<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 05/06/2015 05:11 PM, box 31978
wrote:<br>
</div>
<blockquote
cite="mid:CAB-Wk_zzQpdAtkwqpdDAz=vW60j8ofc-8CS1oJaJsRWFZZ+wwQ@mail.gmail.com"
type="cite">
<div dir="ltr">Hello everyone,<br>
<br>
These days I'm testing integration between FreeIPA4 and Samba4
at file sharing level. Everything seems to work fine except
share access from a standalone Windows client.<br>
<br>
This is the setup (everything is up-to-date):<br>
- ipa-server: CentOS 7.1, ipa-server 4.1, ipa-server-trust-ad
plugin<br>
- file-server: CentOS 7.1, ipa-client 4.1, samba 4.1 (sharing
home dirs, not a DC)<br>
- win-client: Windows 7 Home Premium<br>
<br>
Config is done following the FreeIPA's Samba integration guide,
and testing with samba-client from ipa-server (or any other
ipa-joined machine) to file-server using kerberos after calling
kinit is successful (file manipulation included).<br>
<br>
Attempts to connect to the same share from win-client ends up
with a log in error. Analyzing logs: Samba can't find the user
because it can't find any DC, and that's because Samba can't
resolve workgroup name (note that's not a question of SSO:
win-client asks to type username and password). It seems that
maybe Samba is not handling new kerberos ticket requests.<br>
<br>
By now, my questions are:<br>
- Can this setup work or it is absolutely necessary that any
Windows client expecting to access Samba shares have to be
already joined to a trusted domain?<br>
</div>
</blockquote>
<br>
Samba can have different ID sources. May be there is a way to
somehow specify users that are not members of the domain locally on
the Samba server. At least this is what I would research if I faced
that issue.<br>
<br>
<blockquote
cite="mid:CAB-Wk_zzQpdAtkwqpdDAz=vW60j8ofc-8CS1oJaJsRWFZZ+wwQ@mail.gmail.com"
type="cite">
<div dir="ltr">- If this setup can't be done, I'll go for an LDAP
config in file-server against ipa-server, but then, can I
maintain the file-server joined with ipa-client? Will it work?<br>
</div>
</blockquote>
<br>
Yes. With SSSD 1.12 on the file server it should work.<br>
<a class="moz-txt-link-freetext" href="https://fedorahosted.org/sssd/wiki/DesignDocs/IntegrateSSSDWithCIFSClient">https://fedorahosted.org/sssd/wiki/DesignDocs/IntegrateSSSDWithCIFSClient</a><br>
<br>
<blockquote
cite="mid:CAB-Wk_zzQpdAtkwqpdDAz=vW60j8ofc-8CS1oJaJsRWFZZ+wwQ@mail.gmail.com"
type="cite">
<div dir="ltr"><br>
Feel free to ask whatever you want, any suggestions will be
welcome. Thanks!<br>
<br>
Regards,<br>
<br>
A.<br>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
</blockquote>
<br>
<br>
<pre class="moz-signature" cols="72">--
Thank you,
Dmitri Pal
Director of Engineering for IdM portfolio
Red Hat, Inc.</pre>
</body>
</html>