<html><body>Hi Jeff When I last integrated FreeIPA and Samba I used ldapmodify to successfully add sambaSAMAccount and sambaGroupMapping. <tt>ldapmodify -Y GSSAPI <<EOF</tt> <tt>dn: cn=etc,cn=ipaconfig,dc=my,dc=silly,dc=example,dc=com</tt> <tt>changetype: modify</tt> <tt>add: ipaUserObjectClasses</tt> <tt>ipaUserObjectClasses: sambaSAMAccount</tt> <tt>-</tt> <tt>add: ipaGroupObjectClasses</tt> <tt>ipaGroupObjectClasses: sambaGroupMapping</tt> <tt>EOF</tt> Note, also there is a notorious spelling mistake under Point 5 of the Fedora instructions you are following <tt>cosAttribute: sambaGrouptType</tt> should be: <tt>cosAttribute: sambaGroupType</tt> i.e. sambaGroupType has only one "T". Chris <img width="16" height="16" src="cid:1__=8FBBF5E9DFC68B068f9e8a93df938690918c8FB@" border="0" alt="Inactive hide details for Jeff Goddard ---18.03.2016 16:11:10---Hello all, I'm following this guide:">Jeff Goddard ---18.03.2016 16:11:10---Hello all, I'm following this guide: From: Jeff Goddard <jgoddard@emerlyn.com> To: freeipa-users@redhat.com Date: 18.03.2016 16:11 Subject: [Freeipa-users] Trouble creating userobjectlass sambaSAMAccount Sent by: freeipa-users-bounces@redhat.com <hr width="100%" size="2" align="left" noshade style="color:#8091A5; "> Hello all, I'm following this guide: <a href="https://docs.fedoraproject.org/en-US/Fedora/17/html/FreeIPA_Guide/cifs.html">https://docs.fedoraproject.org/en-US/Fedora/17/html/FreeIPA_Guide/cifs.html</a> in attempts to have a SAMBA server with freeipa as the back-end authentication method. My problem is that the command: ipa config-mod --userobjectclasses=top,person,organizationalperson,inetorgperson,inetuser,posixaccount,krbprincipalaux,krbticketpolicyaux,ipaobject,sambaSAMAccount fails with the message: ipa: ERROR: objectclass top,person,organizationalperson,inetorgperson,inetuser,posixaccount,krbprincipalaux,krbticketpolicyaux,ipaobject,sambaSAMAccount not found. Using the web GUI I was able to add this field but it doesn't dynamically add it to my existing users and so I get errors such as: [2016/03/18 10:20:21.052605, 3] ../source3/lib/smbldap.c:579(smbldap_start_tls) StartTLS issued: using a TLS connection [2016/03/18 10:20:21.052661, 2] ../source3/lib/smbldap.c:794(smbldap_open_connection) smbldap_open_connection: connection opened [2016/03/18 10:20:21.055250, 3] ../source3/lib/smbldap.c:1013(smbldap_connect_system) ldap_connect_system: successful connection to the LDAP server [2016/03/18 10:20:21.056774, 4] ../source3/passdb/pdb_ldap.c:1496(ldapsam_getsampwnam) ldapsam_getsampwnam: Unable to locate user [jgoddard] count=0 [2016/03/18 10:20:21.056856, 3, pid=9121, effective(0, 0), real(0, 0), class=auth] ../source3/auth/check_samsec.c:400(check_sam_security) check_sam_security: Couldn't find user 'jgoddard' in passdb. [2016/03/18 10:20:21.056890, 5, pid=9121, effective(0, 0), real(0, 0), class=auth] ../source3/auth/auth.c:252(auth_check_ntlm_password) check_ntlm_password: sam authentication for user [jgoddard] FAILED with error NT_STATUS_NO_SUCH_USER [2016/03/18 10:20:21.056944, 2, pid=9121, effective(0, 0), real(0, 0), class=auth] ../source3/auth/auth.c:315(auth_check_ntlm_password) check_ntlm_password: Authentication for user [jgoddard] -> [jgoddard] FAILED with error NT_STATUS_NO_SUCH_USER [2016/03/18 10:20:21.056972, 2] ../auth/gensec/spnego.c:746(gensec_spnego_server_negTokenTarg) SPNEGO login failed: NT_STATUS_NO_SUCH_USER [2016/03/18 10:20:21.057837, 3] ../source3/smbd/server_exit.c:249(exit_server_common) Server exit (NT_STATUS_CONNECTION_RESET) When trying to authenticate to my share. The search from the samba server: ldapsearch -LLL -x -h <a href="http://id-management-1.internal.emerlyn.com/">id-management-1.internal.emerlyn.com</a> uid=jgoddard does not return a value for sambaSAMAccount either. Can anyone provide me a pointer or documentation on where I'm going wrong? Thanks, Jeff<tt>-- Manage your subscription for the Freeipa-users mailing list: </tt><tt><a href="https://www.redhat.com/mailman/listinfo/freeipa-users">https://www.redhat.com/mailman/listinfo/freeipa-users</a></tt><tt> Go to </tt><tt><a href="http://freeipa.org">http://freeipa.org</a></tt><tt> for more info on the project</tt> </body></html>