Hi, Does everyone have this working or gived up on it ?
Chers, Matt 2015-08-26 20:07 GMT+02:00 Matt . <[email protected]>: > Chris, > > How far are you on this ? I'm stuck atm :( > > I hope you have some reference notes to follow and check out. > > Thanks! > > Matt > > 2015-08-20 22:15 GMT+02:00 Matt . <[email protected]>: >> Hi Chris, >> >> Would be great to see! >> >> If I have it working and we have 2-3 testcases I think we can add it >> to the IPA docs! >> >> Keep me updated! >> >> Thanks >> >> Matt >> >> 2015-08-20 8:49 GMT+02:00 Christopher Lamb <[email protected]>: >>> Matt >>> >>> Once I got Samba and FreeIPA integrated (by the "good old extensions" >>> path), I always use FreeIPA to administer users. I have never tried the >>> samba tools like smbpasswd. >>> >>> I still have a wiki how-to in the works, but I had to focus on some other >>> issues for a while. >>> >>> Chris >>> >>> >>> >>> From: "Matt ." <[email protected]> >>> To: Youenn PIOLET <[email protected]> >>> Cc: Christopher Lamb/Switzerland/IBM@IBMCH, >>> "[email protected]" <[email protected]> >>> Date: 20.08.2015 08:12 >>> Subject: Re: [Freeipa-users] Ubuntu Samba Server Auth against IPA >>> >>> >>> >>> HI Guys, >>> >>> Anyone still a working clue/test here ? >>> >>> I didn't came further as it seems there need to be some domain join / >>> match following the freeipa devs. >>> >>> Thanks! >>> >>> Matt >>> >>> 2015-08-13 13:09 GMT+02:00 Matt . <[email protected]>: >>>> Hi, >>>> >>>> I might have found somthing which I already seen in the logs. >>>> >>>> I did a smbpasswd my username on the samba server, it connects to ldap >>>> very well. I give my new password and get the following: >>>> >>>> smbldap_search_ext: base => [dc=my,dc=domain], filter => >>>> [(&(objectClass=ipaNTGroupAttrs)(| >>> (ipaNTSecurityIdentifier=S-1----my--sid---)))], >>>> scope => [2] >>>> Attribute [displayName] not found. >>>> Could not retrieve 'displayName' attribute from cn=Default SMB >>>> Group,cn=groups,cn=accounts,dc=my,dc=domain >>>> Sid S-1----my--sid--- -> MYDOMAIN\Default SMB Group(2) >>>> >>>> So something is missing! >>>> >>>> Thanks so far guys! >>>> >>>> Cheers, >>>> >>>> Matt >>>> >>>> 2015-08-13 12:02 GMT+02:00 Matt . <[email protected]>: >>>>> Hi Youenn, >>>>> >>>>> OK thanks! this takes me a little but futher now and I see some good >>>>> stuff in my logging. >>>>> >>>>> I'm testing on a Windows 10 Machine which is not member of an AD or >>>>> so, so that might be my issue for now ? >>>>> >>>>> When testing on the samba box itself as my user I get: >>>>> >>>>> >>>>> [myusername@smb-01 ~]$ smbclient //smb-01.domain.local/shares >>>>> >>>>> ... >>>>> Checking NTLMSSP password for MSP\myusername failed: >>> NT_STATUS_WRONG_PASSWORD >>>>> ... >>>>> SPNEGO login failed: NT_STATUS_WRONG_PASSWORD >>>>> >>>>> >>>>> Maybe I have an issue with encrypted passwords ? >>>>> >>>>> >>>>> When we have this all working, I think we have a howto :D >>>>> >>>>> Thanks! >>>>> >>>>> Matt >>>>> >>>>> 2015-08-13 10:53 GMT+02:00 Youenn PIOLET <[email protected]>: >>>>>> Hi Matt >>>>>> >>>>>> - CentOS : Did you copy ipasam.so and change your smb.conf accordingly? >>>>>> sambaSamAccount is not needed anymore that way. >>>>>> - Default IPA Way : won't work if your Windows is not part of a domain >>>>>> controller. DOMAIN\username may work for some users using Windows 7 - >>> not 8 >>>>>> nor 10 (it did for me but I was the only one at the office... quite >>> useless) >>>>>> >>>>>> This config may work on your CentOS (for the ipasam way): >>>>>> workgroup = TEST >>>>>> realm = TEST.NET >>>>>> kerberos method = dedicated keytab >>>>>> dedicated keytab file = FILE:/<.....>/samba.keytab >>>>>> create krb5 conf = no >>>>>> security = user >>>>>> encrypt passwords = true >>>>>> passdb backend = ipasam:ldaps://youripa.test.net >>>>>> ldapsam:trusted = yes >>>>>> ldapsuffix = test.net >>>>>> ldap user suffix = cn=users,cn=accounts >>>>>> ldap group suffix = cn=groups,cn=accounts >>>>>> >>>>>> >>>>>> -- >>>>>> Youenn Piolet >>>>>> [email protected] >>>>>> >>>>>> >>>>>> 2015-08-12 22:15 GMT+02:00 Matt . <[email protected]>: >>>>>>> >>>>>>> Hi, >>>>>>> >>>>>>> OK the default IPA way works great actually when testing it as >>> described >>>>>>> here: >>>>>>> >>>>>>> >>> http://www.freeipa.org/page/Howto/Integrating_a_Samba_File_Server_With_IPA >>>>>>> >>>>>>> On the samba server I can auth and see my share where I want to >>> connect >>>>>>> to. >>>>>>> >>>>>>> The issue is, on Windows I cannot auth, even when I do DOMAIN\username >>>>>>> as username >>>>>>> >>>>>>> So, the IPA way should work. >>>>>>> >>>>>>> Any comments here ? >>>>>>> >>>>>>> Cheers, >>>>>>> >>>>>>> Matt >>>>>>> >>>>>>> 2015-08-12 19:00 GMT+02:00 Matt . <[email protected]>: >>>>>>> > HI GUys, >>>>>>> > >>>>>>> > I'm testing this out and I think I almost setup, this on a CentOS >>> samba >>>>>>> > server. >>>>>>> > >>>>>>> > I'm using the ipa-adtrust way of Youeen but it seems we still need >>> to >>>>>>> > add (objectclass=sambaSamAccount)) ? >>>>>>> > >>>>>>> > Info is welcome! >>>>>>> > >>>>>>> > I will report back when I have it working. >>>>>>> > >>>>>>> > Thanks! >>>>>>> > >>>>>>> > Matt >>>>>>> > >>>>>>> > 2015-08-10 11:16 GMT+02:00 Christopher Lamb >>>>>>> > <[email protected]>: >>>>>>> >> The next route I will try - is the one Youeen took, using >>> ipa-adtrust >>>>>>> >> >>>>>>> >> >>>>>>> >> >>>>>>> >> From: "Matt ." <[email protected]> >>>>>>> >> To: Christopher Lamb/Switzerland/IBM@IBMCH, >>>>>>> >> "[email protected]" <[email protected]> >>>>>>> >> Date: 10.08.2015 10:03 >>>>>>> >> Subject: Re: [Freeipa-users] Ubuntu Samba Server Auth >>> against >>>>>>> >> IPA >>>>>>> >> >>>>>>> >> >>>>>>> >> >>>>>>> >> Hi Chris, >>>>>>> >> >>>>>>> >> Okay this is good to hear. >>>>>>> >> >>>>>>> >> But don't we want a IPA managed Scheme ? >>>>>>> >> >>>>>>> >> When I did a "ipa-adtrust-install --add-sids" it also wanted a >>> local >>>>>>> >> installed Samba and I wonder why. >>>>>>> >> >>>>>>> >> Good that we make some progres on making it all clear. >>>>>>> >> >>>>>>> >> Cheers, >>>>>>> >> >>>>>>> >> Matt >>>>>>> >> >>>>>>> >> 2015-08-10 6:12 GMT+02:00 Christopher Lamb >>>>>>> >> <[email protected]>: >>>>>>> >>> ldapsam + the samba extensions, pretty much as described in the >>>>>>> >> Techslaves >>>>>>> >>> article. Once I have a draft for the wiki page, I will mail you. >>>>>>> >>> >>>>>>> >>> >>>>>>> >>> >>>>>>> >>> From: "Matt ." <[email protected]> >>>>>>> >>> To: Christopher Lamb/Switzerland/IBM@IBMCH, >>>>>>> >>> "[email protected]" <[email protected]> >>>>>>> >>> Date: 09.08.2015 21:17 >>>>>>> >>> Subject: Re: [Freeipa-users] Ubuntu Samba Server Auth >>> against >>>>>>> >>> IPA >>>>>>> >>> >>>>>>> >>> >>>>>>> >>> >>>>>>> >>> Hi, >>>>>>> >>> >>>>>>> >>> Yes I know about "anything" but which way did you use now ? >>>>>>> >>> >>>>>>> >>> >>>>>>> >>> >>>>>>> >>> 2015-08-09 20:56 GMT+02:00 Christopher Lamb >>>>>>> >> <[email protected]>: >>>>>>> >>>> Hi Matt >>>>>>> >>>> >>>>>>> >>>> I am on OEL 7.1. - so anything that works on that should be good >>> for >>>>>>> >> RHEL >>>>>>> >>>> and Centos 7.x >>>>>>> >>>> >>>>>>> >>>> I intend to add a how-to to the FreeIPA Wiki over the next few >>> days. >>>>>>> >>>> As >>>>>>> >>> we >>>>>>> >>>> have suggested earlier, we will likely end up with several, one >>> for >>>>>>> >>>> each >>>>>>> >>> of >>>>>>> >>>> the possible integration paths. >>>>>>> >>>> >>>>>>> >>>> Chris >>>>>>> >>>> >>>>>>> >>>> >>>>>>> >>>> >>>>>>> >>>> >>>>>>> >>>> >>>>>>> >>>> From: "Matt ." <[email protected]> >>>>>>> >>>> To: Christopher Lamb/Switzerland/IBM@IBMCH, >>>>>>> >>>> "[email protected]" <[email protected]> >>>>>>> >>>> Date: 09.08.2015 16:45 >>>>>>> >>>> Subject: Re: [Freeipa-users] Ubuntu Samba Server Auth >>> against >>>>>>> >>>> IPA >>>>>>> >>>> >>>>>>> >>>> >>>>>>> >>>> >>>>>>> >>>> Hi Chris, >>>>>>> >>>> >>>>>>> >>>> This sounds great! >>>>>>> >>>> >>>>>>> >>>> What are you using now, both CentOS ? So Samba and FreeIPA ? >>>>>>> >>>> >>>>>>> >>>> Maybe it's good to explain which way you used now in steps too, >>> so we >>>>>>> >>>> can combine or create multiple howto's ? >>>>>>> >>>> >>>>>>> >>>> At least we are going somewhere! >>>>>>> >>>> >>>>>>> >>>> Thanks, >>>>>>> >>>> >>>>>>> >>>> Matt >>>>>>> >>>> >>>>>>> >>>> 2015-08-09 14:54 GMT+02:00 Christopher Lamb >>>>>>> >>> <[email protected]>: >>>>>>> >>>>> Hi Matt >>>>>>> >>>>> >>>>>>> >>>>> My test integration of FreeIPA 4.x and Samba 4.x with the "good >>> old >>>>>>> >>> Samba >>>>>>> >>>>> Schema extensions) is up and working, almost flawlessly. >>>>>>> >>>>> >>>>>>> >>>>> I can add users and groups via the FreeIPA CLI, and they get the >>>>>>> >> correct >>>>>>> >>>>> ObjectClasses / attributes required for Samba. >>>>>>> >>>>> >>>>>>> >>>>> So far I have not yet bothered to try the extensions to the >>> WebUI, >>>>>>> >>>> because >>>>>>> >>>>> it is currently giving me the classic "Your session has expired. >>>>>>> >>>>> Please >>>>>>> >>>>> re-login." error which renders the WebUI useless. >>>>>>> >>>>> >>>>>>> >>>>> The only problem I have so far encountered managing Samba / >>> FreeIPA >>>>>>> >>> users >>>>>>> >>>>> via FreeIPA CLI commands is with the handling of the attribute >>>>>>> >>>>> sambaPwdLastSet. This is the subject of an existing thread, also >>>>>>> >> updated >>>>>>> >>>>> today. >>>>>>> >>>>> >>>>>>> >>>>> There is also an existing alternative to hacking group.py, using >>>>>>> >>>>> "Class >>>>>>> >>>> of >>>>>>> >>>>> Service" (Cos) documented in this thread from February 2015 >>>>>>> >>>>> >>>>>>> >>> >>>>>>> >>> >>> https://www.redhat.com/archives/freeipa-users/2015-February/msg00172.html >>>>>>> >>>> . >>>>>>> >>>>> I have not yet tried it, but it sounds reasonable. >>>>>>> >>>>> >>>>>>> >>>>> Chris >>>>>>> >>>>> >>>>>>> >>>>> >>>>>>> >>>>> >>>>>>> >>>>> >>>>>>> >>>>> >>>>>>> >>>>> From: "Matt ." <[email protected]> >>>>>>> >>>>> To: Christopher Lamb/Switzerland/IBM@IBMCH >>>>>>> >>>>> Cc: "[email protected]" <[email protected]>, >>>>>>> >>>>> Youenn >>>>>>> >>>>> PIOLET <[email protected]> >>>>>>> >>>>> Date: 06.08.2015 16:19 >>>>>>> >>>>> Subject: Re: [Freeipa-users] Ubuntu Samba Server Auth >>> against >>>>>>> >> IPA >>>>>>> >>>>> >>>>>>> >>>>> >>>>>>> >>>>> >>>>>>> >>>>> Hi Chris, >>>>>>> >>>>> >>>>>>> >>>>> OK, than we might create two different versions of the wiki, I >>> think >>>>>>> >>>>> this is nice. >>>>>>> >>>>> >>>>>>> >>>>> I'm still figuring out why I get that: >>>>>>> >>>>> >>>>>>> >>>>> IPA Error 4205: ObjectclassViolation >>>>>>> >>>>> >>>>>>> >>>>> missing attribute "sambaGroupType" required by object class >>>>>>> >>>>> "sambaGroupMapping" >>>>>>> >>>>> >>>>>>> >>>>> Matt >>>>>>> >>>>> >>>>>>> >>>>> 2015-08-06 16:09 GMT+02:00 Christopher Lamb >>>>>>> >>>> <[email protected]>: >>>>>>> >>>>>> Hi Matt >>>>>>> >>>>>> >>>>>>> >>>>>> As far as I can make out, there are at least 2 viable Samba / >>>>>>> >>>>>> FreeIPA >>>>>>> >>>>>> integration paths. >>>>>>> >>>>>> >>>>>>> >>>>>> The route I took is suited where there is no Active Directory >>>>>>> >> involved: >>>>>>> >>>>> In >>>>>>> >>>>>> my case all the Windows, OSX and Linux clients are islands that >>> sit >>>>>>> >>>>>> on >>>>>>> >>>>> the >>>>>>> >>>>>> same network. >>>>>>> >>>>>> >>>>>>> >>>>>> The route that Youenn has taken (unless I have got completely >>> the >>>>>>> >> wrong >>>>>>> >>>>> end >>>>>>> >>>>>> of the stick) requires Active Directory in the architecture. >>>>>>> >>>>>> >>>>>>> >>>>>> Chris >>>>>>> >>>>>> >>>>>>> >>>>>> >>>>>>> >>>>>> >>>>>>> >>>>>> From: "Matt ." <[email protected]> >>>>>>> >>>>>> To: Youenn PIOLET <[email protected]> >>>>>>> >>>>>> Cc: Christopher Lamb/Switzerland/IBM@IBMCH, >>>>>>> >>>>>> "[email protected]" >>> <[email protected]> >>>>>>> >>>>>> Date: 06.08.2015 14:42 >>>>>>> >>>>>> Subject: Re: [Freeipa-users] Ubuntu Samba Server Auth >>>>>>> >>>>>> against >>>>>>> >>> IPA >>>>>>> >>>>>> >>>>>>> >>>>>> >>>>>>> >>>>>> >>>>>>> >>>>>> Hi, >>>>>>> >>>>>> >>>>>>> >>>>>> OK, this sounds already quite logical, but I'm still refering >>> to >>>>>>> >>>>>> the >>>>>>> >>>>>> old howto we found earlier, does that one still apply somewhere >>> or >>>>>>> >>>>>> not >>>>>>> >>>>>> at all ? >>>>>>> >>>>>> >>>>>>> >>>>>> Thanks, >>>>>>> >>>>>> >>>>>>> >>>>>> Matt >>>>>>> >>>>>> >>>>>>> >>>>>> >>>>>>> >>>>>> >>>>>>> >>>>>> 2015-08-06 12:23 GMT+02:00 Youenn PIOLET <[email protected]>: >>>>>>> >>>>>>> Hey guys, >>>>>>> >>>>>>> >>>>>>> >>>>>>> I'll try to make a tutorial soon, sorry I'm quite in a rush >>> these >>>>>>> >>>>> days :) >>>>>>> >>>>>>> >>>>>>> >>>>>>> General idea: >>>>>>> >>>>>>> >>>>>>> >>>>>>> On FreeIPA (4.1) >>>>>>> >>>>>>> - `ipa-adtrust-install --add-sids` (creates >>>>>>> >>>>>>> ipaNTsecurityidentifier >>>>>>> >>>>>>> attribude, also known as SID) >>>>>>> >>>>>>> - regenerate each user password to build ipaNTHash attribute, >>> not >>>>>>> >> here >>>>>>> >>>>> by >>>>>>> >>>>>>> default on users >>>>>>> >>>>>>> - use your ldap browser to check ipaNTHash values are here on >>> user >>>>>>> >>>>>> objects >>>>>>> >>>>>>> - create a CIFS service for your samba server >>>>>>> >>>>>>> - Create user roles/permissions as described here: >>>>>>> >>>>>>> >>>>>>> >>>>>> >>>>>>> >>>>> >>>>>>> >>>> >>>>>>> >>> >>>>>>> >> >>>>>>> >> >>> http://freeipa-users.redhat.narkive.com/ez2uKpFS/authenticate-samba-3-or-4-with-freeipa >>> >>>>>>> >> >>>>>>> >>> >>>>>>> >>>> >>>>>>> >>>>> >>>>>>> >>>>>> >>>>>>> >>>>>>> so that CIFS service will be able to read >>> ipaNTsecurityidentifier >>>>>>> >>>>>>> and >>>>>>> >>>>>>> ipaNTHash attributes in LDAP (ACI) >>>>>>> >>>>>>> - SCP ipasam.so module to your cifs server (this is the magic >>>>>>> >> trick) : >>>>>>> >>>>>> scp >>>>>>> >>>>>>> /usr/lib64/samba/pdb/ipasam.so >>>>>>> >>>>>>> [email protected]:/usr/lib64/samba/pdb/ You can also >>> try to >>>>>>> >>>>>> recompile >>>>>>> >>>>>>> it. >>>>>>> >>>>>>> >>>>>>> >>>>>>> On SAMBA Server side (CentOS 7...) >>>>>>> >>>>>>> - Install server keytab file for CIFS >>>>>>> >>>>>>> - check ipasam.so is here. >>>>>>> >>>>>>> - check you can read password hash in LDAP with `ldapsearch -Y >>>>>>> >>>>>>> GSSAPI >>>>>>> >>>>>>> uid=admin ipaNTHash` thanks to kerberos >>>>>>> >>>>>>> - make your smb.conf following the linked thread and restart >>>>>>> >>>>>>> service >>>>>>> >>>>>>> >>>>>>> >>>>>>> I don't know if it works in Ubuntu. I know sssd has evolved >>>>>>> >>>>>>> quickly >>>>>>> >>> and >>>>>>> >>>>>>> ipasam may use quite recent functionalities, the best is to >>> just >>>>>>> >>>>>>> try. >>>>>>> >>>>> You >>>>>>> >>>>>>> can read in previous thread : "If you insist on Ubuntu you >>> need to >>>>>>> >> get >>>>>>> >>>>>>> ipasam somewhere, most likely to compile it yourself". >>>>>>> >>>>>>> >>>>>>> >>>>>>> Make sure your user has ipaNTHash attribute :) >>>>>>> >>>>>>> >>>>>>> >>>>>>> You may want to debug authentication on samba server, I >>> usually do >>>>>>> >>>> this: >>>>>>> >>>>>>> `tail -f /var/log/samba/log* | grep <username> >>>>>>> >>>>>>> >>>>>>> >>>>>>> Cheers >>>>>>> >>>>>>> -- >>>>>>> >>>>>>> Youenn Piolet >>>>>>> >>>>>>> [email protected] >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>> 2015-08-05 17:40 GMT+02:00 Matt . <[email protected]>: >>>>>>> >>>>>>>> >>>>>>> >>>>>>>> Hi, >>>>>>> >>>>>>>> >>>>>>> >>>>>>>> This sounds great to me too, but a howto would help to make >>> it >>>>>>> >>>>>>>> more >>>>>>> >>>>>>>> clear about what you have done here. The thread confuses me a >>>>>>> >>>>>>>> little >>>>>>> >>>>>>>> bit. >>>>>>> >>>>>>>> >>>>>>> >>>>>>>> Can you paste your commands so we can test out too and report >>>>>>> >>>>>>>> back ? >>>>>>> >>>>>>>> >>>>>>> >>>>>>>> Thanks! >>>>>>> >>>>>>>> >>>>>>> >>>>>>>> Matt >>>>>>> >>>>>>>> >>>>>>> >>>>>>>> 2015-08-05 15:18 GMT+02:00 Christopher Lamb >>>>>>> >>>>>> <[email protected]>: >>>>>>> >>>>>>>> > Hi Youenn >>>>>>> >>>>>>>> > >>>>>>> >>>>>>>> > Good news that you have got an integration working >>>>>>> >>>>>>>> > >>>>>>> >>>>>>>> > Now you have got it going, and the solution is fresh in >>> your >>>>>>> >>>>>>>> > mind, >>>>>>> >>>>> how >>>>>>> >>>>>>>> > about adding a How-to page on this solution to the FreeIPA >>>>>>> >>>>>>>> > wiki? >>>>>>> >>>>>>>> > >>>>>>> >>>>>>>> > Chris >>>>>>> >>>>>>>> > >>>>>>> >>>>>>>> > >>>>>>> >>>>>>>> > >>>>>>> >>>>>>>> > From: Youenn PIOLET <[email protected]> >>>>>>> >>>>>>>> > To: "Matt ." <[email protected]> >>>>>>> >>>>>>>> > Cc: Christopher Lamb/Switzerland/IBM@IBMCH, >>>>>>> >>>>>>>> > "[email protected]" >>>>>>> >>>>>>>> > <[email protected]> >>>>>>> >>>>>>>> > Date: 05.08.2015 14:51 >>>>>>> >>>>>>>> > Subject: Re: [Freeipa-users] Ubuntu Samba Server >>> Auth >>>>>>> >>> against >>>>>>> >>>>>> IPA >>>>>>> >>>>>>>> > >>>>>>> >>>>>>>> > >>>>>>> >>>>>>>> > >>>>>>> >>>>>>>> > Hi guys, >>>>>>> >>>>>>>> > >>>>>>> >>>>>>>> > Thank you so much your previous answers. >>>>>>> >>>>>>>> > I realised my SID were stored in ipaNTsecurityidentifier, >>>>>>> >>>>>>>> > thanks >>>>>>> >> to >>>>>>> >>>>>>>> > ipa-adtrust-install --add-sids >>>>>>> >>>>>>>> > >>>>>>> >>>>>>>> > I found an other way to configure smb here: >>>>>>> >>>>>>>> > >>>>>>> >>>>>>>> > >>>>>>> >>>>>> >>>>>>> >>>>> >>>>>>> >>>> >>>>>>> >>> >>>>>>> >> >>>>>>> >> >>> http://freeipa-users.redhat.narkive.com/ez2uKpFS/authenticate-samba-3-or-4-with-freeipa >>> >>>>>>> >> >>>>>>> >>> >>>>>>> >>>> >>>>>>> >>>>> >>>>>>> >>>>>> >>>>>>> >>>>>>>> > It works perfectly. >>>>>>> >>>>>>>> > >>>>>>> >>>>>>>> > I'm using module ipasam.so I have manually scp to the samba >>>>>>> >> server, >>>>>>> >>>>>>>> > Samba is set to use kerberos + ldapsam via this ipasam >>> module. >>>>>>> >>>>>>>> > Following the instructions, I created a user role allowing >>>>>>> >>>>>>>> > service >>>>>>> >>>>>>>> > principal to read ipaNTHash value from the LDAP. >>>>>>> >>>>>>>> > ipaNTHash are generated each time a user changes his >>> password. >>>>>>> >>>>>>>> > Authentication works perfectly on Windows 7, 8 and 10. >>>>>>> >>>>>>>> > >>>>>>> >>>>>>>> > For more details, the previously linked thread is quite >>> clear. >>>>>>> >>>>>>>> > >>>>>>> >>>>>>>> > Cheers >>>>>>> >>>>>>>> > >>>>>>> >>>>>>>> > -- >>>>>>> >>>>>>>> > Youenn Piolet >>>>>>> >>>>>>>> > [email protected] >>>>>>> >>>>>>>> > >>>>>>> >>>>>>>> > >>>>>>> >>>>>>>> > 2015-08-05 11:10 GMT+02:00 Matt . <[email protected]>: >>>>>>> >>>>>>>> > Hi Chris. >>>>>>> >>>>>>>> > >>>>>>> >>>>>>>> > Yes, Apache Studio did that but I was not sure why it >>>>>>> >>>>>>>> > complained >>>>>>> >>>> it >>>>>>> >>>>>>>> > was "already" there. >>>>>>> >>>>>>>> > >>>>>>> >>>>>>>> > I'm still getting: >>>>>>> >>>>>>>> > >>>>>>> >>>>>>>> > IPA Error 4205: ObjectclassViolation >>>>>>> >>>>>>>> > >>>>>>> >>>>>>>> > missing attribute "sambaGroupType" required by object >>> class >>>>>>> >>>>>>>> > "sambaGroupMapping" >>>>>>> >>>>>>>> > >>>>>>> >>>>>>>> > When adding a user. >>>>>>> >>>>>>>> > >>>>>>> >>>>>>>> > I also see "class" as fielname under my "Last name", this >>> is >>>>>>> >>>>>>>> > not >>>>>>> >>>> OK >>>>>>> >>>>>>>> > also. >>>>>>> >>>>>>>> > >>>>>>> >>>>>>>> > >>>>>>> >>>>>>>> > >>>>>>> >>>>>>>> > We sure need to make some howto, I think we can nail this >>>>>>> >> down :) >>>>>>> >>>>>>>> > >>>>>>> >>>>>>>> > Thanks for the heads up! >>>>>>> >>>>>>>> > >>>>>>> >>>>>>>> > Matthijs >>>>>>> >>>>>>>> > >>>>>>> >>>>>>>> > 2015-08-05 7:51 GMT+02:00 Christopher Lamb >>>>>>> >>>>>>>> > <[email protected]>: >>>>>>> >>>>>>>> > > Hi Matt >>>>>>> >>>>>>>> > > >>>>>>> >>>>>>>> > > If I use Apache Directory Studio to add an attribute >>>>>>> >>>>>> ipaCustomFields >>>>>>> >>>>>>>> > to >>>>>>> >>>>>>>> > > cn=ipaConfig,cn=etc, the operation it performs is a >>> modify, >>>>>>> >>>>>>>> > as >>>>>>> >>>>>> shown >>>>>>> >>>>>>>> > below: >>>>>>> >>>>>>>> > > >>>>>>> >>>>>>>> > > #!RESULT OK >>>>>>> >>>>>>>> > > #!CONNECTION ldap://xxx-ldap2.my.silly.example.com:yyy >>>>>>> >>>>>>>> > > #!DATE 2015-08-05T05:45:04.608 >>>>>>> >>>>>>>> > > dn: >>> cn=ipaConfig,cn=etc,dc=my,dc=silly,dc=example,dc=com >>>>>>> >>>>>>>> > > changetype: modify >>>>>>> >>>>>>>> > > add: ipaCustomFields >>>>>>> >>>>>>>> > > ipaCustomFields: Samba Group Type,sambagrouptype,true >>>>>>> >>>>>>>> > > >>>>>>> >>>>>>>> > > After that I then have a visible attribute >>> ipaCustomFields >>>>>>> >>>>>>>> > as >>>>>>> >>>>>>>> > expected. >>>>>>> >>>>>>>> > > >>>>>>> >>>>>>>> > > When adding the attribute, the wizard offered me >>>>>>> >>>>> "ipaCustomFields" >>>>>>> >>>>>>>> > as >>>>>>> >>>>>>>> > > attribute type in a drop down list. >>>>>>> >>>>>>>> > > >>>>>>> >>>>>>>> > > Once we get this cracked, we really must write a how-to >>> on >>>>>>> >>>>>>>> > the >>>>>>> >>>>>>>> > FreeIPA >>>>>>> >>>>>>>> > > Wiki. >>>>>>> >>>>>>>> > > >>>>>>> >>>>>>>> > > Chris >>>>>>> >>>>>>>> > > >>>>>>> >>>>>>>> > > >>>>>>> >>>>>>>> > > >>>>>>> >>>>>>>> > > From: Christopher Lamb/Switzerland/IBM@IBMCH >>>>>>> >>>>>>>> > > To: "Matt ." <[email protected]> >>>>>>> >>>>>>>> > > Cc: "[email protected]" >>>>>>> >>>>>>>> > <[email protected]> >>>>>>> >>>>>>>> > > Date: 05.08.2015 07:31 >>>>>>> >>>>>>>> > > Subject: Re: [Freeipa-users] Ubuntu Samba Server >>>>>>> >>>>>>>> > Auth >>>>>>> >>>>>> against >>>>>>> >>>>>>>> > IPA >>>>>>> >>>>>>>> > > Sent by: [email protected] >>>>>>> >>>>>>>> > > >>>>>>> >>>>>>>> > > >>>>>>> >>>>>>>> > > >>>>>>> >>>>>>>> > > Hi Matt >>>>>>> >>>>>>>> > > >>>>>>> >>>>>>>> > > I also got the same result at that step, but can see >>>>>>> >>>>>>>> > nothing >>>>>>> >> in >>>>>>> >>>>>>>> > Apache >>>>>>> >>>>>>>> > > Directory Studio. >>>>>>> >>>>>>>> > > >>>>>>> >>>>>>>> > > As I am using existing Samba / FreeIPA groups migrated >>>>>>> >>>>>>>> > across, >>>>>>> >>>>>> they >>>>>>> >>>>>>>> > > probably were migrated with all the required >>> attributes. >>>>>>> >>>>>>>> > > >>>>>>> >>>>>>>> > > Looking more closely at that LDIF: I wonder should it >>> not >>>>>>> >>>>>>>> > be: >>>>>>> >>>>>>>> > > >>>>>>> >>>>>>>> > > ldapmodify -Y GSSAPI <<EOF >>>>>>> >>>>>>>> > > dn: cn=ipaconfig,cn=etc,dc=domain,dc=tld >>>>>>> >>>>>>>> > > changetype: modify >>>>>>> >>>>>>>> > > add: ipaCustomFields >>>>>>> >>>>>>>> > > ipaCustomFields: "Samba Group Type,sambagrouptype,true" >>>>>>> >>>>>>>> > > EOF >>>>>>> >>>>>>>> > > >>>>>>> >>>>>>>> > > i.e. changetype: modify, instead of changetype add ? >>>>>>> >>>>>>>> > > >>>>>>> >>>>>>>> > > I don't want to play around with my prod directory - I >>> will >>>>>>> >>>> setup >>>>>>> >>>>>> an >>>>>>> >>>>>>>> > EL >>>>>>> >>>>>>>> > 7.1 >>>>>>> >>>>>>>> > > VM and install FreeIPA 4.x and Samba 4.x That will >>> allow me >>>>>>> >>>>>>>> > to >>>>>>> >>>>>> play >>>>>>> >>>>>>>> > around >>>>>>> >>>>>>>> > > more destructively. >>>>>>> >>>>>>>> > > >>>>>>> >>>>>>>> > > Chris >>>>>>> >>>>>>>> > > >>>>>>> >>>>>>>> > > >>>>>>> >>>>>>>> > > >>>>>>> >>>>>>>> > > >>>>>>> >>>>>>>> > > >>>>>>> >>>>>>>> > > From: "Matt ." <[email protected]> >>>>>>> >>>>>>>> > > To: Christopher Lamb/Switzerland/IBM@IBMCH >>>>>>> >>>>>>>> > > Cc: Youenn PIOLET <[email protected]>, " >>>>>>> >>>>>>>> > [email protected]" >>>>>>> >>>>>>>> > > <[email protected]> >>>>>>> >>>>>>>> > > Date: 05.08.2015 01:01 >>>>>>> >>>>>>>> > > Subject: Re: [Freeipa-users] Ubuntu >>> Samba >>>>>>> >>> Server >>>>>>> >>>>>>>> > Auth >>>>>>> >>>>>>>> > against IPA >>>>>>> >>>>>>>> > > >>>>>>> >>>>>>>> > > >>>>>>> >>>>>>>> > > >>>>>>> >>>>>>>> > > Hi Chris, >>>>>>> >>>>>>>> > > >>>>>>> >>>>>>>> > > I'm at the right path, but my issue is that: >>>>>>> >>>>>>>> > > >>>>>>> >>>>>>>> > > ldapmodify -Y GSSAPI <<EOF >>>>>>> >>>>>>>> > > dn: cn=ipaconfig,cn=etc,dc=domain,dc=tld >>>>>>> >>>>>>>> > > changetype: add >>>>>>> >>>>>>>> > > add: ipaCustomFields >>>>>>> >>>>>>>> > > ipaCustomFields: "Samba Group Type,sambagrouptype,true" >>>>>>> >>>>>>>> > > EOF >>>>>>> >>>>>>>> > > >>>>>>> >>>>>>>> > > Does say it exists, my ldap explorer doesn't show it, >>> and >>>>>>> >>>>>>>> > when >>>>>>> >>> I >>>>>>> >>>>>> add >>>>>>> >>>>>>>> > > it manually as an attribute it still fails when I add a >>>>>>> >>>>>>>> > user >>>>>>> >> on >>>>>>> >>>>>> this >>>>>>> >>>>>>>> > > sambagrouptype as it's needed by the other attributes >>>>>>> >>>>>>>> > > >>>>>>> >>>>>>>> > > So that is my issue I think so far. >>>>>>> >>>>>>>> > > >>>>>>> >>>>>>>> > > Any clue about that ? >>>>>>> >>>>>>>> > > >>>>>>> >>>>>>>> > > No problem "you don't know something or are no guru" we >>> are >>>>>>> >> all >>>>>>> >>>>>>>> > > learning! :) >>>>>>> >>>>>>>> > > >>>>>>> >>>>>>>> > > Cheers, >>>>>>> >>>>>>>> > > >>>>>>> >>>>>>>> > > Matt >>>>>>> >>>>>>>> > > >>>>>>> >>>>>>>> > > >>>>>>> >>>>>>>> > > 2015-08-04 21:22 GMT+02:00 Christopher Lamb < >>>>>>> >>>>>>>> > [email protected]>: >>>>>>> >>>>>>>> > >> Hi Matt, Youeen >>>>>>> >>>>>>>> > >> >>>>>>> >>>>>>>> > >> Just to set the background properly, I did not invent >>> this >>>>>>> >>>>>> process. >>>>>>> >>>>>>>> > I >>>>>>> >>>>>>>> > > know >>>>>>> >>>>>>>> > >> only a little about FreeIPA, and almost nothing about >>>>>>> >>>>>>>> > Samba, >>>>>>> >>>> but >>>>>>> >>>>>> I >>>>>>> >>>>>>>> > guess >>>>>>> >>>>>>>> > > I >>>>>>> >>>>>>>> > >> was lucky enough to get the integration working on a >>>>>>> >>>>>>>> > Sunday >>>>>>> >>>>>>>> > afternoon. >>>>>>> >>>>>>>> > (I >>>>>>> >>>>>>>> > >> did have an older FreeIPA 3.x / Samba 3.x installation >>> as >>>>>>> >>>>>>>> > a >>>>>>> >>>>>>>> > reference). >>>>>>> >>>>>>>> > >> >>>>>>> >>>>>>>> > >> It sounds like we need to step back, and look at the >>> test >>>>>>> >> user >>>>>>> >>>>>> and >>>>>>> >>>>>>>> > group >>>>>>> >>>>>>>> > > in >>>>>>> >>>>>>>> > >> the FreeIPA LDAP tree. I find using an LDAP browser >>> makes >>>>>>> >> this >>>>>>> >>>>>> much >>>>>>> >>>>>>>> > > easier. >>>>>>> >>>>>>>> > >> >>>>>>> >>>>>>>> > >> My FreeIPA / Samba Users have the following Samba >>>>>>> >>>>>>>> > extensions >>>>>>> >>> in >>>>>>> >>>>>>>> > FreeIPA >>>>>>> >>>>>>>> > >> (cn=accounts, cn=users): >>>>>>> >>>>>>>> > >> >>>>>>> >>>>>>>> > >> * objectClass: sambasamaccount >>>>>>> >>>>>>>> > >> >>>>>>> >>>>>>>> > >> * Attributes: sambaSID, sambaNTPassword, >>> sambaPwdLastSet >>>>>>> >>>>>>>> > >> >>>>>>> >>>>>>>> > >> My FreeIPA / Samba Groups have the following Samba >>>>>>> >>>>>>>> > extensions >>>>>>> >>>> in >>>>>>> >>>>>>>> > FreeIPA >>>>>>> >>>>>>>> > >> (cn=accounts, cn=groups): >>>>>>> >>>>>>>> > >> >>>>>>> >>>>>>>> > >> * objectClass: sambaGroupMapping >>>>>>> >>>>>>>> > >> >>>>>>> >>>>>>>> > >> * Attributes: sambaGroupType, sambaSID >>>>>>> >>>>>>>> > >> >>>>>>> >>>>>>>> > >> The Users must belong to one or more of the samba >>> groups >>>>>>> >>>>>>>> > that >>>>>>> >>>>> you >>>>>>> >>>>>>>> > have >>>>>>> >>>>>>>> > >> setup. >>>>>>> >>>>>>>> > >> >>>>>>> >>>>>>>> > >> If you don't have something similar to the above >>> (which >>>>>>> >> sounds >>>>>>> >>>>>> like >>>>>>> >>>>>>>> > it >>>>>>> >>>>>>>> > is >>>>>>> >>>>>>>> > >> the case), then something went wrong applying the >>>>>>> >>>>>>>> > extensions. >>>>>>> >>>> It >>>>>>> >>>>>>>> > would >>>>>>> >>>>>>>> > be >>>>>>> >>>>>>>> > >> worth testing comparing a new user / group created >>> post >>>>>>> >> adding >>>>>>> >>>>>> the >>>>>>> >>>>>>>> > >> extensions to a previous existing user. >>>>>>> >>>>>>>> > >> >>>>>>> >>>>>>>> > >> i.e. >>>>>>> >>>>>>>> > >> are the extensions missing on existing users / groups? >>>>>>> >>>>>>>> > >> are the extensions missing on new users / groups? >>>>>>> >>>>>>>> > >> >>>>>>> >>>>>>>> > >> Cheers >>>>>>> >>>>>>>> > >> >>>>>>> >>>>>>>> > >> Chris >>>>>>> >>>>>>>> > >> >>>>>>> >>>>>>>> > >> >>>>>>> >>>>>>>> > >> >>>>>>> >>>>>>>> > >> >>>>>>> >>>>>>>> > >> >>>>>>> >>>>>>>> > >> From: Youenn PIOLET <[email protected]> >>>>>>> >>>>>>>> > >> To: "Matt ." <[email protected]> >>>>>>> >>>>>>>> > >> Cc: Christopher Lamb/Switzerland/IBM@IBMCH, >>>>>>> >>>>>>>> > >> "[email protected]" >>>>>>> >>>>> <[email protected]> >>>>>>> >>>>>>>> > >> Date: 04.08.2015 18:56 >>>>>>> >>>>>>>> > >> Subject: Re: [Freeipa-users] Ubuntu Samba >>> Server >>>>>>> >>>>>>>> > Auth >>>>>>> >>>>>>>> > against >>>>>>> >>>>>>>> > IPA >>>>>>> >>>>>>>> > >> >>>>>>> >>>>>>>> > >> >>>>>>> >>>>>>>> > >> >>>>>>> >>>>>>>> > >> Hi there, >>>>>>> >>>>>>>> > >> >>>>>>> >>>>>>>> > >> I have difficulties to follow you at this point :) >>>>>>> >>>>>>>> > >> Here is what I've done and what I've understood: >>>>>>> >>>>>>>> > >> >>>>>>> >>>>>>>> > >> ## SMB Side >>>>>>> >>>>>>>> > >> - Testparm OK >>>>>>> >>>>>>>> > >> - I've got the same NT_STATUS_NO_SUCH_USER when I try >>> to >>>>>>> >>>>> connect. >>>>>>> >>>>>>>> > >> - pdbedit -Lv output is all successfull but I can see >>>>>>> >>>>>>>> > there >>>>>>> >> is >>>>>>> >>>> a >>>>>>> >>>>>>>> > filter : >>>>>>> >>>>>>>> > >> (&(uid=*)(objectclass=sambaSamAccount). In LDAP, the >>> users >>>>>>> >>>> don't >>>>>>> >>>>>>>> > have >>>>>>> >>>>>>>> > >> sambaSamAccount. >>>>>>> >>>>>>>> > >> >>>>>>> >>>>>>>> > >> ## LDAP / FreeIPA side >>>>>>> >>>>>>>> > >> - Since SMB server uses LDAP, I did >>> ipa-adtrust-install on >>>>>>> >>>>>>>> > my >>>>>>> >>>>>>>> > FreeIPA >>>>>>> >>>>>>>> > >> server to get samba LDAP extensions. >>>>>>> >>>>>>>> > >> - I can see samba classes exist in LDAP but are not >>> used >>>>>>> >>>>>>>> > on >>>>>>> >> my >>>>>>> >>>>>>>> > group >>>>>>> >>>>>>>> > >> objects nor my user objects >>>>>>> >>>>>>>> > >> - I have add sambaSamAccount in FreeIPA default user >>>>>>> >>>>>>>> > classes, >>>>>>> >>>>>>>> > >> and sambaGroupMapping to default group classes. In >>> that >>>>>>> >>>>>>>> > state >>>>>>> >>> I >>>>>>> >>>>>>>> > can't >>>>>>> >>>>>>>> > >> create user nor groups anymore, as new samba >>> attributes >>>>>>> >>>>>>>> > are >>>>>>> >>>>>> needed >>>>>>> >>>>>>>> > for >>>>>>> >>>>>>>> > >> instantiation. >>>>>>> >>>>>>>> > >> - I have add in etc ipaCustomFields: 'Samba Group >>>>>>> >>>>>>>> > > Type,sambagrouptype,true' >>>>>>> >>>>>>>> > >> but I don't get what it does. >>>>>>> >>>>>>>> > >> - I tried to add the samba.js plugin. It works, and >>> adds >>>>>>> >>>>>>>> > the >>>>>>> >>>>>>>> > "local" >>>>>>> >>>>>>>> > > option >>>>>>> >>>>>>>> > >> when creating a group in FreeIPA, supposed to set >>>>>>> >>>> sambagrouptype >>>>>>> >>>>>> to >>>>>>> >>>>>>>> > 4 >>>>>>> >>>>>>>> > or >>>>>>> >>>>>>>> > > 2 >>>>>>> >>>>>>>> > >> (domain). It doesn't work and tells that >>> sambagrouptype >>>>>>> >>>>> attribute >>>>>>> >>>>>>>> > doesn't >>>>>>> >>>>>>>> > >> exist (but it should now I put sambaGroupType class by >>>>>>> >>>>>> default...) >>>>>>> >>>>>>>> > >> >>>>>>> >>>>>>>> > >> ## Questions >>>>>>> >>>>>>>> > >> 0) Can I ask samba not to search sambaSamAccount and >>> use >>>>>>> >>> unix / >>>>>>> >>>>>>>> > posix >>>>>>> >>>>>>>> > >> instead? I guess no. >>>>>>> >>>>>>>> > >> 1) How to generate the user/group SIDs ? They are >>>>>>> >>>>>>>> > requested >>>>>>> >> to >>>>>>> >>>>>> add >>>>>>> >>>>>>>> > >> sambaSamAccount classes. >>>>>>> >>>>>>>> > >> This article doesn't seem relevant since we don't use >>>>>>> >>>>>>>> > domain >>>>>>> >>>>>>>> > controller >>>>>>> >>>>>>>> > >> >>>>>>> >>>>>>>> > > >>>>>>> >>>>>>>> > >>>>>>> >>>>>>>> > >>>>>>> >>>>>> >>>>>>> >>>>> >>>>>>> >>>> >>>>>>> >>> >>>>>>> >> >>>>>>> >> >>> http://docs.fedoraproject.org/en-US/Fedora/17/html/FreeIPA_Guide/cifs.html >>>>>>> >>>>>>>> > >>>>>>> >>>>>>>> > >> and netgetlocalsid returns an error. >>>>>>> >>>>>>>> > >> 2) How to fix samba.js plugin? >>>>>>> >>>>>>>> > >> 3) I guess an equivalent of samba.js is needed for >>> user >>>>>>> >>>>> creation, >>>>>>> >>>>>>>> > where >>>>>>> >>>>>>>> > > can >>>>>>> >>>>>>>> > >> I find it? >>>>>>> >>>>>>>> > >> 4) Is your setup working with Windows 8 / Windows 10 >>> and >>>>>>> >>>>>>>> > not >>>>>>> >>>>> only >>>>>>> >>>>>>>> > Windows >>>>>>> >>>>>>>> > >> 7? >>>>>>> >>>>>>>> > >> >>>>>>> >>>>>>>> > >> Thanks a lot for your previous and future answers >>>>>>> >>>>>>>> > >> >>>>>>> >>>>>>>> > >> -- >>>>>>> >>>>>>>> > >> Youenn Piolet >>>>>>> >>>>>>>> > >> [email protected] >>>>>>> >>>>>>>> > >> >>>>>>> >>>>>>>> > >> >>>>>>> >>>>>>>> > >> 2015-08-04 17:55 GMT+02:00 Matt . >>>>>>> >>>>>>>> > <[email protected]>: >>>>>>> >>>>>>>> > >> Hi, >>>>>>> >>>>>>>> > >> >>>>>>> >>>>>>>> > >> Yes, log is anonymised. >>>>>>> >>>>>>>> > >> >>>>>>> >>>>>>>> > >> It's strange, my user doesn't have a >>> SambaPwdLastSet, >>>>>>> >>>>>>>> > also >>>>>>> >>>>> when >>>>>>> >>>>>> I >>>>>>> >>>>>>>> > >> change it's password it doesn't get it in ldap. >>>>>>> >>>>>>>> > >> >>>>>>> >>>>>>>> > >> There must be something going wrong I guess. >>>>>>> >>>>>>>> > >> >>>>>>> >>>>>>>> > >> Matt >>>>>>> >>>>>>>> > >> >>>>>>> >>>>>>>> > >> 2015-08-04 17:45 GMT+02:00 Christopher Lamb >>>>>>> >>>>>>>> > > <[email protected] >>>>>>> >>>>>>>> > >> >: >>>>>>> >>>>>>>> > >> > Hi Matt >>>>>>> >>>>>>>> > >> > >>>>>>> >>>>>>>> > >> > I assume [username] is a real username, identical >>> to >>>>>>> >>>>>>>> > that >>>>>>> >>>> in >>>>>>> >>>>>>>> > the >>>>>>> >>>>>>>> > >> FreeIPA >>>>>>> >>>>>>>> > >> > cn=accounts, cn=users tree? (i.e. you anonymised >>> the >>>>>>> >>>>>>>> > log >>>>>>> >>>>>>>> > extract). >>>>>>> >>>>>>>> > >> > >>>>>>> >>>>>>>> > >> > You user should be a member of the appropriate >>> samba >>>>>>> >>> groups >>>>>>> >>>>>>>> > that >>>>>>> >>>>>>>> > you >>>>>>> >>>>>>>> > >> setup >>>>>>> >>>>>>>> > >> > in FreeIPA. >>>>>>> >>>>>>>> > >> > >>>>>>> >>>>>>>> > >> > You should check that the user attribute >>>>>>> >>>>>>>> > SambaPwdLastSet >>>>>>> >>> is >>>>>>> >>>>>> set >>>>>>> >>>>>>>> > to >>>>>>> >>>>>>>> > a >>>>>>> >>>>>>>> > >> > positive value (e.g. 1). If not you get an error >>> in >>>>>>> >>>>>>>> > the >>>>>>> >>>>> Samba >>>>>>> >>>>>>>> > logs >>>>>>> >>>>>>>> > - >>>>>>> >>>>>>>> > > I >>>>>>> >>>>>>>> > >> > would need to play around again with a test user >>> to >>>>>>> >>>>>>>> > find >>>>>>> >>>> out >>>>>>> >>>>>>>> > the >>>>>>> >>>>>>>> > > exact >>>>>>> >>>>>>>> > >> > error. >>>>>>> >>>>>>>> > >> > >>>>>>> >>>>>>>> > >> > I don't understand what you mean about syncing the >>>>>>> >>>>>>>> > users >>>>>>> >>>>>> local, >>>>>>> >>>>>>>> > but >>>>>>> >>>>>>>> > > we >>>>>>> >>>>>>>> > >> did >>>>>>> >>>>>>>> > >> > not need to do anything like that. >>>>>>> >>>>>>>> > >> > >>>>>>> >>>>>>>> > >> > Chris >>>>>>> >>>>>>>> > >> > >>>>>>> >>>>>>>> > >> > >>>>>>> >>>>>>>> > >> > >>>>>>> >>>>>>>> > >> > >>>>>>> >>>>>>>> > >> > From: "Matt ." <[email protected]> >>>>>>> >>>>>>>> > >> > To: Christopher Lamb/Switzerland/IBM@IBMCH >>>>>>> >>>>>>>> > >> > Cc: "[email protected]" >>>>>>> >>>>> <[email protected]> >>>>>>> >>>>>>>> > >> > Date: 04.08.2015 15:33 >>>>>>> >>>>>>>> > >> > Subject: Re: [Freeipa-users] Ubuntu Samba >>>>>>> >>>>>>>> > Server >>>>>>> >>>> Auth >>>>>>> >>>>>>>> > against >>>>>>> >>>>>>>> > >> IPA >>>>>>> >>>>>>>> > >> > >>>>>>> >>>>>>>> > >> > >>>>>>> >>>>>>>> > >> > >>>>>>> >>>>>>>> > >> > Hi Chris, >>>>>>> >>>>>>>> > >> > >>>>>>> >>>>>>>> > >> > A puppet run added another passdb backend, that >>> was >>>>>>> >>> causing >>>>>>> >>>>>> my >>>>>>> >>>>>>>> > issue. >>>>>>> >>>>>>>> > >> > >>>>>>> >>>>>>>> > >> > What I still experience is: >>>>>>> >>>>>>>> > >> > >>>>>>> >>>>>>>> > >> > >>>>>>> >>>>>>>> > >> > [2015/08/04 15:29:45.477783, 3] >>>>>>> >>>>>>>> > >> > ../source3/auth/check_samsec.c:399 >>> (check_sam_security) >>>>>>> >>>>>>>> > >> > check_sam_security: Couldn't find user >>> 'username' in >>>>>>> >>>>>> passdb. >>>>>>> >>>>>>>> > >> > [2015/08/04 15:29:45.478026, 2] >>>>>>> >>>>>>>> > >> > ../source3/auth/auth.c:288 >>> (auth_check_ntlm_password) >>>>>>> >>>>>>>> > >> > check_ntlm_password: Authentication for user >>>>>>> >> [username] >>>>>>> >>>>> -> >>>>>>> >>>>>>>> > >> > [username] FAILED with error >>> NT_STATUS_NO_SUCH_USER >>>>>>> >>>>>>>> > >> > >>>>>>> >>>>>>>> > >> > >>>>>>> >>>>>>>> > >> > I also wonder if I shall still sync the users >>> local, >>>>>>> >>>>>>>> > or >>>>>>> >> is >>>>>>> >>>>> it >>>>>>> >>>>>>>> > > needed ? >>>>>>> >>>>>>>> > >> > >>>>>>> >>>>>>>> > >> > Thanks again, >>>>>>> >>>>>>>> > >> > >>>>>>> >>>>>>>> > >> > Matt >>>>>>> >>>>>>>> > >> > >>>>>>> >>>>>>>> > >> > 2015-08-04 14:16 GMT+02:00 Christopher Lamb < >>>>>>> >>>>>>>> > >> [email protected]>: >>>>>>> >>>>>>>> > >> >> Hi Matt >>>>>>> >>>>>>>> > >> >> >>>>>>> >>>>>>>> > >> >> From our smb.conf file: >>>>>>> >>>>>>>> > >> >> >>>>>>> >>>>>>>> > >> >> [global] >>>>>>> >>>>>>>> > >> >> security = user >>>>>>> >>>>>>>> > >> >> passdb backend = >>>>>>> >>>>>>>> > ldapsam:ldap://xxx-ldap2.my.silly.example.com >>>>>>> >>>>>>>> > >> >> ldap suffix = dc=my,dc=silly,dc=example,dc=com >>>>>>> >>>>>>>> > >> >> ldap admin dn = cn=Directory Manager >>>>>>> >>>>>>>> > >> >> >>>>>>> >>>>>>>> > >> >> So yes, we use Directory Manager, it works for >>> us. I >>>>>>> >> have >>>>>>> >>>>>> not >>>>>>> >>>>>>>> > tried >>>>>>> >>>>>>>> > >> with >>>>>>> >>>>>>>> > >> > a >>>>>>> >>>>>>>> > >> >> less powerful user, but it is conceivable that a >>>>>>> >>>>>>>> > lesser >>>>>>> >>>>> user >>>>>>> >>>>>>>> > may >>>>>>> >>>>>>>> > not >>>>>>> >>>>>>>> > >> see >>>>>>> >>>>>>>> > >> >> all the required attributes, resulting in "no >>> such >>>>>>> >>>>>>>> > user" >>>>>>> >>>>>>>> > errors. >>>>>>> >>>>>>>> > >> >> >>>>>>> >>>>>>>> > >> >> Chris >>>>>>> >>>>>>>> > >> >> >>>>>>> >>>>>>>> > >> >> >>>>>>> >>>>>>>> > >> >> >>>>>>> >>>>>>>> > >> >> >>>>>>> >>>>>>>> > >> >> From: "Matt ." <[email protected]> >>>>>>> >>>>>>>> > >> >> To: Christopher Lamb/Switzerland/IBM@IBMCH >>>>>>> >>>>>>>> > >> >> Cc: "[email protected]" >>>>>>> >>>>>> <[email protected]> >>>>>>> >>>>>>>> > >> >> Date: 04.08.2015 13:32 >>>>>>> >>>>>>>> > >> >> Subject: Re: [Freeipa-users] Ubuntu Samba >>>>>>> >>>>>>>> > Server >>>>>>> >>>>> Auth >>>>>>> >>>>>>>> > against >>>>>>> >>>>>>>> > >> IPA >>>>>>> >>>>>>>> > >> >> >>>>>>> >>>>>>>> > >> >> >>>>>>> >>>>>>>> > >> >> >>>>>>> >>>>>>>> > >> >> Hi Chris, >>>>>>> >>>>>>>> > >> >> >>>>>>> >>>>>>>> > >> >> Thanks for the heads up, indeed local is 4 I see >>> now >>>>>>> >> when >>>>>>> >>>> I >>>>>>> >>>>>>>> > add a >>>>>>> >>>>>>>> > >> >> group from the GUI, great thanks! >>>>>>> >>>>>>>> > >> >> >>>>>>> >>>>>>>> > >> >> But do you use Directory Manager as ldap admin >>> user >>>>>>> >>>>>>>> > or >>>>>>> >>>> some >>>>>>> >>>>>>>> > other >>>>>>> >>>>>>>> > >> >> admin account ? >>>>>>> >>>>>>>> > >> >> >>>>>>> >>>>>>>> > >> >> I'm not sure id DM is needed and it should get >>> that >>>>>>> >>>>>>>> > deep >>>>>>> >>>>>> into >>>>>>> >>>>>>>> > IPA. >>>>>>> >>>>>>>> > >> >> Also when starting samba it cannot find "such >>> user" >>>>>>> >>>>>>>> > as >>>>>>> >>>> that >>>>>>> >>>>>>>> > sounds >>>>>>> >>>>>>>> > >> >> quite known as it has no UID. >>>>>>> >>>>>>>> > >> >> >>>>>>> >>>>>>>> > >> >> From your config I see you use DM, this should >>> work ? >>>>>>> >>>>>>>> > >> >> >>>>>>> >>>>>>>> > >> >> Thanks! >>>>>>> >>>>>>>> > >> >> >>>>>>> >>>>>>>> > >> >> >>>>>>> >>>>>>>> > >> >> Matt >>>>>>> >>>>>>>> > >> >> >>>>>>> >>>>>>>> > >> >> >>>>>>> >>>>>>>> > >> > >>>>>>> >>>>>>>> > >> > >>>>>>> >>>>>>>> > >> > >>>>>>> >>>>>>>> > >> > >>>>>>> >>>>>>>> > >> >>>>>>> >>>>>>>> > >> -- >>>>>>> >>>>>>>> > >> Manage your subscription for the Freeipa-users >>> mailing >>>>>>> >> list: >>>>>>> >>>>>>>> > >> >>> https://www.redhat.com/mailman/listinfo/freeipa-users >>>>>>> >>>>>>>> > >> Go to http://freeipa.org for more info on the >>> project >>>>>>> >>>>>>>> > >> >>>>>>> >>>>>>>> > >> >>>>>>> >>>>>>>> > >> >>>>>>> >>>>>>>> > > >>>>>>> >>>>>>>> > > >>>>>>> >>>>>>>> > > >>>>>>> >>>>>>>> > > >>>>>>> >>>>>>>> > > -- >>>>>>> >>>>>>>> > > Manage your subscription for the Freeipa-users mailing >>>>>>> >>>>>>>> > list: >>>>>>> >>>>>>>> > > https://www.redhat.com/mailman/listinfo/freeipa-users >>>>>>> >>>>>>>> > > Go to http://freeipa.org for more info on the project >>>>>>> >>>>>>>> > > >>>>>>> >>>>>>>> > > >>>>>>> >>>>>>>> > > >>>>>>> >>>>>>>> > > >>>>>>> >>>>>>>> > >>>>>>> >>>>>>>> > -- >>>>>>> >>>>>>>> > Manage your subscription for the Freeipa-users mailing >>> list: >>>>>>> >>>>>>>> > https://www.redhat.com/mailman/listinfo/freeipa-users >>>>>>> >>>>>>>> > Go to http://freeipa.org for more info on the project >>>>>>> >>>>>>>> > >>>>>>> >>>>>>>> > >>>>>>> >>>>>>>> > >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>>> >>>>>> >>>>>>> >>>>>> >>>>>>> >>>>>> >>>>>>> >>>>>> >>>>>>> >>>>> >>>>>>> >>>>> >>>>>>> >>>>> >>>>>>> >>>>> >>>>>>> >>>> >>>>>>> >>>> >>>>>>> >>>> >>>>>>> >>>> >>>>>>> >>> >>>>>>> >>> >>>>>>> >>> >>>>>>> >>> >>>>>>> >> >>>>>>> >> >>>>>>> >> >>>>>>> >> >>>>>> >>>>>> >>> >>> >>> >>> -- Manage your subscription for the Freeipa-users mailing list: https://www.redhat.com/mailman/listinfo/freeipa-users Go to http://freeipa.org for more info on the project
