[Freeipa-users] Ubuntu Samba Server Auth against IPA
Matt .
yamakasi.014 at gmail.com
Thu Aug 20 20:15:48 UTC 2015
Hi Chris,
Would be great to see!
If I have it working and we have 2-3 testcases I think we can add it
to the IPA docs!
Keep me updated!
Thanks
Matt
2015-08-20 8:49 GMT+02:00 Christopher Lamb <christopher.lamb at ch.ibm.com>:
> Matt
>
> Once I got Samba and FreeIPA integrated (by the "good old extensions"
> path), I always use FreeIPA to administer users. I have never tried the
> samba tools like smbpasswd.
>
> I still have a wiki how-to in the works, but I had to focus on some other
> issues for a while.
>
> Chris
>
>
>
> From: "Matt ." <yamakasi.014 at gmail.com>
> To: Youenn PIOLET <piolet.y at gmail.com>
> Cc: Christopher Lamb/Switzerland/IBM at IBMCH,
> "freeipa-users at redhat.com" <freeipa-users at redhat.com>
> Date: 20.08.2015 08:12
> Subject: Re: [Freeipa-users] Ubuntu Samba Server Auth against IPA
>
>
>
> HI Guys,
>
> Anyone still a working clue/test here ?
>
> I didn't came further as it seems there need to be some domain join /
> match following the freeipa devs.
>
> Thanks!
>
> Matt
>
> 2015-08-13 13:09 GMT+02:00 Matt . <yamakasi.014 at gmail.com>:
>> Hi,
>>
>> I might have found somthing which I already seen in the logs.
>>
>> I did a smbpasswd my username on the samba server, it connects to ldap
>> very well. I give my new password and get the following:
>>
>> smbldap_search_ext: base => [dc=my,dc=domain], filter =>
>> [(&(objectClass=ipaNTGroupAttrs)(|
> (ipaNTSecurityIdentifier=S-1----my--sid---)))],
>> scope => [2]
>> Attribute [displayName] not found.
>> Could not retrieve 'displayName' attribute from cn=Default SMB
>> Group,cn=groups,cn=accounts,dc=my,dc=domain
>> Sid S-1----my--sid--- -> MYDOMAIN\Default SMB Group(2)
>>
>> So something is missing!
>>
>> Thanks so far guys!
>>
>> Cheers,
>>
>> Matt
>>
>> 2015-08-13 12:02 GMT+02:00 Matt . <yamakasi.014 at gmail.com>:
>>> Hi Youenn,
>>>
>>> OK thanks! this takes me a little but futher now and I see some good
>>> stuff in my logging.
>>>
>>> I'm testing on a Windows 10 Machine which is not member of an AD or
>>> so, so that might be my issue for now ?
>>>
>>> When testing on the samba box itself as my user I get:
>>>
>>>
>>> [myusername at smb-01 ~]$ smbclient //smb-01.domain.local/shares
>>>
>>> ...
>>> Checking NTLMSSP password for MSP\myusername failed:
> NT_STATUS_WRONG_PASSWORD
>>> ...
>>> SPNEGO login failed: NT_STATUS_WRONG_PASSWORD
>>>
>>>
>>> Maybe I have an issue with encrypted passwords ?
>>>
>>>
>>> When we have this all working, I think we have a howto :D
>>>
>>> Thanks!
>>>
>>> Matt
>>>
>>> 2015-08-13 10:53 GMT+02:00 Youenn PIOLET <piolet.y at gmail.com>:
>>>> Hi Matt
>>>>
>>>> - CentOS : Did you copy ipasam.so and change your smb.conf accordingly?
>>>> sambaSamAccount is not needed anymore that way.
>>>> - Default IPA Way : won't work if your Windows is not part of a domain
>>>> controller. DOMAIN\username may work for some users using Windows 7 -
> not 8
>>>> nor 10 (it did for me but I was the only one at the office... quite
> useless)
>>>>
>>>> This config may work on your CentOS (for the ipasam way):
>>>> workgroup = TEST
>>>> realm = TEST.NET
>>>> kerberos method = dedicated keytab
>>>> dedicated keytab file = FILE:/<.....>/samba.keytab
>>>> create krb5 conf = no
>>>> security = user
>>>> encrypt passwords = true
>>>> passdb backend = ipasam:ldaps://youripa.test.net
>>>> ldapsam:trusted = yes
>>>> ldapsuffix = test.net
>>>> ldap user suffix = cn=users,cn=accounts
>>>> ldap group suffix = cn=groups,cn=accounts
>>>>
>>>>
>>>> --
>>>> Youenn Piolet
>>>> piolet.y at gmail.com
>>>>
>>>>
>>>> 2015-08-12 22:15 GMT+02:00 Matt . <yamakasi.014 at gmail.com>:
>>>>>
>>>>> Hi,
>>>>>
>>>>> OK the default IPA way works great actually when testing it as
> described
>>>>> here:
>>>>>
>>>>>
> http://www.freeipa.org/page/Howto/Integrating_a_Samba_File_Server_With_IPA
>>>>>
>>>>> On the samba server I can auth and see my share where I want to
> connect
>>>>> to.
>>>>>
>>>>> The issue is, on Windows I cannot auth, even when I do DOMAIN\username
>>>>> as username
>>>>>
>>>>> So, the IPA way should work.
>>>>>
>>>>> Any comments here ?
>>>>>
>>>>> Cheers,
>>>>>
>>>>> Matt
>>>>>
>>>>> 2015-08-12 19:00 GMT+02:00 Matt . <yamakasi.014 at gmail.com>:
>>>>> > HI GUys,
>>>>> >
>>>>> > I'm testing this out and I think I almost setup, this on a CentOS
> samba
>>>>> > server.
>>>>> >
>>>>> > I'm using the ipa-adtrust way of Youeen but it seems we still need
> to
>>>>> > add (objectclass=sambaSamAccount)) ?
>>>>> >
>>>>> > Info is welcome!
>>>>> >
>>>>> > I will report back when I have it working.
>>>>> >
>>>>> > Thanks!
>>>>> >
>>>>> > Matt
>>>>> >
>>>>> > 2015-08-10 11:16 GMT+02:00 Christopher Lamb
>>>>> > <christopher.lamb at ch.ibm.com>:
>>>>> >> The next route I will try - is the one Youeen took, using
> ipa-adtrust
>>>>> >>
>>>>> >>
>>>>> >>
>>>>> >> From: "Matt ." <yamakasi.014 at gmail.com>
>>>>> >> To: Christopher Lamb/Switzerland/IBM at IBMCH,
>>>>> >> "freeipa-users at redhat.com" <freeipa-users at redhat.com>
>>>>> >> Date: 10.08.2015 10:03
>>>>> >> Subject: Re: [Freeipa-users] Ubuntu Samba Server Auth
> against
>>>>> >> IPA
>>>>> >>
>>>>> >>
>>>>> >>
>>>>> >> Hi Chris,
>>>>> >>
>>>>> >> Okay this is good to hear.
>>>>> >>
>>>>> >> But don't we want a IPA managed Scheme ?
>>>>> >>
>>>>> >> When I did a "ipa-adtrust-install --add-sids" it also wanted a
> local
>>>>> >> installed Samba and I wonder why.
>>>>> >>
>>>>> >> Good that we make some progres on making it all clear.
>>>>> >>
>>>>> >> Cheers,
>>>>> >>
>>>>> >> Matt
>>>>> >>
>>>>> >> 2015-08-10 6:12 GMT+02:00 Christopher Lamb
>>>>> >> <christopher.lamb at ch.ibm.com>:
>>>>> >>> ldapsam + the samba extensions, pretty much as described in the
>>>>> >> Techslaves
>>>>> >>> article. Once I have a draft for the wiki page, I will mail you.
>>>>> >>>
>>>>> >>>
>>>>> >>>
>>>>> >>> From: "Matt ." <yamakasi.014 at gmail.com>
>>>>> >>> To: Christopher Lamb/Switzerland/IBM at IBMCH,
>>>>> >>> "freeipa-users at redhat.com" <freeipa-users at redhat.com>
>>>>> >>> Date: 09.08.2015 21:17
>>>>> >>> Subject: Re: [Freeipa-users] Ubuntu Samba Server Auth
> against
>>>>> >>> IPA
>>>>> >>>
>>>>> >>>
>>>>> >>>
>>>>> >>> Hi,
>>>>> >>>
>>>>> >>> Yes I know about "anything" but which way did you use now ?
>>>>> >>>
>>>>> >>>
>>>>> >>>
>>>>> >>> 2015-08-09 20:56 GMT+02:00 Christopher Lamb
>>>>> >> <christopher.lamb at ch.ibm.com>:
>>>>> >>>> Hi Matt
>>>>> >>>>
>>>>> >>>> I am on OEL 7.1. - so anything that works on that should be good
> for
>>>>> >> RHEL
>>>>> >>>> and Centos 7.x
>>>>> >>>>
>>>>> >>>> I intend to add a how-to to the FreeIPA Wiki over the next few
> days.
>>>>> >>>> As
>>>>> >>> we
>>>>> >>>> have suggested earlier, we will likely end up with several, one
> for
>>>>> >>>> each
>>>>> >>> of
>>>>> >>>> the possible integration paths.
>>>>> >>>>
>>>>> >>>> Chris
>>>>> >>>>
>>>>> >>>>
>>>>> >>>>
>>>>> >>>>
>>>>> >>>>
>>>>> >>>> From: "Matt ." <yamakasi.014 at gmail.com>
>>>>> >>>> To: Christopher Lamb/Switzerland/IBM at IBMCH,
>>>>> >>>> "freeipa-users at redhat.com" <freeipa-users at redhat.com>
>>>>> >>>> Date: 09.08.2015 16:45
>>>>> >>>> Subject: Re: [Freeipa-users] Ubuntu Samba Server Auth
> against
>>>>> >>>> IPA
>>>>> >>>>
>>>>> >>>>
>>>>> >>>>
>>>>> >>>> Hi Chris,
>>>>> >>>>
>>>>> >>>> This sounds great!
>>>>> >>>>
>>>>> >>>> What are you using now, both CentOS ? So Samba and FreeIPA ?
>>>>> >>>>
>>>>> >>>> Maybe it's good to explain which way you used now in steps too,
> so we
>>>>> >>>> can combine or create multiple howto's ?
>>>>> >>>>
>>>>> >>>> At least we are going somewhere!
>>>>> >>>>
>>>>> >>>> Thanks,
>>>>> >>>>
>>>>> >>>> Matt
>>>>> >>>>
>>>>> >>>> 2015-08-09 14:54 GMT+02:00 Christopher Lamb
>>>>> >>> <christopher.lamb at ch.ibm.com>:
>>>>> >>>>> Hi Matt
>>>>> >>>>>
>>>>> >>>>> My test integration of FreeIPA 4.x and Samba 4.x with the "good
> old
>>>>> >>> Samba
>>>>> >>>>> Schema extensions) is up and working, almost flawlessly.
>>>>> >>>>>
>>>>> >>>>> I can add users and groups via the FreeIPA CLI, and they get the
>>>>> >> correct
>>>>> >>>>> ObjectClasses / attributes required for Samba.
>>>>> >>>>>
>>>>> >>>>> So far I have not yet bothered to try the extensions to the
> WebUI,
>>>>> >>>> because
>>>>> >>>>> it is currently giving me the classic "Your session has expired.
>>>>> >>>>> Please
>>>>> >>>>> re-login." error which renders the WebUI useless.
>>>>> >>>>>
>>>>> >>>>> The only problem I have so far encountered managing Samba /
> FreeIPA
>>>>> >>> users
>>>>> >>>>> via FreeIPA CLI commands is with the handling of the attribute
>>>>> >>>>> sambaPwdLastSet. This is the subject of an existing thread, also
>>>>> >> updated
>>>>> >>>>> today.
>>>>> >>>>>
>>>>> >>>>> There is also an existing alternative to hacking group.py, using
>>>>> >>>>> "Class
>>>>> >>>> of
>>>>> >>>>> Service" (Cos) documented in this thread from February 2015
>>>>> >>>>>
>>>>> >>>
>>>>> >>>
> https://www.redhat.com/archives/freeipa-users/2015-February/msg00172.html
>>>>> >>>> .
>>>>> >>>>> I have not yet tried it, but it sounds reasonable.
>>>>> >>>>>
>>>>> >>>>> Chris
>>>>> >>>>>
>>>>> >>>>>
>>>>> >>>>>
>>>>> >>>>>
>>>>> >>>>>
>>>>> >>>>> From: "Matt ." <yamakasi.014 at gmail.com>
>>>>> >>>>> To: Christopher Lamb/Switzerland/IBM at IBMCH
>>>>> >>>>> Cc: "freeipa-users at redhat.com" <freeipa-users at redhat.com>,
>>>>> >>>>> Youenn
>>>>> >>>>> PIOLET <piolet.y at gmail.com>
>>>>> >>>>> Date: 06.08.2015 16:19
>>>>> >>>>> Subject: Re: [Freeipa-users] Ubuntu Samba Server Auth
> against
>>>>> >> IPA
>>>>> >>>>>
>>>>> >>>>>
>>>>> >>>>>
>>>>> >>>>> Hi Chris,
>>>>> >>>>>
>>>>> >>>>> OK, than we might create two different versions of the wiki, I
> think
>>>>> >>>>> this is nice.
>>>>> >>>>>
>>>>> >>>>> I'm still figuring out why I get that:
>>>>> >>>>>
>>>>> >>>>> IPA Error 4205: ObjectclassViolation
>>>>> >>>>>
>>>>> >>>>> missing attribute "sambaGroupType" required by object class
>>>>> >>>>> "sambaGroupMapping"
>>>>> >>>>>
>>>>> >>>>> Matt
>>>>> >>>>>
>>>>> >>>>> 2015-08-06 16:09 GMT+02:00 Christopher Lamb
>>>>> >>>> <christopher.lamb at ch.ibm.com>:
>>>>> >>>>>> Hi Matt
>>>>> >>>>>>
>>>>> >>>>>> As far as I can make out, there are at least 2 viable Samba /
>>>>> >>>>>> FreeIPA
>>>>> >>>>>> integration paths.
>>>>> >>>>>>
>>>>> >>>>>> The route I took is suited where there is no Active Directory
>>>>> >> involved:
>>>>> >>>>> In
>>>>> >>>>>> my case all the Windows, OSX and Linux clients are islands that
> sit
>>>>> >>>>>> on
>>>>> >>>>> the
>>>>> >>>>>> same network.
>>>>> >>>>>>
>>>>> >>>>>> The route that Youenn has taken (unless I have got completely
> the
>>>>> >> wrong
>>>>> >>>>> end
>>>>> >>>>>> of the stick) requires Active Directory in the architecture.
>>>>> >>>>>>
>>>>> >>>>>> Chris
>>>>> >>>>>>
>>>>> >>>>>>
>>>>> >>>>>>
>>>>> >>>>>> From: "Matt ." <yamakasi.014 at gmail.com>
>>>>> >>>>>> To: Youenn PIOLET <piolet.y at gmail.com>
>>>>> >>>>>> Cc: Christopher Lamb/Switzerland/IBM at IBMCH,
>>>>> >>>>>> "freeipa-users at redhat.com"
> <freeipa-users at redhat.com>
>>>>> >>>>>> Date: 06.08.2015 14:42
>>>>> >>>>>> Subject: Re: [Freeipa-users] Ubuntu Samba Server Auth
>>>>> >>>>>> against
>>>>> >>> IPA
>>>>> >>>>>>
>>>>> >>>>>>
>>>>> >>>>>>
>>>>> >>>>>> Hi,
>>>>> >>>>>>
>>>>> >>>>>> OK, this sounds already quite logical, but I'm still refering
> to
>>>>> >>>>>> the
>>>>> >>>>>> old howto we found earlier, does that one still apply somewhere
> or
>>>>> >>>>>> not
>>>>> >>>>>> at all ?
>>>>> >>>>>>
>>>>> >>>>>> Thanks,
>>>>> >>>>>>
>>>>> >>>>>> Matt
>>>>> >>>>>>
>>>>> >>>>>>
>>>>> >>>>>>
>>>>> >>>>>> 2015-08-06 12:23 GMT+02:00 Youenn PIOLET <piolet.y at gmail.com>:
>>>>> >>>>>>> Hey guys,
>>>>> >>>>>>>
>>>>> >>>>>>> I'll try to make a tutorial soon, sorry I'm quite in a rush
> these
>>>>> >>>>> days :)
>>>>> >>>>>>>
>>>>> >>>>>>> General idea:
>>>>> >>>>>>>
>>>>> >>>>>>> On FreeIPA (4.1)
>>>>> >>>>>>> - `ipa-adtrust-install --add-sids` (creates
>>>>> >>>>>>> ipaNTsecurityidentifier
>>>>> >>>>>>> attribude, also known as SID)
>>>>> >>>>>>> - regenerate each user password to build ipaNTHash attribute,
> not
>>>>> >> here
>>>>> >>>>> by
>>>>> >>>>>>> default on users
>>>>> >>>>>>> - use your ldap browser to check ipaNTHash values are here on
> user
>>>>> >>>>>> objects
>>>>> >>>>>>> - create a CIFS service for your samba server
>>>>> >>>>>>> - Create user roles/permissions as described here:
>>>>> >>>>>>>
>>>>> >>>>>>
>>>>> >>>>>
>>>>> >>>>
>>>>> >>>
>>>>> >>
>>>>> >>
> http://freeipa-users.redhat.narkive.com/ez2uKpFS/authenticate-samba-3-or-4-with-freeipa
>
>>>>> >>
>>>>> >>>
>>>>> >>>>
>>>>> >>>>>
>>>>> >>>>>>
>>>>> >>>>>>> so that CIFS service will be able to read
> ipaNTsecurityidentifier
>>>>> >>>>>>> and
>>>>> >>>>>>> ipaNTHash attributes in LDAP (ACI)
>>>>> >>>>>>> - SCP ipasam.so module to your cifs server (this is the magic
>>>>> >> trick) :
>>>>> >>>>>> scp
>>>>> >>>>>>> /usr/lib64/samba/pdb/ipasam.so
>>>>> >>>>>>> root at samba-server.domain:/usr/lib64/samba/pdb/ You can also
> try to
>>>>> >>>>>> recompile
>>>>> >>>>>>> it.
>>>>> >>>>>>>
>>>>> >>>>>>> On SAMBA Server side (CentOS 7...)
>>>>> >>>>>>> - Install server keytab file for CIFS
>>>>> >>>>>>> - check ipasam.so is here.
>>>>> >>>>>>> - check you can read password hash in LDAP with `ldapsearch -Y
>>>>> >>>>>>> GSSAPI
>>>>> >>>>>>> uid=admin ipaNTHash` thanks to kerberos
>>>>> >>>>>>> - make your smb.conf following the linked thread and restart
>>>>> >>>>>>> service
>>>>> >>>>>>>
>>>>> >>>>>>> I don't know if it works in Ubuntu. I know sssd has evolved
>>>>> >>>>>>> quickly
>>>>> >>> and
>>>>> >>>>>>> ipasam may use quite recent functionalities, the best is to
> just
>>>>> >>>>>>> try.
>>>>> >>>>> You
>>>>> >>>>>>> can read in previous thread : "If you insist on Ubuntu you
> need to
>>>>> >> get
>>>>> >>>>>>> ipasam somewhere, most likely to compile it yourself".
>>>>> >>>>>>>
>>>>> >>>>>>> Make sure your user has ipaNTHash attribute :)
>>>>> >>>>>>>
>>>>> >>>>>>> You may want to debug authentication on samba server, I
> usually do
>>>>> >>>> this:
>>>>> >>>>>>> `tail -f /var/log/samba/log* | grep <username>
>>>>> >>>>>>>
>>>>> >>>>>>> Cheers
>>>>> >>>>>>> --
>>>>> >>>>>>> Youenn Piolet
>>>>> >>>>>>> piolet.y at gmail.com
>>>>> >>>>>>>
>>>>> >>>>>>>
>>>>> >>>>>>> 2015-08-05 17:40 GMT+02:00 Matt . <yamakasi.014 at gmail.com>:
>>>>> >>>>>>>>
>>>>> >>>>>>>> Hi,
>>>>> >>>>>>>>
>>>>> >>>>>>>> This sounds great to me too, but a howto would help to make
> it
>>>>> >>>>>>>> more
>>>>> >>>>>>>> clear about what you have done here. The thread confuses me a
>>>>> >>>>>>>> little
>>>>> >>>>>>>> bit.
>>>>> >>>>>>>>
>>>>> >>>>>>>> Can you paste your commands so we can test out too and report
>>>>> >>>>>>>> back ?
>>>>> >>>>>>>>
>>>>> >>>>>>>> Thanks!
>>>>> >>>>>>>>
>>>>> >>>>>>>> Matt
>>>>> >>>>>>>>
>>>>> >>>>>>>> 2015-08-05 15:18 GMT+02:00 Christopher Lamb
>>>>> >>>>>> <christopher.lamb at ch.ibm.com>:
>>>>> >>>>>>>> > Hi Youenn
>>>>> >>>>>>>> >
>>>>> >>>>>>>> > Good news that you have got an integration working
>>>>> >>>>>>>> >
>>>>> >>>>>>>> > Now you have got it going, and the solution is fresh in
> your
>>>>> >>>>>>>> > mind,
>>>>> >>>>> how
>>>>> >>>>>>>> > about adding a How-to page on this solution to the FreeIPA
>>>>> >>>>>>>> > wiki?
>>>>> >>>>>>>> >
>>>>> >>>>>>>> > Chris
>>>>> >>>>>>>> >
>>>>> >>>>>>>> >
>>>>> >>>>>>>> >
>>>>> >>>>>>>> > From: Youenn PIOLET <piolet.y at gmail.com>
>>>>> >>>>>>>> > To: "Matt ." <yamakasi.014 at gmail.com>
>>>>> >>>>>>>> > Cc: Christopher Lamb/Switzerland/IBM at IBMCH,
>>>>> >>>>>>>> > "freeipa-users at redhat.com"
>>>>> >>>>>>>> > <freeipa-users at redhat.com>
>>>>> >>>>>>>> > Date: 05.08.2015 14:51
>>>>> >>>>>>>> > Subject: Re: [Freeipa-users] Ubuntu Samba Server
> Auth
>>>>> >>> against
>>>>> >>>>>> IPA
>>>>> >>>>>>>> >
>>>>> >>>>>>>> >
>>>>> >>>>>>>> >
>>>>> >>>>>>>> > Hi guys,
>>>>> >>>>>>>> >
>>>>> >>>>>>>> > Thank you so much your previous answers.
>>>>> >>>>>>>> > I realised my SID were stored in ipaNTsecurityidentifier,
>>>>> >>>>>>>> > thanks
>>>>> >> to
>>>>> >>>>>>>> > ipa-adtrust-install --add-sids
>>>>> >>>>>>>> >
>>>>> >>>>>>>> > I found an other way to configure smb here:
>>>>> >>>>>>>> >
>>>>> >>>>>>>> >
>>>>> >>>>>>
>>>>> >>>>>
>>>>> >>>>
>>>>> >>>
>>>>> >>
>>>>> >>
> http://freeipa-users.redhat.narkive.com/ez2uKpFS/authenticate-samba-3-or-4-with-freeipa
>
>>>>> >>
>>>>> >>>
>>>>> >>>>
>>>>> >>>>>
>>>>> >>>>>>
>>>>> >>>>>>>> > It works perfectly.
>>>>> >>>>>>>> >
>>>>> >>>>>>>> > I'm using module ipasam.so I have manually scp to the samba
>>>>> >> server,
>>>>> >>>>>>>> > Samba is set to use kerberos + ldapsam via this ipasam
> module.
>>>>> >>>>>>>> > Following the instructions, I created a user role allowing
>>>>> >>>>>>>> > service
>>>>> >>>>>>>> > principal to read ipaNTHash value from the LDAP.
>>>>> >>>>>>>> > ipaNTHash are generated each time a user changes his
> password.
>>>>> >>>>>>>> > Authentication works perfectly on Windows 7, 8 and 10.
>>>>> >>>>>>>> >
>>>>> >>>>>>>> > For more details, the previously linked thread is quite
> clear.
>>>>> >>>>>>>> >
>>>>> >>>>>>>> > Cheers
>>>>> >>>>>>>> >
>>>>> >>>>>>>> > --
>>>>> >>>>>>>> > Youenn Piolet
>>>>> >>>>>>>> > piolet.y at gmail.com
>>>>> >>>>>>>> >
>>>>> >>>>>>>> >
>>>>> >>>>>>>> > 2015-08-05 11:10 GMT+02:00 Matt . <yamakasi.014 at gmail.com>:
>>>>> >>>>>>>> > Hi Chris.
>>>>> >>>>>>>> >
>>>>> >>>>>>>> > Yes, Apache Studio did that but I was not sure why it
>>>>> >>>>>>>> > complained
>>>>> >>>> it
>>>>> >>>>>>>> > was "already" there.
>>>>> >>>>>>>> >
>>>>> >>>>>>>> > I'm still getting:
>>>>> >>>>>>>> >
>>>>> >>>>>>>> > IPA Error 4205: ObjectclassViolation
>>>>> >>>>>>>> >
>>>>> >>>>>>>> > missing attribute "sambaGroupType" required by object
> class
>>>>> >>>>>>>> > "sambaGroupMapping"
>>>>> >>>>>>>> >
>>>>> >>>>>>>> > When adding a user.
>>>>> >>>>>>>> >
>>>>> >>>>>>>> > I also see "class" as fielname under my "Last name", this
> is
>>>>> >>>>>>>> > not
>>>>> >>>> OK
>>>>> >>>>>>>> > also.
>>>>> >>>>>>>> >
>>>>> >>>>>>>> >
>>>>> >>>>>>>> >
>>>>> >>>>>>>> > We sure need to make some howto, I think we can nail this
>>>>> >> down :)
>>>>> >>>>>>>> >
>>>>> >>>>>>>> > Thanks for the heads up!
>>>>> >>>>>>>> >
>>>>> >>>>>>>> > Matthijs
>>>>> >>>>>>>> >
>>>>> >>>>>>>> > 2015-08-05 7:51 GMT+02:00 Christopher Lamb
>>>>> >>>>>>>> > <christopher.lamb at ch.ibm.com>:
>>>>> >>>>>>>> > > Hi Matt
>>>>> >>>>>>>> > >
>>>>> >>>>>>>> > > If I use Apache Directory Studio to add an attribute
>>>>> >>>>>> ipaCustomFields
>>>>> >>>>>>>> > to
>>>>> >>>>>>>> > > cn=ipaConfig,cn=etc, the operation it performs is a
> modify,
>>>>> >>>>>>>> > as
>>>>> >>>>>> shown
>>>>> >>>>>>>> > below:
>>>>> >>>>>>>> > >
>>>>> >>>>>>>> > > #!RESULT OK
>>>>> >>>>>>>> > > #!CONNECTION ldap://xxx-ldap2.my.silly.example.com:yyy
>>>>> >>>>>>>> > > #!DATE 2015-08-05T05:45:04.608
>>>>> >>>>>>>> > > dn:
> cn=ipaConfig,cn=etc,dc=my,dc=silly,dc=example,dc=com
>>>>> >>>>>>>> > > changetype: modify
>>>>> >>>>>>>> > > add: ipaCustomFields
>>>>> >>>>>>>> > > ipaCustomFields: Samba Group Type,sambagrouptype,true
>>>>> >>>>>>>> > >
>>>>> >>>>>>>> > > After that I then have a visible attribute
> ipaCustomFields
>>>>> >>>>>>>> > as
>>>>> >>>>>>>> > expected.
>>>>> >>>>>>>> > >
>>>>> >>>>>>>> > > When adding the attribute, the wizard offered me
>>>>> >>>>> "ipaCustomFields"
>>>>> >>>>>>>> > as
>>>>> >>>>>>>> > > attribute type in a drop down list.
>>>>> >>>>>>>> > >
>>>>> >>>>>>>> > > Once we get this cracked, we really must write a how-to
> on
>>>>> >>>>>>>> > the
>>>>> >>>>>>>> > FreeIPA
>>>>> >>>>>>>> > > Wiki.
>>>>> >>>>>>>> > >
>>>>> >>>>>>>> > > Chris
>>>>> >>>>>>>> > >
>>>>> >>>>>>>> > >
>>>>> >>>>>>>> > >
>>>>> >>>>>>>> > > From: Christopher Lamb/Switzerland/IBM at IBMCH
>>>>> >>>>>>>> > > To: "Matt ." <yamakasi.014 at gmail.com>
>>>>> >>>>>>>> > > Cc: "freeipa-users at redhat.com"
>>>>> >>>>>>>> > <freeipa-users at redhat.com>
>>>>> >>>>>>>> > > Date: 05.08.2015 07:31
>>>>> >>>>>>>> > > Subject: Re: [Freeipa-users] Ubuntu Samba Server
>>>>> >>>>>>>> > Auth
>>>>> >>>>>> against
>>>>> >>>>>>>> > IPA
>>>>> >>>>>>>> > > Sent by: freeipa-users-bounces at redhat.com
>>>>> >>>>>>>> > >
>>>>> >>>>>>>> > >
>>>>> >>>>>>>> > >
>>>>> >>>>>>>> > > Hi Matt
>>>>> >>>>>>>> > >
>>>>> >>>>>>>> > > I also got the same result at that step, but can see
>>>>> >>>>>>>> > nothing
>>>>> >> in
>>>>> >>>>>>>> > Apache
>>>>> >>>>>>>> > > Directory Studio.
>>>>> >>>>>>>> > >
>>>>> >>>>>>>> > > As I am using existing Samba / FreeIPA groups migrated
>>>>> >>>>>>>> > across,
>>>>> >>>>>> they
>>>>> >>>>>>>> > > probably were migrated with all the required
> attributes.
>>>>> >>>>>>>> > >
>>>>> >>>>>>>> > > Looking more closely at that LDIF: I wonder should it
> not
>>>>> >>>>>>>> > be:
>>>>> >>>>>>>> > >
>>>>> >>>>>>>> > > ldapmodify -Y GSSAPI <<EOF
>>>>> >>>>>>>> > > dn: cn=ipaconfig,cn=etc,dc=domain,dc=tld
>>>>> >>>>>>>> > > changetype: modify
>>>>> >>>>>>>> > > add: ipaCustomFields
>>>>> >>>>>>>> > > ipaCustomFields: "Samba Group Type,sambagrouptype,true"
>>>>> >>>>>>>> > > EOF
>>>>> >>>>>>>> > >
>>>>> >>>>>>>> > > i.e. changetype: modify, instead of changetype add ?
>>>>> >>>>>>>> > >
>>>>> >>>>>>>> > > I don't want to play around with my prod directory - I
> will
>>>>> >>>> setup
>>>>> >>>>>> an
>>>>> >>>>>>>> > EL
>>>>> >>>>>>>> > 7.1
>>>>> >>>>>>>> > > VM and install FreeIPA 4.x and Samba 4.x That will
> allow me
>>>>> >>>>>>>> > to
>>>>> >>>>>> play
>>>>> >>>>>>>> > around
>>>>> >>>>>>>> > > more destructively.
>>>>> >>>>>>>> > >
>>>>> >>>>>>>> > > Chris
>>>>> >>>>>>>> > >
>>>>> >>>>>>>> > >
>>>>> >>>>>>>> > >
>>>>> >>>>>>>> > >
>>>>> >>>>>>>> > >
>>>>> >>>>>>>> > > From: "Matt ." <yamakasi.014 at gmail.com>
>>>>> >>>>>>>> > > To: Christopher Lamb/Switzerland/IBM at IBMCH
>>>>> >>>>>>>> > > Cc: Youenn PIOLET <piolet.y at gmail.com>, "
>>>>> >>>>>>>> > freeipa-users at redhat.com"
>>>>> >>>>>>>> > > <freeipa-users at redhat.com>
>>>>> >>>>>>>> > > Date: 05.08.2015 01:01
>>>>> >>>>>>>> > > Subject: Re: [Freeipa-users] Ubuntu
> Samba
>>>>> >>> Server
>>>>> >>>>>>>> > Auth
>>>>> >>>>>>>> > against IPA
>>>>> >>>>>>>> > >
>>>>> >>>>>>>> > >
>>>>> >>>>>>>> > >
>>>>> >>>>>>>> > > Hi Chris,
>>>>> >>>>>>>> > >
>>>>> >>>>>>>> > > I'm at the right path, but my issue is that:
>>>>> >>>>>>>> > >
>>>>> >>>>>>>> > > ldapmodify -Y GSSAPI <<EOF
>>>>> >>>>>>>> > > dn: cn=ipaconfig,cn=etc,dc=domain,dc=tld
>>>>> >>>>>>>> > > changetype: add
>>>>> >>>>>>>> > > add: ipaCustomFields
>>>>> >>>>>>>> > > ipaCustomFields: "Samba Group Type,sambagrouptype,true"
>>>>> >>>>>>>> > > EOF
>>>>> >>>>>>>> > >
>>>>> >>>>>>>> > > Does say it exists, my ldap explorer doesn't show it,
> and
>>>>> >>>>>>>> > when
>>>>> >>> I
>>>>> >>>>>> add
>>>>> >>>>>>>> > > it manually as an attribute it still fails when I add a
>>>>> >>>>>>>> > user
>>>>> >> on
>>>>> >>>>>> this
>>>>> >>>>>>>> > > sambagrouptype as it's needed by the other attributes
>>>>> >>>>>>>> > >
>>>>> >>>>>>>> > > So that is my issue I think so far.
>>>>> >>>>>>>> > >
>>>>> >>>>>>>> > > Any clue about that ?
>>>>> >>>>>>>> > >
>>>>> >>>>>>>> > > No problem "you don't know something or are no guru" we
> are
>>>>> >> all
>>>>> >>>>>>>> > > learning! :)
>>>>> >>>>>>>> > >
>>>>> >>>>>>>> > > Cheers,
>>>>> >>>>>>>> > >
>>>>> >>>>>>>> > > Matt
>>>>> >>>>>>>> > >
>>>>> >>>>>>>> > >
>>>>> >>>>>>>> > > 2015-08-04 21:22 GMT+02:00 Christopher Lamb <
>>>>> >>>>>>>> > christopher.lamb at ch.ibm.com>:
>>>>> >>>>>>>> > >> Hi Matt, Youeen
>>>>> >>>>>>>> > >>
>>>>> >>>>>>>> > >> Just to set the background properly, I did not invent
> this
>>>>> >>>>>> process.
>>>>> >>>>>>>> > I
>>>>> >>>>>>>> > > know
>>>>> >>>>>>>> > >> only a little about FreeIPA, and almost nothing about
>>>>> >>>>>>>> > Samba,
>>>>> >>>> but
>>>>> >>>>>> I
>>>>> >>>>>>>> > guess
>>>>> >>>>>>>> > > I
>>>>> >>>>>>>> > >> was lucky enough to get the integration working on a
>>>>> >>>>>>>> > Sunday
>>>>> >>>>>>>> > afternoon.
>>>>> >>>>>>>> > (I
>>>>> >>>>>>>> > >> did have an older FreeIPA 3.x / Samba 3.x installation
> as
>>>>> >>>>>>>> > a
>>>>> >>>>>>>> > reference).
>>>>> >>>>>>>> > >>
>>>>> >>>>>>>> > >> It sounds like we need to step back, and look at the
> test
>>>>> >> user
>>>>> >>>>>> and
>>>>> >>>>>>>> > group
>>>>> >>>>>>>> > > in
>>>>> >>>>>>>> > >> the FreeIPA LDAP tree. I find using an LDAP browser
> makes
>>>>> >> this
>>>>> >>>>>> much
>>>>> >>>>>>>> > > easier.
>>>>> >>>>>>>> > >>
>>>>> >>>>>>>> > >> My FreeIPA / Samba Users have the following Samba
>>>>> >>>>>>>> > extensions
>>>>> >>> in
>>>>> >>>>>>>> > FreeIPA
>>>>> >>>>>>>> > >> (cn=accounts, cn=users):
>>>>> >>>>>>>> > >>
>>>>> >>>>>>>> > >> * objectClass: sambasamaccount
>>>>> >>>>>>>> > >>
>>>>> >>>>>>>> > >> * Attributes: sambaSID, sambaNTPassword,
> sambaPwdLastSet
>>>>> >>>>>>>> > >>
>>>>> >>>>>>>> > >> My FreeIPA / Samba Groups have the following Samba
>>>>> >>>>>>>> > extensions
>>>>> >>>> in
>>>>> >>>>>>>> > FreeIPA
>>>>> >>>>>>>> > >> (cn=accounts, cn=groups):
>>>>> >>>>>>>> > >>
>>>>> >>>>>>>> > >> * objectClass: sambaGroupMapping
>>>>> >>>>>>>> > >>
>>>>> >>>>>>>> > >> * Attributes: sambaGroupType, sambaSID
>>>>> >>>>>>>> > >>
>>>>> >>>>>>>> > >> The Users must belong to one or more of the samba
> groups
>>>>> >>>>>>>> > that
>>>>> >>>>> you
>>>>> >>>>>>>> > have
>>>>> >>>>>>>> > >> setup.
>>>>> >>>>>>>> > >>
>>>>> >>>>>>>> > >> If you don't have something similar to the above
> (which
>>>>> >> sounds
>>>>> >>>>>> like
>>>>> >>>>>>>> > it
>>>>> >>>>>>>> > is
>>>>> >>>>>>>> > >> the case), then something went wrong applying the
>>>>> >>>>>>>> > extensions.
>>>>> >>>> It
>>>>> >>>>>>>> > would
>>>>> >>>>>>>> > be
>>>>> >>>>>>>> > >> worth testing comparing a new user / group created
> post
>>>>> >> adding
>>>>> >>>>>> the
>>>>> >>>>>>>> > >> extensions to a previous existing user.
>>>>> >>>>>>>> > >>
>>>>> >>>>>>>> > >> i.e.
>>>>> >>>>>>>> > >> are the extensions missing on existing users / groups?
>>>>> >>>>>>>> > >> are the extensions missing on new users / groups?
>>>>> >>>>>>>> > >>
>>>>> >>>>>>>> > >> Cheers
>>>>> >>>>>>>> > >>
>>>>> >>>>>>>> > >> Chris
>>>>> >>>>>>>> > >>
>>>>> >>>>>>>> > >>
>>>>> >>>>>>>> > >>
>>>>> >>>>>>>> > >>
>>>>> >>>>>>>> > >>
>>>>> >>>>>>>> > >> From: Youenn PIOLET <piolet.y at gmail.com>
>>>>> >>>>>>>> > >> To: "Matt ." <yamakasi.014 at gmail.com>
>>>>> >>>>>>>> > >> Cc: Christopher Lamb/Switzerland/IBM at IBMCH,
>>>>> >>>>>>>> > >> "freeipa-users at redhat.com"
>>>>> >>>>> <freeipa-users at redhat.com>
>>>>> >>>>>>>> > >> Date: 04.08.2015 18:56
>>>>> >>>>>>>> > >> Subject: Re: [Freeipa-users] Ubuntu Samba
> Server
>>>>> >>>>>>>> > Auth
>>>>> >>>>>>>> > against
>>>>> >>>>>>>> > IPA
>>>>> >>>>>>>> > >>
>>>>> >>>>>>>> > >>
>>>>> >>>>>>>> > >>
>>>>> >>>>>>>> > >> Hi there,
>>>>> >>>>>>>> > >>
>>>>> >>>>>>>> > >> I have difficulties to follow you at this point :)
>>>>> >>>>>>>> > >> Here is what I've done and what I've understood:
>>>>> >>>>>>>> > >>
>>>>> >>>>>>>> > >> ## SMB Side
>>>>> >>>>>>>> > >> - Testparm OK
>>>>> >>>>>>>> > >> - I've got the same NT_STATUS_NO_SUCH_USER when I try
> to
>>>>> >>>>> connect.
>>>>> >>>>>>>> > >> - pdbedit -Lv output is all successfull but I can see
>>>>> >>>>>>>> > there
>>>>> >> is
>>>>> >>>> a
>>>>> >>>>>>>> > filter :
>>>>> >>>>>>>> > >> (&(uid=*)(objectclass=sambaSamAccount). In LDAP, the
> users
>>>>> >>>> don't
>>>>> >>>>>>>> > have
>>>>> >>>>>>>> > >> sambaSamAccount.
>>>>> >>>>>>>> > >>
>>>>> >>>>>>>> > >> ## LDAP / FreeIPA side
>>>>> >>>>>>>> > >> - Since SMB server uses LDAP, I did
> ipa-adtrust-install on
>>>>> >>>>>>>> > my
>>>>> >>>>>>>> > FreeIPA
>>>>> >>>>>>>> > >> server to get samba LDAP extensions.
>>>>> >>>>>>>> > >> - I can see samba classes exist in LDAP but are not
> used
>>>>> >>>>>>>> > on
>>>>> >> my
>>>>> >>>>>>>> > group
>>>>> >>>>>>>> > >> objects nor my user objects
>>>>> >>>>>>>> > >> - I have add sambaSamAccount in FreeIPA default user
>>>>> >>>>>>>> > classes,
>>>>> >>>>>>>> > >> and sambaGroupMapping to default group classes. In
> that
>>>>> >>>>>>>> > state
>>>>> >>> I
>>>>> >>>>>>>> > can't
>>>>> >>>>>>>> > >> create user nor groups anymore, as new samba
> attributes
>>>>> >>>>>>>> > are
>>>>> >>>>>> needed
>>>>> >>>>>>>> > for
>>>>> >>>>>>>> > >> instantiation.
>>>>> >>>>>>>> > >> - I have add in etc ipaCustomFields: 'Samba Group
>>>>> >>>>>>>> > > Type,sambagrouptype,true'
>>>>> >>>>>>>> > >> but I don't get what it does.
>>>>> >>>>>>>> > >> - I tried to add the samba.js plugin. It works, and
> adds
>>>>> >>>>>>>> > the
>>>>> >>>>>>>> > "local"
>>>>> >>>>>>>> > > option
>>>>> >>>>>>>> > >> when creating a group in FreeIPA, supposed to set
>>>>> >>>> sambagrouptype
>>>>> >>>>>> to
>>>>> >>>>>>>> > 4
>>>>> >>>>>>>> > or
>>>>> >>>>>>>> > > 2
>>>>> >>>>>>>> > >> (domain). It doesn't work and tells that
> sambagrouptype
>>>>> >>>>> attribute
>>>>> >>>>>>>> > doesn't
>>>>> >>>>>>>> > >> exist (but it should now I put sambaGroupType class by
>>>>> >>>>>> default...)
>>>>> >>>>>>>> > >>
>>>>> >>>>>>>> > >> ## Questions
>>>>> >>>>>>>> > >> 0) Can I ask samba not to search sambaSamAccount and
> use
>>>>> >>> unix /
>>>>> >>>>>>>> > posix
>>>>> >>>>>>>> > >> instead? I guess no.
>>>>> >>>>>>>> > >> 1) How to generate the user/group SIDs ? They are
>>>>> >>>>>>>> > requested
>>>>> >> to
>>>>> >>>>>> add
>>>>> >>>>>>>> > >> sambaSamAccount classes.
>>>>> >>>>>>>> > >> This article doesn't seem relevant since we don't use
>>>>> >>>>>>>> > domain
>>>>> >>>>>>>> > controller
>>>>> >>>>>>>> > >>
>>>>> >>>>>>>> > >
>>>>> >>>>>>>> >
>>>>> >>>>>>>> >
>>>>> >>>>>>
>>>>> >>>>>
>>>>> >>>>
>>>>> >>>
>>>>> >>
>>>>> >>
> http://docs.fedoraproject.org/en-US/Fedora/17/html/FreeIPA_Guide/cifs.html
>>>>> >>>>>>>> >
>>>>> >>>>>>>> > >> and netgetlocalsid returns an error.
>>>>> >>>>>>>> > >> 2) How to fix samba.js plugin?
>>>>> >>>>>>>> > >> 3) I guess an equivalent of samba.js is needed for
> user
>>>>> >>>>> creation,
>>>>> >>>>>>>> > where
>>>>> >>>>>>>> > > can
>>>>> >>>>>>>> > >> I find it?
>>>>> >>>>>>>> > >> 4) Is your setup working with Windows 8 / Windows 10
> and
>>>>> >>>>>>>> > not
>>>>> >>>>> only
>>>>> >>>>>>>> > Windows
>>>>> >>>>>>>> > >> 7?
>>>>> >>>>>>>> > >>
>>>>> >>>>>>>> > >> Thanks a lot for your previous and future answers
>>>>> >>>>>>>> > >>
>>>>> >>>>>>>> > >> --
>>>>> >>>>>>>> > >> Youenn Piolet
>>>>> >>>>>>>> > >> piolet.y at gmail.com
>>>>> >>>>>>>> > >>
>>>>> >>>>>>>> > >>
>>>>> >>>>>>>> > >> 2015-08-04 17:55 GMT+02:00 Matt .
>>>>> >>>>>>>> > <yamakasi.014 at gmail.com>:
>>>>> >>>>>>>> > >> Hi,
>>>>> >>>>>>>> > >>
>>>>> >>>>>>>> > >> Yes, log is anonymised.
>>>>> >>>>>>>> > >>
>>>>> >>>>>>>> > >> It's strange, my user doesn't have a
> SambaPwdLastSet,
>>>>> >>>>>>>> > also
>>>>> >>>>> when
>>>>> >>>>>> I
>>>>> >>>>>>>> > >> change it's password it doesn't get it in ldap.
>>>>> >>>>>>>> > >>
>>>>> >>>>>>>> > >> There must be something going wrong I guess.
>>>>> >>>>>>>> > >>
>>>>> >>>>>>>> > >> Matt
>>>>> >>>>>>>> > >>
>>>>> >>>>>>>> > >> 2015-08-04 17:45 GMT+02:00 Christopher Lamb
>>>>> >>>>>>>> > > <christopher.lamb at ch.ibm.com
>>>>> >>>>>>>> > >> >:
>>>>> >>>>>>>> > >> > Hi Matt
>>>>> >>>>>>>> > >> >
>>>>> >>>>>>>> > >> > I assume [username] is a real username, identical
> to
>>>>> >>>>>>>> > that
>>>>> >>>> in
>>>>> >>>>>>>> > the
>>>>> >>>>>>>> > >> FreeIPA
>>>>> >>>>>>>> > >> > cn=accounts, cn=users tree? (i.e. you anonymised
> the
>>>>> >>>>>>>> > log
>>>>> >>>>>>>> > extract).
>>>>> >>>>>>>> > >> >
>>>>> >>>>>>>> > >> > You user should be a member of the appropriate
> samba
>>>>> >>> groups
>>>>> >>>>>>>> > that
>>>>> >>>>>>>> > you
>>>>> >>>>>>>> > >> setup
>>>>> >>>>>>>> > >> > in FreeIPA.
>>>>> >>>>>>>> > >> >
>>>>> >>>>>>>> > >> > You should check that the user attribute
>>>>> >>>>>>>> > SambaPwdLastSet
>>>>> >>> is
>>>>> >>>>>> set
>>>>> >>>>>>>> > to
>>>>> >>>>>>>> > a
>>>>> >>>>>>>> > >> > positive value (e.g. 1). If not you get an error
> in
>>>>> >>>>>>>> > the
>>>>> >>>>> Samba
>>>>> >>>>>>>> > logs
>>>>> >>>>>>>> > -
>>>>> >>>>>>>> > > I
>>>>> >>>>>>>> > >> > would need to play around again with a test user
> to
>>>>> >>>>>>>> > find
>>>>> >>>> out
>>>>> >>>>>>>> > the
>>>>> >>>>>>>> > > exact
>>>>> >>>>>>>> > >> > error.
>>>>> >>>>>>>> > >> >
>>>>> >>>>>>>> > >> > I don't understand what you mean about syncing the
>>>>> >>>>>>>> > users
>>>>> >>>>>> local,
>>>>> >>>>>>>> > but
>>>>> >>>>>>>> > > we
>>>>> >>>>>>>> > >> did
>>>>> >>>>>>>> > >> > not need to do anything like that.
>>>>> >>>>>>>> > >> >
>>>>> >>>>>>>> > >> > Chris
>>>>> >>>>>>>> > >> >
>>>>> >>>>>>>> > >> >
>>>>> >>>>>>>> > >> >
>>>>> >>>>>>>> > >> >
>>>>> >>>>>>>> > >> > From: "Matt ." <yamakasi.014 at gmail.com>
>>>>> >>>>>>>> > >> > To: Christopher Lamb/Switzerland/IBM at IBMCH
>>>>> >>>>>>>> > >> > Cc: "freeipa-users at redhat.com"
>>>>> >>>>> <freeipa-users at redhat.com>
>>>>> >>>>>>>> > >> > Date: 04.08.2015 15:33
>>>>> >>>>>>>> > >> > Subject: Re: [Freeipa-users] Ubuntu Samba
>>>>> >>>>>>>> > Server
>>>>> >>>> Auth
>>>>> >>>>>>>> > against
>>>>> >>>>>>>> > >> IPA
>>>>> >>>>>>>> > >> >
>>>>> >>>>>>>> > >> >
>>>>> >>>>>>>> > >> >
>>>>> >>>>>>>> > >> > Hi Chris,
>>>>> >>>>>>>> > >> >
>>>>> >>>>>>>> > >> > A puppet run added another passdb backend, that
> was
>>>>> >>> causing
>>>>> >>>>>> my
>>>>> >>>>>>>> > issue.
>>>>> >>>>>>>> > >> >
>>>>> >>>>>>>> > >> > What I still experience is:
>>>>> >>>>>>>> > >> >
>>>>> >>>>>>>> > >> >
>>>>> >>>>>>>> > >> > [2015/08/04 15:29:45.477783, 3]
>>>>> >>>>>>>> > >> > ../source3/auth/check_samsec.c:399
> (check_sam_security)
>>>>> >>>>>>>> > >> > check_sam_security: Couldn't find user
> 'username' in
>>>>> >>>>>> passdb.
>>>>> >>>>>>>> > >> > [2015/08/04 15:29:45.478026, 2]
>>>>> >>>>>>>> > >> > ../source3/auth/auth.c:288
> (auth_check_ntlm_password)
>>>>> >>>>>>>> > >> > check_ntlm_password: Authentication for user
>>>>> >> [username]
>>>>> >>>>> ->
>>>>> >>>>>>>> > >> > [username] FAILED with error
> NT_STATUS_NO_SUCH_USER
>>>>> >>>>>>>> > >> >
>>>>> >>>>>>>> > >> >
>>>>> >>>>>>>> > >> > I also wonder if I shall still sync the users
> local,
>>>>> >>>>>>>> > or
>>>>> >> is
>>>>> >>>>> it
>>>>> >>>>>>>> > > needed ?
>>>>> >>>>>>>> > >> >
>>>>> >>>>>>>> > >> > Thanks again,
>>>>> >>>>>>>> > >> >
>>>>> >>>>>>>> > >> > Matt
>>>>> >>>>>>>> > >> >
>>>>> >>>>>>>> > >> > 2015-08-04 14:16 GMT+02:00 Christopher Lamb <
>>>>> >>>>>>>> > >> christopher.lamb at ch.ibm.com>:
>>>>> >>>>>>>> > >> >> Hi Matt
>>>>> >>>>>>>> > >> >>
>>>>> >>>>>>>> > >> >> From our smb.conf file:
>>>>> >>>>>>>> > >> >>
>>>>> >>>>>>>> > >> >> [global]
>>>>> >>>>>>>> > >> >> security = user
>>>>> >>>>>>>> > >> >> passdb backend =
>>>>> >>>>>>>> > ldapsam:ldap://xxx-ldap2.my.silly.example.com
>>>>> >>>>>>>> > >> >> ldap suffix = dc=my,dc=silly,dc=example,dc=com
>>>>> >>>>>>>> > >> >> ldap admin dn = cn=Directory Manager
>>>>> >>>>>>>> > >> >>
>>>>> >>>>>>>> > >> >> So yes, we use Directory Manager, it works for
> us. I
>>>>> >> have
>>>>> >>>>>> not
>>>>> >>>>>>>> > tried
>>>>> >>>>>>>> > >> with
>>>>> >>>>>>>> > >> > a
>>>>> >>>>>>>> > >> >> less powerful user, but it is conceivable that a
>>>>> >>>>>>>> > lesser
>>>>> >>>>> user
>>>>> >>>>>>>> > may
>>>>> >>>>>>>> > not
>>>>> >>>>>>>> > >> see
>>>>> >>>>>>>> > >> >> all the required attributes, resulting in "no
> such
>>>>> >>>>>>>> > user"
>>>>> >>>>>>>> > errors.
>>>>> >>>>>>>> > >> >>
>>>>> >>>>>>>> > >> >> Chris
>>>>> >>>>>>>> > >> >>
>>>>> >>>>>>>> > >> >>
>>>>> >>>>>>>> > >> >>
>>>>> >>>>>>>> > >> >>
>>>>> >>>>>>>> > >> >> From: "Matt ." <yamakasi.014 at gmail.com>
>>>>> >>>>>>>> > >> >> To: Christopher Lamb/Switzerland/IBM at IBMCH
>>>>> >>>>>>>> > >> >> Cc: "freeipa-users at redhat.com"
>>>>> >>>>>> <freeipa-users at redhat.com>
>>>>> >>>>>>>> > >> >> Date: 04.08.2015 13:32
>>>>> >>>>>>>> > >> >> Subject: Re: [Freeipa-users] Ubuntu Samba
>>>>> >>>>>>>> > Server
>>>>> >>>>> Auth
>>>>> >>>>>>>> > against
>>>>> >>>>>>>> > >> IPA
>>>>> >>>>>>>> > >> >>
>>>>> >>>>>>>> > >> >>
>>>>> >>>>>>>> > >> >>
>>>>> >>>>>>>> > >> >> Hi Chris,
>>>>> >>>>>>>> > >> >>
>>>>> >>>>>>>> > >> >> Thanks for the heads up, indeed local is 4 I see
> now
>>>>> >> when
>>>>> >>>> I
>>>>> >>>>>>>> > add a
>>>>> >>>>>>>> > >> >> group from the GUI, great thanks!
>>>>> >>>>>>>> > >> >>
>>>>> >>>>>>>> > >> >> But do you use Directory Manager as ldap admin
> user
>>>>> >>>>>>>> > or
>>>>> >>>> some
>>>>> >>>>>>>> > other
>>>>> >>>>>>>> > >> >> admin account ?
>>>>> >>>>>>>> > >> >>
>>>>> >>>>>>>> > >> >> I'm not sure id DM is needed and it should get
> that
>>>>> >>>>>>>> > deep
>>>>> >>>>>> into
>>>>> >>>>>>>> > IPA.
>>>>> >>>>>>>> > >> >> Also when starting samba it cannot find "such
> user"
>>>>> >>>>>>>> > as
>>>>> >>>> that
>>>>> >>>>>>>> > sounds
>>>>> >>>>>>>> > >> >> quite known as it has no UID.
>>>>> >>>>>>>> > >> >>
>>>>> >>>>>>>> > >> >> From your config I see you use DM, this should
> work ?
>>>>> >>>>>>>> > >> >>
>>>>> >>>>>>>> > >> >> Thanks!
>>>>> >>>>>>>> > >> >>
>>>>> >>>>>>>> > >> >>
>>>>> >>>>>>>> > >> >> Matt
>>>>> >>>>>>>> > >> >>
>>>>> >>>>>>>> > >> >>
>>>>> >>>>>>>> > >> >
>>>>> >>>>>>>> > >> >
>>>>> >>>>>>>> > >> >
>>>>> >>>>>>>> > >> >
>>>>> >>>>>>>> > >>
>>>>> >>>>>>>> > >> --
>>>>> >>>>>>>> > >> Manage your subscription for the Freeipa-users
> mailing
>>>>> >> list:
>>>>> >>>>>>>> > >>
> https://www.redhat.com/mailman/listinfo/freeipa-users
>>>>> >>>>>>>> > >> Go to http://freeipa.org for more info on the
> project
>>>>> >>>>>>>> > >>
>>>>> >>>>>>>> > >>
>>>>> >>>>>>>> > >>
>>>>> >>>>>>>> > >
>>>>> >>>>>>>> > >
>>>>> >>>>>>>> > >
>>>>> >>>>>>>> > >
>>>>> >>>>>>>> > > --
>>>>> >>>>>>>> > > Manage your subscription for the Freeipa-users mailing
>>>>> >>>>>>>> > list:
>>>>> >>>>>>>> > > https://www.redhat.com/mailman/listinfo/freeipa-users
>>>>> >>>>>>>> > > Go to http://freeipa.org for more info on the project
>>>>> >>>>>>>> > >
>>>>> >>>>>>>> > >
>>>>> >>>>>>>> > >
>>>>> >>>>>>>> > >
>>>>> >>>>>>>> >
>>>>> >>>>>>>> > --
>>>>> >>>>>>>> > Manage your subscription for the Freeipa-users mailing
> list:
>>>>> >>>>>>>> > https://www.redhat.com/mailman/listinfo/freeipa-users
>>>>> >>>>>>>> > Go to http://freeipa.org for more info on the project
>>>>> >>>>>>>> >
>>>>> >>>>>>>> >
>>>>> >>>>>>>> >
>>>>> >>>>>>>
>>>>> >>>>>>>
>>>>> >>>>>>
>>>>> >>>>>>
>>>>> >>>>>>
>>>>> >>>>>>
>>>>> >>>>>
>>>>> >>>>>
>>>>> >>>>>
>>>>> >>>>>
>>>>> >>>>
>>>>> >>>>
>>>>> >>>>
>>>>> >>>>
>>>>> >>>
>>>>> >>>
>>>>> >>>
>>>>> >>>
>>>>> >>
>>>>> >>
>>>>> >>
>>>>> >>
>>>>
>>>>
>
>
>
>
More information about the Freeipa-users
mailing list