<div dir="ltr"><div>Hi,</div><div> </div><div>ipa-adtrust-install populates the ipaNTHash in LDAP for each user/group, but you still need a samba backend to read these new attributes.</div><div>Do you use ipasam.so ?</div><div>If you don't, you should recompile your version of FreeIPA, move ipasam.so to your password backend directory containing other .so files, and put this in your smb.conf :</div><div><pre style="color:rgb(0,0,0)">passdb backend = ldapsam:ldap//ipaserver</pre></div><div> </div><div>Procedure / best practices may have change now, if anyone from redhat is around to confirm... </div><div>I just can tell it's working with any Centos 7 and FreeIPA > 4.1.4 server.</div><div class="gmail_extra"> </div><div class="gmail_extra"><div><div class="m_-8136908149918688062gmail_signature" data-smartmail="gmail_signature"><div><div>--</div><div>Youenn Piolet</div><div><a href="mailto:piolet.y@gmail.com" target="_blank">piolet.y@gmail.com</a></div><div style="font-size:large"><div> </div></div></div></div></div> <div class="gmail_quote">2017-01-13 19:33 GMT+01:00 Armaan Esfahani <<a href="mailto:armaan.esfahani@advancedopen.com" target="_blank">armaan.esfahani@advancedopen.com</a>>: <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div bgcolor="white" lang="EN-US" link="#0563C1" vlink="#954F72"><div class="m_-8136908149918688062m_-6722252880772757711WordSection1">Upon running the ldapmodify command, I receive an “ldap_bind: No such object (32)” error, any suggesions? On 1/13/17, 8:37 AM, "Sumit Bose" <<a href="mailto:freeipa-users-bounces@redhat.com" target="_blank">freeipa-users-bounces@redhat.com</a> on behalf of <a href="mailto:sbose@redhat.com" target="_blank">sbose@redhat.com</a>> wrote: <div><div class="m_-8136908149918688062h5"> On Wed, Jan 11, 2017 at 04:00:57PM -0500, Armaan Esfahani wrote: > Hi, I have setup a Samba server to use FreeIPA as a password backend, however whenever I try to use existing users to login I get “NT_STATUS_LOGON_FAILURE”. > > Looking at the sssd_nss log on my ipa server, I get the following error “(Wed Jan 11 15:56:11 2017) [sssd[nss]] [fill_sid] (0x0020): Missing SID.” On all existing accounts, whereas all new accounts function properly (after resetting their passwords). > > > > Anyone have any ideas? Maybe the sidgen task was run during ipa-adtrust-install, please see <a href="https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Windows_Integration_Guide/creating-trusts.html#create-trust-existing-idm" target="_blank">https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Windows_Integration_Guide/creating-trusts.html#create-trust-existing-idm</a> how to run it. HTH bye, Sumit > > -- > Manage your subscription for the Freeipa-users mailing list: > <a href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a> > Go to <a href="http://freeipa.org" target="_blank">http://freeipa.org</a> for more info on the project -- Manage your subscription for the Freeipa-users mailing list: <a href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a> Go to <a href="http://freeipa.org" target="_blank">http://freeipa.org</a> for more info on the project</div></div></div></div> -- Manage your subscription for the Freeipa-users mailing list: <a href="https://www.redhat.com/mailman/listinfo/freeipa-users" rel="noreferrer" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a> Go to <a href="http://freeipa.org" rel="noreferrer" target="_blank">http://freeipa.org</a> for more info on the project </blockquote></div> </div></div>