>> > IPA
>>>> >>>>>>>> > > Sent by: freeipa-users-bounces at redhat.com
>>>> >>>>>>>> > >
>>>> >>>>>>>> > >
>>>> >>>>>>>> > >
>>>> >>>>>>>> > > Hi Matt
>>>> >>>>>>>> > >
>>>> >>>>>>>> > > I also got the same result at that step, but can see
>>>> >>>>>>>> > nothing
>>>> >> in
>>>> >>>>>>>> > Apache
>>>> >>>>>>>> > > Directory Studio.
>>>> >>>>>>>> > >
>>>> >>>>>>>> > > As I am using existing Samba / FreeIPA groups migrated
>>>> >>>>>>>> > across,
>>>> >>>>>> they
>>>> >>>>>>>> > > probably were migrated with all the required attributes.
>>>> >>>>>>>> > >
>>>> >>>>>>>> > > Looking more closely at that LDIF: I wonder should it not
>>>> >>>>>>>> > be:
>>>> >>>>>>>> > >
>>>> >>>>>>>> > > ldapmodify -Y GSSAPI <<EOF
>>>> >>>>>>>> > > dn: cn=ipaconfig,cn=etc,dc=domain,dc=tld
>>>> >>>>>>>> > > changetype: modify
>>>> >>>>>>>> > > add: ipaCustomFields
>>>> >>>>>>>> > > ipaCustomFields: "Samba Group Type,sambagrouptype,true"
>>>> >>>>>>>> > > EOF
>>>> >>>>>>>> > >
>>>> >>>>>>>> > > i.e. changetype: modify, instead of changetype add ?
>>>> >>>>>>>> > >
>>>> >>>>>>>> > > I don't want to play around with my prod directory - I will
>>>> >>>> setup
>>>> >>>>>> an
>>>> >>>>>>>> > EL
>>>> >>>>>>>> > 7.1
>>>> >>>>>>>> > > VM and install FreeIPA 4.x and Samba 4.x That will allow me
>>>> >>>>>>>> > to
>>>> >>>>>> play
>>>> >>>>>>>> > around
>>>> >>>>>>>> > > more destructively.
>>>> >>>>>>>> > >
>>>> >>>>>>>> > > Chris
>>>> >>>>>>>> > >
>>>> >>>>>>>> > >
>>>> >>>>>>>> > >
>>>> >>>>>>>> > >
>>>> >>>>>>>> > >
>>>> >>>>>>>> > > From: "Matt ." <yamakasi.014 at gmail.com>
>>>> >>>>>>>> > > To: Christopher Lamb/Switzerland/IBM at IBMCH
>>>> >>>>>>>> > > Cc: Youenn PIOLET <piolet.y at gmail.com>, "
>>>> >>>>>>>> > freeipa-users at redhat.com"
>>>> >>>>>>>> > > <freeipa-users at redhat.com>
>>>> >>>>>>>> > > Date: 05.08.2015 01:01
>>>> >>>>>>>> > > Subject: Re: [Freeipa-users] Ubuntu Samba
>>>> >>> Server
>>>> >>>>>>>> > Auth
>>>> >>>>>>>> > against IPA
>>>> >>>>>>>> > >
>>>> >>>>>>>> > >
>>>> >>>>>>>> > >
>>>> >>>>>>>> > > Hi Chris,
>>>> >>>>>>>> > >
>>>> >>>>>>>> > > I'm at the right path, but my issue is that:
>>>> >>>>>>>> > >
>>>> >>>>>>>> > > ldapmodify -Y GSSAPI <<EOF
>>>> >>>>>>>> > > dn: cn=ipaconfig,cn=etc,dc=domain,dc=tld
>>>> >>>>>>>> > > changetype: add
>>>> >>>>>>>> > > add: ipaCustomFields
>>>> >>>>>>>> > > ipaCustomFields: "Samba Group Type,sambagrouptype,true"
>>>> >>>>>>>> > > EOF
>>>> >>>>>>>> > >
>>>> >>>>>>>> > > Does say it exists, my ldap explorer doesn't show it, and
>>>> >>>>>>>> > when
>>>> >>> I
>>>> >>>>>> add
>>>> >>>>>>>> > > it manually as an attribute it still fails when I add a
>>>> >>>>>>>> > user
>>>> >> on
>>>> >>>>>> this
>>>> >>>>>>>> > > sambagrouptype as it's needed by the other attributes
>>>> >>>>>>>> > >
>>>> >>>>>>>> > > So that is my issue I think so far.
>>>> >>>>>>>> > >
>>>> >>>>>>>> > > Any clue about that ?
>>>> >>>>>>>> > >
>>>> >>>>>>>> > > No problem "you don't know something or are no guru" we are
>>>> >> all
>>>> >>>>>>>> > > learning! :)
>>>> >>>>>>>> > >
>>>> >>>>>>>> > > Cheers,
>>>> >>>>>>>> > >
>>>> >>>>>>>> > > Matt
>>>> >>>>>>>> > >
>>>> >>>>>>>> > >
>>>> >>>>>>>> > > 2015-08-04 21:22 GMT+02:00 Christopher Lamb <
>>>> >>>>>>>> > christopher.lamb at ch.ibm.com>:
>>>> >>>>>>>> > >> Hi Matt, Youeen
>>>> >>>>>>>> > >>
>>>> >>>>>>>> > >> Just to set the background properly, I did not invent this
>>>> >>>>>> process.
>>>> >>>>>>>> > I
>>>> >>>>>>>> > > know
>>>> >>>>>>>> > >> only a little about FreeIPA, and almost nothing about
>>>> >>>>>>>> > Samba,
>>>> >>>> but
>>>> >>>>>> I
>>>> >>>>>>>> > guess
>>>> >>>>>>>> > > I
>>>> >>>>>>>> > >> was lucky enough to get the integration working on a
>>>> >>>>>>>> > Sunday
>>>> >>>>>>>> > afternoon.
>>>> >>>>>>>> > (I
>>>> >>>>>>>> > >> did have an older FreeIPA 3.x / Samba 3.x installation as
>>>> >>>>>>>> > a
>>>> >>>>>>>> > reference).
>>>> >>>>>>>> > >>
>>>> >>>>>>>> > >> It sounds like we need to step back, and look at the test
>>>> >> user
>>>> >>>>>> and
>>>> >>>>>>>> > group
>>>> >>>>>>>> > > in
>>>> >>>>>>>> > >> the FreeIPA LDAP tree. I find using an LDAP browser makes
>>>> >> this
>>>> >>>>>> much
>>>> >>>>>>>> > > easier.
>>>> >>>>>>>> > >>
>>>> >>>>>>>> > >> My FreeIPA / Samba Users have the following Samba
>>>> >>>>>>>> > extensions
>>>> >>> in
>>>> >>>>>>>> > FreeIPA
>>>> >>>>>>>> > >> (cn=accounts, cn=users):
>>>> >>>>>>>> > >>
>>>> >>>>>>>> > >> * objectClass: sambasamaccount
>>>> >>>>>>>> > >>
>>>> >>>>>>>> > >> * Attributes: sambaSID, sambaNTPassword, sambaPwdLastSet
>>>> >>>>>>>> > >>
>>>> >>>>>>>> > >> My FreeIPA / Samba Groups have the following Samba
>>>> >>>>>>>> > extensions
>>>> >>>> in
>>>> >>>>>>>> > FreeIPA
>>>> >>>>>>>> > >> (cn=accounts, cn=groups):
>>>> >>>>>>>> > >>
>>>> >>>>>>>> > >> * objectClass: sambaGroupMapping
>>>> >>>>>>>> > >>
>>>> >>>>>>>> > >> * Attributes: sambaGroupType, sambaSID
>>>> >>>>>>>> > >>
>>>> >>>>>>>> > >> The Users must belong to one or more of the samba groups
>>>> >>>>>>>> > that
>>>> >>>>> you
>>>> >>>>>>>> > have
>>>> >>>>>>>> > >> setup.
>>>> >>>>>>>> > >>
>>>> >>>>>>>> > >> If you don't have something similar to the above (which
>>>> >> sounds
>>>> >>>>>> like
>>>> >>>>>>>> > it
>>>> >>>>>>>> > is
>>>> >>>>>>>> > >> the case), then something went wrong applying the
>>>> >>>>>>>> > extensions.
>>>> >>>> It
>>>> >>>>>>>> > would
>>>> >>>>>>>> > be
>>>> >>>>>>>> > >> worth testing comparing a new user / group created post
>>>> >> adding
>>>> >>>>>> the
>>>> >>>>>>>> > >> extensions to a previous existing user.
>>>> >>>>>>>> > >>
>>>> >>>>>>>> > >> i.e.
>>>> >>>>>>>> > >> are the extensions missing on existing users / groups?
>>>> >>>>>>>> > >> are the extensions missing on new users / groups?
>>>> >>>>>>>> > >>
>>>> >>>>>>>> > >> Cheers
>>>> >>>>>>>> > >>
>>>> >>>>>>>> > >> Chris
>>>> >>>>>>>> > >>
>>>> >>>>>>>> > >>
>>>> >>>>>>>> > >>
>>>> >>>>>>>> > >>
>>>> >>>>>>>> > >>
>>>> >>>>>>>> > >> From: Youenn PIOLET <piolet.y at gmail.com>
>>>> >>>>>>>> > >> To: "Matt ." <yamakasi.014 at gmail.com>
>>>> >>>>>>>> > >> Cc: Christopher Lamb/Switzerland/IBM at IBMCH,
>>>> >>>>>>>> > >> "freeipa-users at redhat.com"
>>>> >>>>> <freeipa-users at redhat.com>
>>>> >>>>>>>> > >> Date: 04.08.2015 18:56
>>>> >>>>>>>> > >> Subject: Re: [Freeipa-users] Ubuntu Samba Server
>>>> >>>>>>>> > Auth
>>>> >>>>>>>> > against
>>>> >>>>>>>> > IPA
>>>> >>>>>>>> > >>
>>>> >>>>>>>> > >>
>>>> >>>>>>>> > >>
>>>> >>>>>>>> > >> Hi there,
>>>> >>>>>>>> > >>
>>>> >>>>>>>> > >> I have difficulties to follow you at this point :)
>>>> >>>>>>>> > >> Here is what I've done and what I've understood:
>>>> >>>>>>>> > >>
>>>> >>>>>>>> > >> ## SMB Side
>>>> >>>>>>>> > >> - Testparm OK
>>>> >>>>>>>> > >> - I've got the same NT_STATUS_NO_SUCH_USER when I try to
>>>> >>>>> connect.
>>>> >>>>>>>> > >> - pdbedit -Lv output is all successfull but I can see
>>>> >>>>>>>> > there
>>>> >> is
>>>> >>>> a
>>>> >>>>>>>> > filter :
>>>> >>>>>>>> > >> (&(uid=*)(objectclass=sambaSamAccount). In LDAP, the users
>>>> >>>> don't
>>>> >>>>>>>> > have
>>>> >>>>>>>> > >> sambaSamAccount.
>>>> >>>>>>>> > >>
>>>> >>>>>>>> > >> ## LDAP / FreeIPA side
>>>> >>>>>>>> > >> - Since SMB server uses LDAP, I did ipa-adtrust-install on
>>>> >>>>>>>> > my
>>>> >>>>>>>> > FreeIPA
>>>> >>>>>>>> > >> server to get samba LDAP extensions.
>>>> >>>>>>>> > >> - I can see samba classes exist in LDAP but are not used
>>>> >>>>>>>> > on
>>>> >> my
>>>> >>>>>>>> > group
>>>> >>>>>>>> > >> objects nor my user objects
>>>> >>>>>>>> > >> - I have add sambaSamAccount in FreeIPA default user
>>>> >>>>>>>> > classes,
>>>> >>>>>>>> > >> and sambaGroupMapping to default group classes. In that
>>>> >>>>>>>> > state
>>>> >>> I
>>>> >>>>>>>> > can't
>>>> >>>>>>>> > >> create user nor groups anymore, as new samba attributes
>>>> >>>>>>>> > are
>>>> >>>>>> needed
>>>> >>>>>>>> > for
>>>> >>>>>>>> > >> instantiation.
>>>> >>>>>>>> > >> - I have add in etc ipaCustomFields: 'Samba Group
>>>> >>>>>>>> > > Type,sambagrouptype,true'
>>>> >>>>>>>> > >> but I don't get what it does.
>>>> >>>>>>>> > >> - I tried to add the samba.js plugin. It works, and adds
>>>> >>>>>>>> > the
>>>> >>>>>>>> > "local"
>>>> >>>>>>>> > > option
>>>> >>>>>>>> > >> when creating a group in FreeIPA, supposed to set
>>>> >>>> sambagrouptype
>>>> >>>>>> to
>>>> >>>>>>>> > 4
>>>> >>>>>>>> > or
>>>> >>>>>>>> > > 2
>>>> >>>>>>>> > >> (domain). It doesn't work and tells that sambagrouptype
>>>> >>>>> attribute
>>>> >>>>>>>> > doesn't
>>>> >>>>>>>> > >> exist (but it should now I put sambaGroupType class by
>>>> >>>>>> default...)
>>>> >>>>>>>> > >>
>>>> >>>>>>>> > >> ## Questions
>>>> >>>>>>>> > >> 0) Can I ask samba not to search sambaSamAccount and use
>>>> >>> unix /
>>>> >>>>>>>> > posix
>>>> >>>>>>>> > >> instead? I guess no.
>>>> >>>>>>>> > >> 1) How to generate the user/group SIDs ? They are
>>>> >>>>>>>> > requested
>>>> >> to
>>>> >>>>>> add
>>>> >>>>>>>> > >> sambaSamAccount classes.
>>>> >>>>>>>> > >> This article doesn't seem relevant since we don't use
>>>> >>>>>>>> > domain
>>>> >>>>>>>> > controller
>>>> >>>>>>>> > >>
>>>> >>>>>>>> > >
>>>> >>>>>>>> >
>>>> >>>>>>>> >
>>>> >>>>>>
>>>> >>>>>
>>>> >>>>
>>>> >>>
>>>> >>
>>>> >> http://docs.fedoraproject.org/en-US/Fedora/17/html/FreeIPA_Guide/cifs.html
>>>> >>>>>>>> >
>>>> >>>>>>>> > >> and netgetlocalsid returns an error.
>>>> >>>>>>>> > >> 2) How to fix samba.js plugin?
>>>> >>>>>>>> > >> 3) I guess an equivalent of samba.js is needed for user
>>>> >>>>> creation,
>>>> >>>>>>>> > where
>>>> >>>>>>>> > > can
>>>> >>>>>>>> > >> I find it?
>>>> >>>>>>>> > >> 4) Is your setup working with Windows 8 / Windows 10 and
>>>> >>>>>>>> > not
>>>> >>>>> only
>>>> >>>>>>>> > Windows
>>>> >>>>>>>> > >> 7?
>>>> >>>>>>>> > >>
>>>> >>>>>>>> > >> Thanks a lot for your previous and future answers
>>>> >>>>>>>> > >>
>>>> >>>>>>>> > >> --
>>>> >>>>>>>> > >> Youenn Piolet
>>>> >>>>>>>> > >> piolet.y at gmail.com
>>>> >>>>>>>> > >>
>>>> >>>>>>>> > >>
>>>> >>>>>>>> > >> 2015-08-04 17:55 GMT+02:00 Matt .
>>>> >>>>>>>> > <yamakasi.014 at gmail.com>:
>>>> >>>>>>>> > >> Hi,
>>>> >>>>>>>> > >>
>>>> >>>>>>>> > >> Yes, log is anonymised.
>>>> >>>>>>>> > >>
>>>> >>>>>>>> > >> It's strange, my user doesn't have a SambaPwdLastSet,
>>>> >>>>>>>> > also
>>>> >>>>> when
>>>> >>>>>> I
>>>> >>>>>>>> > >> change it's password it doesn't get it in ldap.
>>>> >>>>>>>> > >>
>>>> >>>>>>>> > >> There must be something going wrong I guess.
>>>> >>>>>>>> > >>
>>>> >>>>>>>> > >> Matt
>>>> >>>>>>>> > >>
>>>> >>>>>>>> > >> 2015-08-04 17:45 GMT+02:00 Christopher Lamb
>>>> >>>>>>>> > > <christopher.lamb at ch.ibm.com
>>>> >>>>>>>> > >> >:
>>>> >>>>>>>> > >> > Hi Matt
>>>> >>>>>>>> > >> >
>>>> >>>>>>>> > >> > I assume [username] is a real username, identical to
>>>> >>>>>>>> > that
>>>> >>>> in
>>>> >>>>>>>> > the
>>>> >>>>>>>> > >> FreeIPA
>>>> >>>>>>>> > >> > cn=accounts, cn=users tree? (i.e. you anonymised the
>>>> >>>>>>>> > log
>>>> >>>>>>>> > extract).
>>>> >>>>>>>> > >> >
>>>> >>>>>>>> > >> > You user should be a member of the appropriate samba
>>>> >>> groups
>>>> >>>>>>>> > that
>>>> >>>>>>>> > you
>>>> >>>>>>>> > >> setup
>>>> >>>>>>>> > >> > in FreeIPA.
>>>> >>>>>>>> > >> >
>>>> >>>>>>>> > >> > You should check that the user attribute
>>>> >>>>>>>> > SambaPwdLastSet
>>>> >>> is
>>>> >>>>>> set
>>>> >>>>>>>> > to
>>>> >>>>>>>> > a
>>>> >>>>>>>> > >> > positive value (e.g. 1). If not you get an error in
>>>> >>>>>>>> > the
>>>> >>>>> Samba
>>>> >>>>>>>> > logs
>>>> >>>>>>>> > -
>>>> >>>>>>>> > > I
>>>> >>>>>>>> > >> > would need to play around again with a test user to
>>>> >>>>>>>> > find
>>>> >>>> out
>>>> >>>>>>>> > the
>>>> >>>>>>>> > > exact
>>>> >>>>>>>> > >> > error.
>>>> >>>>>>>> > >> >
>>>> >>>>>>>> > >> > I don't understand what you mean about syncing the
>>>> >>>>>>>> > users
>>>> >>>>>> local,
>>>> >>>>>>>> > but
>>>> >>>>>>>> > > we
>>>> >>>>>>>> > >> did
>>>> >>>>>>>> > >> > not need to do anything like that.
>>>> >>>>>>>> > >> >
>>>> >>>>>>>> > >> > Chris
>>>> >>>>>>>> > >> >
>>>> >>>>>>>> > >> >
>>>> >>>>>>>> > >> >
>>>> >>>>>>>> > >> >
>>>> >>>>>>>> > >> > From: "Matt ." <yamakasi.014 at gmail.com>
>>>> >>>>>>>> > >> > To: Christopher Lamb/Switzerland/IBM at IBMCH
>>>> >>>>>>>> > >> > Cc: "freeipa-users at redhat.com"
>>>> >>>>> <freeipa-users at redhat.com>
>>>> >>>>>>>> > >> > Date: 04.08.2015 15:33
>>>> >>>>>>>> > >> > Subject: Re: [Freeipa-users] Ubuntu Samba
>>>> >>>>>>>> > Server
>>>> >>>> Auth
>>>> >>>>>>>> > against
>>>> >>>>>>>> > >> IPA
>>>> >>>>>>>> > >> >
>>>> >>>>>>>> > >> >
>>>> >>>>>>>> > >> >
>>>> >>>>>>>> > >> > Hi Chris,
>>>> >>>>>>>> > >> >
>>>> >>>>>>>> > >> > A puppet run added another passdb backend, that was
>>>> >>> causing
>>>> >>>>>> my
>>>> >>>>>>>> > issue.
>>>> >>>>>>>> > >> >
>>>> >>>>>>>> > >> > What I still experience is:
>>>> >>>>>>>> > >> >
>>>> >>>>>>>> > >> >
>>>> >>>>>>>> > >> > [2015/08/04 15:29:45.477783, 3]
>>>> >>>>>>>> > >> > ../source3/auth/check_samsec.c:399(check_sam_security)
>>>> >>>>>>>> > >> > check_sam_security: Couldn't find user 'username' in
>>>> >>>>>> passdb.
>>>> >>>>>>>> > >> > [2015/08/04 15:29:45.478026, 2]
>>>> >>>>>>>> > >> > ../source3/auth/auth.c:288(auth_check_ntlm_password)
>>>> >>>>>>>> > >> > check_ntlm_password: Authentication for user
>>>> >> [username]
>>>> >>>>> ->
>>>> >>>>>>>> > >> > [username] FAILED with error NT_STATUS_NO_SUCH_USER
>>>> >>>>>>>> > >> >
>>>> >>>>>>>> > >> >
>>>> >>>>>>>> > >> > I also wonder if I shall still sync the users local,
>>>> >>>>>>>> > or
>>>> >> is
>>>> >>>>> it
>>>> >>>>>>>> > > needed ?
>>>> >>>>>>>> > >> >
>>>> >>>>>>>> > >> > Thanks again,
>>>> >>>>>>>> > >> >
>>>> >>>>>>>> > >> > Matt
>>>> >>>>>>>> > >> >
>>>> >>>>>>>> > >> > 2015-08-04 14:16 GMT+02:00 Christopher Lamb <
>>>> >>>>>>>> > >> christopher.lamb at ch.ibm.com>:
>>>> >>>>>>>> > >> >> Hi Matt
>>>> >>>>>>>> > >> >>
>>>> >>>>>>>> > >> >> From our smb.conf file:
>>>> >>>>>>>> > >> >>
>>>> >>>>>>>> > >> >> [global]
>>>> >>>>>>>> > >> >> security = user
>>>> >>>>>>>> > >> >> passdb backend =
>>>> >>>>>>>> > ldapsam:ldap://xxx-ldap2.my.silly.example.com
>>>> >>>>>>>> > >> >> ldap suffix = dc=my,dc=silly,dc=example,dc=com
>>>> >>>>>>>> > >> >> ldap admin dn = cn=Directory Manager
>>>> >>>>>>>> > >> >>
>>>> >>>>>>>> > >> >> So yes, we use Directory Manager, it works for us. I
>>>> >> have
>>>> >>>>>> not
>>>> >>>>>>>> > tried
>>>> >>>>>>>> > >> with
>>>> >>>>>>>> > >> > a
>>>> >>>>>>>> > >> >> less powerful user, but it is conceivable that a
>>>> >>>>>>>> > lesser
>>>> >>>>> user
>>>> >>>>>>>> > may
>>>> >>>>>>>> > not
>>>> >>>>>>>> > >> see
>>>> >>>>>>>> > >> >> all the required attributes, resulting in "no such
>>>> >>>>>>>> > user"
>>>> >>>>>>>> > errors.
>>>> >>>>>>>> > >> >>
>>>> >>>>>>>> > >> >> Chris
>>>> >>>>>>>> > >> >>
>>>> >>>>>>>> > >> >>
>>>> >>>>>>>> > >> >>
>>>> >>>>>>>> > >> >>
>>>> >>>>>>>> > >> >> From: "Matt ." <yamakasi.014 at gmail.com>
>>>> >>>>>>>> > >> >> To: Christopher Lamb/Switzerland/IBM at IBMCH
>>>> >>>>>>>> > >> >> Cc: "freeipa-users at redhat.com"
>>>> >>>>>> <freeipa-users at redhat.com>
>>>> >>>>>>>> > >> >> Date: 04.08.2015 13:32
>>>> >>>>>>>> > >> >> Subject: Re: [Freeipa-users] Ubuntu Samba
>>>> >>>>>>>> > Server
>>>> >>>>> Auth
>>>> >>>>>>>> > against
>>>> >>>>>>>> > >> IPA
>>>> >>>>>>>> > >> >>
>>>> >>>>>>>> > >> >>
>>>> >>>>>>>> > >> >>
>>>> >>>>>>>> > >> >> Hi Chris,
>>>> >>>>>>>> > >> >>
>>>> >>>>>>>> > >> >> Thanks for the heads up, indeed local is 4 I see now
>>>> >> when
>>>> >>>> I
>>>> >>>>>>>> > add a
>>>> >>>>>>>> > >> >> group from the GUI, great thanks!
>>>> >>>>>>>> > >> >>
>>>> >>>>>>>> > >> >> But do you use Directory Manager as ldap admin user
>>>> >>>>>>>> > or
>>>> >>>> some
>>>> >>>>>>>> > other
>>>> >>>>>>>> > >> >> admin account ?
>>>> >>>>>>>> > >> >>
>>>> >>>>>>>> > >> >> I'm not sure id DM is needed and it should get that
>>>> >>>>>>>> > deep
>>>> >>>>>> into
>>>> >>>>>>>> > IPA.
>>>> >>>>>>>> > >> >> Also when starting samba it cannot find "such user"
>>>> >>>>>>>> > as
>>>> >>>> that
>>>> >>>>>>>> > sounds
>>>> >>>>>>>> > >> >> quite known as it has no UID.
>>>> >>>>>>>> > >> >>
>>>> >>>>>>>> > >> >> From your config I see you use DM, this should work ?
>>>> >>>>>>>> > >> >>
>>>> >>>>>>>> > >> >> Thanks!
>>>> >>>>>>>> > >> >>
>>>> >>>>>>>> > >> >>
>>>> >>>>>>>> > >> >> Matt
>>>> >>>>>>>> > >> >>
>>>> >>>>>>>> > >> >>
>>>> >>>>>>>> > >> >
>>>> >>>>>>>> > >> >
>>>> >>>>>>>> > >> >
>>>> >>>>>>>> > >> >
>>>> >>>>>>>> > >>
>>>> >>>>>>>> > >> --
>>>> >>>>>>>> > >> Manage your subscription for the Freeipa-users mailing
>>>> >> list:
>>>> >>>>>>>> > >> https://www.redhat.com/mailman/listinfo/freeipa-users
>>>> >>>>>>>> > >> Go to http://freeipa.org for more info on the project
>>>> >>>>>>>> > >>
>>>> >>>>>>>> > >>
>>>> >>>>>>>> > >>
>>>> >>>>>>>> > >
>>>> >>>>>>>> > >
>>>> >>>>>>>> > >
>>>> >>>>>>>> > >
>>>> >>>>>>>> > > --
>>>> >>>>>>>> > > Manage your subscription for the Freeipa-users mailing
>>>> >>>>>>>> > list:
>>>> >>>>>>>> > > https://www.redhat.com/mailman/listinfo/freeipa-users
>>>> >>>>>>>> > > Go to http://freeipa.org for more info on the project
>>>> >>>>>>>> > >
>>>> >>>>>>>> > >
>>>> >>>>>>>> > >
>>>> >>>>>>>> > >
>>>> >>>>>>>> >
>>>> >>>>>>>> > --
>>>> >>>>>>>> > Manage your subscription for the Freeipa-users mailing list:
>>>> >>>>>>>> > https://www.redhat.com/mailman/listinfo/freeipa-users
>>>> >>>>>>>> > Go to http://freeipa.org for more info on the project
>>>> >>>>>>>> >
>>>> >>>>>>>> >
>>>> >>>>>>>> >
>>>> >>>>>>>
>>>> >>>>>>>
>>>> >>>>>>
>>>> >>>>>>
>>>> >>>>>>
>>>> >>>>>>
>>>> >>>>>
>>>> >>>>>
>>>> >>>>>
>>>> >>>>>
>>>> >>>>
>>>> >>>>
>>>> >>>>
>>>> >>>>
>>>> >>>
>>>> >>>
>>>> >>>
>>>> >>>
>>>> >>
>>>> >>
>>>> >>
>>>> >>
>>>
>>>
More information about the Freeipa-users
mailing list