<html><body><div style="font-family: arial,helvetica,sans-serif; font-size: 12pt; color: #000000"><div>This might be related to the old thread https://www.redhat.com/archives/freeipa-users/2015-January/msg00285.html but on the other side not quite, and can't see that it have been been solved.<br></div><div><br data-mce-bogus="1"></div><div>I have been spending quite some time on this, but haven't been able to solve it yet.<br data-mce-bogus="1"></div><div><br data-mce-bogus="1"></div><div>My problem is:<br data-mce-bogus="1"></div><div><br data-mce-bogus="1"></div><div>I have a complete new infrastructure based om RedHat7 and CentOS7 servers.<br data-mce-bogus="1"></div><div>No Windows and defenently no AD, however we use Samba for sharing files to some clients.<br data-mce-bogus="1"></div><div><br data-mce-bogus="1"></div><div>Clients is mostly Ubuntu based laptops, completely individually manages. No central user admin or anything. </div><div>Users manage their own PC 100%.<br data-mce-bogus="1"></div><div><br data-mce-bogus="1"></div><div>We have two IPA servers set up, and all Linux servers authenticate against IPA and all that works flawless.<br data-mce-bogus="1"></div><div><br data-mce-bogus="1"></div><div>We migrated from a pure LDAP / Samba3 based solution to IPA / Samba4, using the ipa migrate script and this also worked fine.<br data-mce-bogus="1"></div><div><br data-mce-bogus="1"></div><div>Now comes the tricky part that I haven't been able to solve.<br data-mce-bogus="1"></div><div><br data-mce-bogus="1"></div><div>I can't seem to set Samba to play with IPA.<br data-mce-bogus="1"></div><div><br data-mce-bogus="1"></div><div>I have been trying to use plain old ldapsam backend, but never managed to get it to work.<br data-mce-bogus="1"></div><div>Seems Samba can't authenticate users.<br data-mce-bogus="1"></div><div><br data-mce-bogus="1"></div><div>Tried ipasam backend, using kerberos, following the instructions from the old thread: https://www.redhat.com/archives/freeipa-users/2015-September/msg00052.html<br data-mce-bogus="1"></div><div>Samba fails to start up, with a:<br data-mce-bogus="1"></div><div>2015/10/27 14:13:42.127557, 0] ipa_sam.c:4478(pdb_init_ipasam)<br> pdb_init_ldapsam: WARNING: Could not get domain info, nor add one to the domain. We cannot work reliably without it.<br>[2015/10/27 14:13:42.127785, 0] ../source3/passdb/pdb_interface.c:178(make_pdb_method_name)<br> pdb backend ipasam:"ldaps://kenai.casalogic.lan ldaps://koda.casalogic.lan" did not correctly init (error was NT_STATUS_CANT_ACCESS_DOMAIN_INFO)</div><div><br data-mce-bogus="1"></div><div>If I look at tje users directly in LDAP, I can see they don't have a ipaNTHash or ipaNTSecurityIdentifier attribute, however have preserved their old LDAP-ish sambaLMPassword and sambaNTPassword<br data-mce-bogus="1"></div><div><br data-mce-bogus="1"></div><div>I might be completely off, but I need Samba to authenticate users against IPA, using password, and not krb as I have no control over the clients.<br data-mce-bogus="1"></div><div><br data-mce-bogus="1"></div><div>FreeIPA is currently 4.1<br data-mce-bogus="1"></div><div><br></div><div data-marker="__SIG_POST__">-- <br></div><div><p style="MARGIN: 5px 0px 0px; FONT-FAMILY: arial,verdana,sans-serif; FONT-SIZE: 12px" data-mce-style="margin: 5px 0px 0px; font-family: arial,verdana,sans-serif; font-size: 12px;">Med venlig hilsen</p><p style="MARGIN: 10px 0px 0px; FONT-FAMILY: arial,verdana,sans-serif; FONT-SIZE: 14px" data-mce-style="margin: 10px 0px 0px; font-family: arial,verdana,sans-serif; font-size: 14px;"><b>Troels Hansen</b></p><p style="MARGIN: 3px 0px 0px; FONT-FAMILY: arial,verdana,sans-serif; FONT-SIZE: 12px" data-mce-style="margin: 3px 0px 0px; font-family: arial,verdana,sans-serif; font-size: 12px;">Systemkonsulent</p><p style="MARGIN: 4px 2px 0px 0px; FONT-FAMILY: arial,verdana,sans-serif; COLOR: #4c4c4c; FONT-SIZE: 14px; FONT-WEIGHT: bold" data-mce-style="margin: 4px 2px 0px 0px; font-family: arial,verdana,sans-serif; color: #4c4c4c; font-size: 14px; font-weight: bold;">Casalogic A/S</p><div><img src="http://www.casalogic.dk/signatur/casalogic_green_spacer_line.png" data-mce-src="http://www.casalogic.dk/signatur/casalogic_green_spacer_line.png" border="0"></div><p style="MARGIN: 5px 0px 0px; FONT-FAMILY: arial,verdana,sans-serif; FONT-SIZE: 12px" data-mce-style="margin: 5px 0px 0px; font-family: arial,verdana,sans-serif; font-size: 12px;">T (+45) 70 20 10 63</p><p style="MARGIN: 5px 0px 0px; FONT-FAMILY: arial,verdana,sans-serif; FONT-SIZE: 12px" data-mce-style="margin: 5px 0px 0px; font-family: arial,verdana,sans-serif; font-size: 12px;">M (+45) 22 43 71 57</p><div><a title="Download vCard" href="http://www.casalogic.dk/signatur/th.vcf" data-mce-href="http://www.casalogic.dk/signatur/th.vcf"><img src="http://www.casalogic.dk/signatur/vcard_download_small.png" data-mce-src="http://www.casalogic.dk/signatur/vcard_download_small.png" border="0"></a> <a title="Follow us on LinkedIn" href="http://www.linkedin.com/company/67524" data-mce-href="http://www.linkedin.com/company/67524"><img src="http://www.casalogic.dk/signatur/linkedin_logo_20x20.png" data-mce-src="http://www.casalogic.dk/signatur/linkedin_logo_20x20.png" border="0"></a> <a title="Follow us on Twitter" href="http://twitter.com/casalogic" data-mce-href="http://twitter.com/casalogic"><img src="http://www.casalogic.dk/signatur/twitter_logo_20x20.png" data-mce-src="http://www.casalogic.dk/signatur/twitter_logo_20x20.png" border="0"></a><br></div><div>Red Hat, SUSE, VMware, Citrix, Novell, Yellowfin BI, EnterpriseDB, Sophos og meget mere.<br></div></div></div></body></html>