[Freeipa-users] Ubuntu Samba Server Auth against IPA
Matt .
yamakasi.014 at gmail.com
Wed Sep 23 09:32:43 UTC 2015
Hi Guys,
Please keep this topic updated as many people seem to have this question.
What's the status at your side ?
Cheers,
Matt
2015-09-04 15:27 GMT+02:00 Matt . <yamakasi.014 at gmail.com>:
> Hi,
>
> Does everyone have this working or gived up on it ?
>
> Chers,
>
> Matt
>
> 2015-08-26 20:07 GMT+02:00 Matt . <yamakasi.014 at gmail.com>:
>> Chris,
>>
>> How far are you on this ? I'm stuck atm :(
>>
>> I hope you have some reference notes to follow and check out.
>>
>> Thanks!
>>
>> Matt
>>
>> 2015-08-20 22:15 GMT+02:00 Matt . <yamakasi.014 at gmail.com>:
>>> Hi Chris,
>>>
>>> Would be great to see!
>>>
>>> If I have it working and we have 2-3 testcases I think we can add it
>>> to the IPA docs!
>>>
>>> Keep me updated!
>>>
>>> Thanks
>>>
>>> Matt
>>>
>>> 2015-08-20 8:49 GMT+02:00 Christopher Lamb <christopher.lamb at ch.ibm.com>:
>>>> Matt
>>>>
>>>> Once I got Samba and FreeIPA integrated (by the "good old extensions"
>>>> path), I always use FreeIPA to administer users. I have never tried the
>>>> samba tools like smbpasswd.
>>>>
>>>> I still have a wiki how-to in the works, but I had to focus on some other
>>>> issues for a while.
>>>>
>>>> Chris
>>>>
>>>>
>>>>
>>>> From: "Matt ." <yamakasi.014 at gmail.com>
>>>> To: Youenn PIOLET <piolet.y at gmail.com>
>>>> Cc: Christopher Lamb/Switzerland/IBM at IBMCH,
>>>> "freeipa-users at redhat.com" <freeipa-users at redhat.com>
>>>> Date: 20.08.2015 08:12
>>>> Subject: Re: [Freeipa-users] Ubuntu Samba Server Auth against IPA
>>>>
>>>>
>>>>
>>>> HI Guys,
>>>>
>>>> Anyone still a working clue/test here ?
>>>>
>>>> I didn't came further as it seems there need to be some domain join /
>>>> match following the freeipa devs.
>>>>
>>>> Thanks!
>>>>
>>>> Matt
>>>>
>>>> 2015-08-13 13:09 GMT+02:00 Matt . <yamakasi.014 at gmail.com>:
>>>>> Hi,
>>>>>
>>>>> I might have found somthing which I already seen in the logs.
>>>>>
>>>>> I did a smbpasswd my username on the samba server, it connects to ldap
>>>>> very well. I give my new password and get the following:
>>>>>
>>>>> smbldap_search_ext: base => [dc=my,dc=domain], filter =>
>>>>> [(&(objectClass=ipaNTGroupAttrs)(|
>>>> (ipaNTSecurityIdentifier=S-1----my--sid---)))],
>>>>> scope => [2]
>>>>> Attribute [displayName] not found.
>>>>> Could not retrieve 'displayName' attribute from cn=Default SMB
>>>>> Group,cn=groups,cn=accounts,dc=my,dc=domain
>>>>> Sid S-1----my--sid--- -> MYDOMAIN\Default SMB Group(2)
>>>>>
>>>>> So something is missing!
>>>>>
>>>>> Thanks so far guys!
>>>>>
>>>>> Cheers,
>>>>>
>>>>> Matt
>>>>>
>>>>> 2015-08-13 12:02 GMT+02:00 Matt . <yamakasi.014 at gmail.com>:
>>>>>> Hi Youenn,
>>>>>>
>>>>>> OK thanks! this takes me a little but futher now and I see some good
>>>>>> stuff in my logging.
>>>>>>
>>>>>> I'm testing on a Windows 10 Machine which is not member of an AD or
>>>>>> so, so that might be my issue for now ?
>>>>>>
>>>>>> When testing on the samba box itself as my user I get:
>>>>>>
>>>>>>
>>>>>> [myusername at smb-01 ~]$ smbclient //smb-01.domain.local/shares
>>>>>>
>>>>>> ...
>>>>>> Checking NTLMSSP password for MSP\myusername failed:
>>>> NT_STATUS_WRONG_PASSWORD
>>>>>> ...
>>>>>> SPNEGO login failed: NT_STATUS_WRONG_PASSWORD
>>>>>>
>>>>>>
>>>>>> Maybe I have an issue with encrypted passwords ?
>>>>>>
>>>>>>
>>>>>> When we have this all working, I think we have a howto :D
>>>>>>
>>>>>> Thanks!
>>>>>>
>>>>>> Matt
>>>>>>
>>>>>> 2015-08-13 10:53 GMT+02:00 Youenn PIOLET <piolet.y at gmail.com>:
>>>>>>> Hi Matt
>>>>>>>
>>>>>>> - CentOS : Did you copy ipasam.so and change your smb.conf accordingly?
>>>>>>> sambaSamAccount is not needed anymore that way.
>>>>>>> - Default IPA Way : won't work if your Windows is not part of a domain
>>>>>>> controller. DOMAIN\username may work for some users using Windows 7 -
>>>> not 8
>>>>>>> nor 10 (it did for me but I was the only one at the office... quite
>>>> useless)
>>>>>>>
>>>>>>> This config may work on your CentOS (for the ipasam way):
>>>>>>> workgroup = TEST
>>>>>>> realm = TEST.NET
>>>>>>> kerberos method = dedicated keytab
>>>>>>> dedicated keytab file = FILE:/<.....>/samba.keytab
>>>>>>> create krb5 conf = no
>>>>>>> security = user
>>>>>>> encrypt passwords = true
>>>>>>> passdb backend = ipasam:ldaps://youripa.test.net
>>>>>>> ldapsam:trusted = yes
>>>>>>> ldapsuffix = test.net
>>>>>>> ldap user suffix = cn=users,cn=accounts
>>>>>>> ldap group suffix = cn=groups,cn=accounts
>>>>>>>
>>>>>>>
>>>>>>> --
>>>>>>> Youenn Piolet
>>>>>>> piolet.y at gmail.com
>>>>>>>
>>>>>>>
>>>>>>> 2015-08-12 22:15 GMT+02:00 Matt . <yamakasi.014 at gmail.com>:
>>>>>>>>
>>>>>>>> Hi,
>>>>>>>>
>>>>>>>> OK the default IPA way works great actually when testing it as
>>>> described
>>>>>>>> here:
>>>>>>>>
>>>>>>>>
>>>> http://www.freeipa.org/page/Howto/Integrating_a_Samba_File_Server_With_IPA
>>>>>>>>
>>>>>>>> On the samba server I can auth and see my share where I want to
>>>> connect
>>>>>>>> to.
>>>>>>>>
>>>>>>>> The issue is, on Windows I cannot auth, even when I do DOMAIN\username
>>>>>>>> as username
>>>>>>>>
>>>>>>>> So, the IPA way should work.
>>>>>>>>
>>>>>>>> Any comments here ?
>>>>>>>>
>>>>>>>> Cheers,
>>>>>>>>
>>>>>>>> Matt
>>>>>>>>
>>>>>>>> 2015-08-12 19:00 GMT+02:00 Matt . <yamakasi.014 at gmail.com>:
>>>>>>>> > HI GUys,
>>>>>>>> >
>>>>>>>> > I'm testing this out and I think I almost setup, this on a CentOS
>>>> samba
>>>>>>>> > server.
>>>>>>>> >
>>>>>>>> > I'm using the ipa-adtrust way of Youeen but it seems we still need
>>>> to
>>>>>>>> > add (objectclass=sambaSamAccount)) ?
>>>>>>>> >
>>>>>>>> > Info is welcome!
>>>>>>>> >
>>>>>>>> > I will report back when I have it working.
>>>>>>>> >
>>>>>>>> > Thanks!
>>>>>>>> >
>>>>>>>> > Matt
>>>>>>>> >
>>>>>>>> > 2015-08-10 11:16 GMT+02:00 Christopher Lamb
>>>>>>>> > <christopher.lamb at ch.ibm.com>:
>>>>>>>> >> The next route I will try - is the one Youeen took, using
>>>> ipa-adtrust
>>>>>>>> >>
>>>>>>>> >>
>>>>>>>> >>
>>>>>>>> >> From: "Matt ." <yamakasi.014 at gmail.com>
>>>>>>>> >> To: Christopher Lamb/Switzerland/IBM at IBMCH,
>>>>>>>> >> "freeipa-users at redhat.com" <freeipa-users at redhat.com>
>>>>>>>> >> Date: 10.08.2015 10:03
>>>>>>>> >> Subject: Re: [Freeipa-users] Ubuntu Samba Server Auth
>>>> against
>>>>>>>> >> IPA
>>>>>>>> >>
>>>>>>>> >>
>>>>>>>> >>
>>>>>>>> >> Hi Chris,
>>>>>>>> >>
>>>>>>>> >> Okay this is good to hear.
>>>>>>>> >>
>>>>>>>> >> But don't we want a IPA managed Scheme ?
>>>>>>>> >>
>>>>>>>> >> When I did a "ipa-adtrust-install --add-sids" it also wanted a
>>>> local
>>>>>>>> >> installed Samba and I wonder why.
>>>>>>>> >>
>>>>>>>> >> Good that we make some progres on making it all clear.
>>>>>>>> >>
>>>>>>>> >> Cheers,
>>>>>>>> >>
>>>>>>>> >> Matt
>>>>>>>> >>
>>>>>>>> >> 2015-08-10 6:12 GMT+02:00 Christopher Lamb
>>>>>>>> >> <christopher.lamb at ch.ibm.com>:
>>>>>>>> >>> ldapsam + the samba extensions, pretty much as described in the
>>>>>>>> >> Techslaves
>>>>>>>> >>> article. Once I have a draft for the wiki page, I will mail you.
>>>>>>>> >>>
>>>>>>>> >>>
>>>>>>>> >>>
>>>>>>>> >>> From: "Matt ." <yamakasi.014 at gmail.com>
>>>>>>>> >>> To: Christopher Lamb/Switzerland/IBM at IBMCH,
>>>>>>>> >>> "freeipa-users at redhat.com" <freeipa-users at redhat.com>
>>>>>>>> >>> Date: 09.08.2015 21:17
>>>>>>>> >>> Subject: Re: [Freeipa-users] Ubuntu Samba Server Auth
>>>> against
>>>>>>>> >>> IPA
>>>>>>>> >>>
>>>>>>>> >>>
>>>>>>>> >>>
>>>>>>>> >>> Hi,
>>>>>>>> >>>
>>>>>>>> >>> Yes I know about "anything" but which way did you use now ?
>>>>>>>> >>>
>>>>>>>> >>>
>>>>>>>> >>>
>>>>>>>> >>> 2015-08-09 20:56 GMT+02:00 Christopher Lamb
>>>>>>>> >> <christopher.lamb at ch.ibm.com>:
>>>>>>>> >>>> Hi Matt
>>>>>>>> >>>>
>>>>>>>> >>>> I am on OEL 7.1. - so anything that works on that should be good
>>>> for
>>>>>>>> >> RHEL
>>>>>>>> >>>> and Centos 7.x
>>>>>>>> >>>>
>>>>>>>> >>>> I intend to add a how-to to the FreeIPA Wiki over the next few
>>>> days.
>>>>>>>> >>>> As
>>>>>>>> >>> we
>>>>>>>> >>>> have suggested earlier, we will likely end up with several, one
>>>> for
>>>>>>>> >>>> each
>>>>>>>> >>> of
>>>>>>>> >>>> the possible integration paths.
>>>>>>>> >>>>
>>>>>>>> >>>> Chris
>>>>>>>> >>>>
>>>>>>>> >>>>
>>>>>>>> >>>>
>>>>>>>> >>>>
>>>>>>>> >>>>
>>>>>>>> >>>> From: "Matt ." <yamakasi.014 at gmail.com>
>>>>>>>> >>>> To: Christopher Lamb/Switzerland/IBM at IBMCH,
>>>>>>>> >>>> "freeipa-users at redhat.com" <freeipa-users at redhat.com>
>>>>>>>> >>>> Date: 09.08.2015 16:45
>>>>>>>> >>>> Subject: Re: [Freeipa-users] Ubuntu Samba Server Auth
>>>> against
>>>>>>>> >>>> IPA
>>>>>>>> >>>>
>>>>>>>> >>>>
>>>>>>>> >>>>
>>>>>>>> >>>> Hi Chris,
>>>>>>>> >>>>
>>>>>>>> >>>> This sounds great!
>>>>>>>> >>>>
>>>>>>>> >>>> What are you using now, both CentOS ? So Samba and FreeIPA ?
>>>>>>>> >>>>
>>>>>>>> >>>> Maybe it's good to explain which way you used now in steps too,
>>>> so we
>>>>>>>> >>>> can combine or create multiple howto's ?
>>>>>>>> >>>>
>>>>>>>> >>>> At least we are going somewhere!
>>>>>>>> >>>>
>>>>>>>> >>>> Thanks,
>>>>>>>> >>>>
>>>>>>>> >>>> Matt
>>>>>>>> >>>>
>>>>>>>> >>>> 2015-08-09 14:54 GMT+02:00 Christopher Lamb
>>>>>>>> >>> <christopher.lamb at ch.ibm.com>:
>>>>>>>> >>>>> Hi Matt
>>>>>>>> >>>>>
>>>>>>>> >>>>> My test integration of FreeIPA 4.x and Samba 4.x with the "good
>>>> old
>>>>>>>> >>> Samba
>>>>>>>> >>>>> Schema extensions) is up and working, almost flawlessly.
>>>>>>>> >>>>>
>>>>>>>> >>>>> I can add users and groups via the FreeIPA CLI, and they get the
>>>>>>>> >> correct
>>>>>>>> >>>>> ObjectClasses / attributes required for Samba.
>>>>>>>> >>>>>
>>>>>>>> >>>>> So far I have not yet bothered to try the extensions to the
>>>> WebUI,
>>>>>>>> >>>> because
>>>>>>>> >>>>> it is currently giving me the classic "Your session has expired.
>>>>>>>> >>>>> Please
>>>>>>>> >>>>> re-login." error which renders the WebUI useless.
>>>>>>>> >>>>>
>>>>>>>> >>>>> The only problem I have so far encountered managing Samba /
>>>> FreeIPA
>>>>>>>> >>> users
>>>>>>>> >>>>> via FreeIPA CLI commands is with the handling of the attribute
>>>>>>>> >>>>> sambaPwdLastSet. This is the subject of an existing thread, also
>>>>>>>> >> updated
>>>>>>>> >>>>> today.
>>>>>>>> >>>>>
>>>>>>>> >>>>> There is also an existing alternative to hacking group.py, using
>>>>>>>> >>>>> "Class
>>>>>>>> >>>> of
>>>>>>>> >>>>> Service" (Cos) documented in this thread from February 2015
>>>>>>>> >>>>>
>>>>>>>> >>>
>>>>>>>> >>>
>>>> https://www.redhat.com/archives/freeipa-users/2015-February/msg00172.html
>>>>>>>> >>>> .
>>>>>>>> >>>>> I have not yet tried it, but it sounds reasonable.
>>>>>>>> >>>>>
>>>>>>>> >>>>> Chris
>>>>>>>> >>>>>
>>>>>>>> >>>>>
>>>>>>>> >>>>>
>>>>>>>> >>>>>
>>>>>>>> >>>>>
>>>>>>>> >>>>> From: "Matt ." <yamakasi.014 at gmail.com>
>>>>>>>> >>>>> To: Christopher Lamb/Switzerland/IBM at IBMCH
>>>>>>>> >>>>> Cc: "freeipa-users at redhat.com" <freeipa-users at redhat.com>,
>>>>>>>> >>>>> Youenn
>>>>>>>> >>>>> PIOLET <piolet.y at gmail.com>
>>>>>>>> >>>>> Date: 06.08.2015 16:19
>>>>>>>> >>>>> Subject: Re: [Freeipa-users] Ubuntu Samba Server Auth
>>>> against
>>>>>>>> >> IPA
>>>>>>>> >>>>>
>>>>>>>> >>>>>
>>>>>>>> >>>>>
>>>>>>>> >>>>> Hi Chris,
>>>>>>>> >>>>>
>>>>>>>> >>>>> OK, than we might create two different versions of the wiki, I
>>>> think
>>>>>>>> >>>>> this is nice.
>>>>>>>> >>>>>
>>>>>>>> >>>>> I'm still figuring out why I get that:
>>>>>>>> >>>>>
>>>>>>>> >>>>> IPA Error 4205: ObjectclassViolation
>>>>>>>> >>>>>
>>>>>>>> >>>>> missing attribute "sambaGroupType" required by object class
>>>>>>>> >>>>> "sambaGroupMapping"
>>>>>>>> >>>>>
>>>>>>>> >>>>> Matt
>>>>>>>> >>>>>
>>>>>>>> >>>>> 2015-08-06 16:09 GMT+02:00 Christopher Lamb
>>>>>>>> >>>> <christopher.lamb at ch.ibm.com>:
>>>>>>>> >>>>>> Hi Matt
>>>>>>>> >>>>>>
>>>>>>>> >>>>>> As far as I can make out, there are at least 2 viable Samba /
>>>>>>>> >>>>>> FreeIPA
>>>>>>>> >>>>>> integration paths.
>>>>>>>> >>>>>>
>>>>>>>> >>>>>> The route I took is suited where there is no Active Directory
>>>>>>>> >> involved:
>>>>>>>> >>>>> In
>>>>>>>> >>>>>> my case all the Windows, OSX and Linux clients are islands that
>>>> sit
>>>>>>>> >>>>>> on
>>>>>>>> >>>>> the
>>>>>>>> >>>>>> same network.
>>>>>>>> >>>>>>
>>>>>>>> >>>>>> The route that Youenn has taken (unless I have got completely
>>>> the
>>>>>>>> >> wrong
>>>>>>>> >>>>> end
>>>>>>>> >>>>>> of the stick) requires Active Directory in the architecture.
>>>>>>>> >>>>>>
>>>>>>>> >>>>>> Chris
>>>>>>>> >>>>>>
>>>>>>>> >>>>>>
>>>>>>>> >>>>>>
>>>>>>>> >>>>>> From: "Matt ." <yamakasi.014 at gmail.com>
>>>>>>>> >>>>>> To: Youenn PIOLET <piolet.y at gmail.com>
>>>>>>>> >>>>>> Cc: Christopher Lamb/Switzerland/IBM at IBMCH,
>>>>>>>> >>>>>> "freeipa-users at redhat.com"
>>>> <freeipa-users at redhat.com>
>>>>>>>> >>>>>> Date: 06.08.2015 14:42
>>>>>>>> >>>>>> Subject: Re: [Freeipa-users] Ubuntu Samba Server Auth
>>>>>>>> >>>>>> against
>>>>>>>> >>> IPA
>>>>>>>> >>>>>>
>>>>>>>> >>>>>>
>>>>>>>> >>>>>>
>>>>>>>> >>>>>> Hi,
>>>>>>>> >>>>>>
>>>>>>>> >>>>>> OK, this sounds already quite logical, but I'm still refering
>>>> to
>>>>>>>> >>>>>> the
>>>>>>>> >>>>>> old howto we found earlier, does that one still apply somewhere
>>>> or
>>>>>>>> >>>>>> not
>>>>>>>> >>>>>> at all ?
>>>>>>>> >>>>>>
>>>>>>>> >>>>>> Thanks,
>>>>>>>> >>>>>>
>>>>>>>> >>>>>> Matt
>>>>>>>> >>>>>>
>>>>>>>> >>>>>>
>>>>>>>> >>>>>>
>>>>>>>> >>>>>> 2015-08-06 12:23 GMT+02:00 Youenn PIOLET <piolet.y at gmail.com>:
>>>>>>>> >>>>>>> Hey guys,
>>>>>>>> >>>>>>>
>>>>>>>> >>>>>>> I'll try to make a tutorial soon, sorry I'm quite in a rush
>>>> these
>>>>>>>> >>>>> days :)
>>>>>>>> >>>>>>>
>>>>>>>> >>>>>>> General idea:
>>>>>>>> >>>>>>>
>>>>>>>> >>>>>>> On FreeIPA (4.1)
>>>>>>>> >>>>>>> - `ipa-adtrust-install --add-sids` (creates
>>>>>>>> >>>>>>> ipaNTsecurityidentifier
>>>>>>>> >>>>>>> attribude, also known as SID)
>>>>>>>> >>>>>>> - regenerate each user password to build ipaNTHash attribute,
>>>> not
>>>>>>>> >> here
>>>>>>>> >>>>> by
>>>>>>>> >>>>>>> default on users
>>>>>>>> >>>>>>> - use your ldap browser to check ipaNTHash values are here on
>>>> user
>>>>>>>> >>>>>> objects
>>>>>>>> >>>>>>> - create a CIFS service for your samba server
>>>>>>>> >>>>>>> - Create user roles/permissions as described here:
>>>>>>>> >>>>>>>
>>>>>>>> >>>>>>
>>>>>>>> >>>>>
>>>>>>>> >>>>
>>>>>>>> >>>
>>>>>>>> >>
>>>>>>>> >>
>>>> http://freeipa-users.redhat.narkive.com/ez2uKpFS/authenticate-samba-3-or-4-with-freeipa
>>>>
>>>>>>>> >>
>>>>>>>> >>>
>>>>>>>> >>>>
>>>>>>>> >>>>>
>>>>>>>> >>>>>>
>>>>>>>> >>>>>>> so that CIFS service will be able to read
>>>> ipaNTsecurityidentifier
>>>>>>>> >>>>>>> and
>>>>>>>> >>>>>>> ipaNTHash attributes in LDAP (ACI)
>>>>>>>> >>>>>>> - SCP ipasam.so module to your cifs server (this is the magic
>>>>>>>> >> trick) :
>>>>>>>> >>>>>> scp
>>>>>>>> >>>>>>> /usr/lib64/samba/pdb/ipasam.so
>>>>>>>> >>>>>>> root at samba-server.domain:/usr/lib64/samba/pdb/ You can also
>>>> try to
>>>>>>>> >>>>>> recompile
>>>>>>>> >>>>>>> it.
>>>>>>>> >>>>>>>
>>>>>>>> >>>>>>> On SAMBA Server side (CentOS 7...)
>>>>>>>> >>>>>>> - Install server keytab file for CIFS
>>>>>>>> >>>>>>> - check ipasam.so is here.
>>>>>>>> >>>>>>> - check you can read password hash in LDAP with `ldapsearch -Y
>>>>>>>> >>>>>>> GSSAPI
>>>>>>>> >>>>>>> uid=admin ipaNTHash` thanks to kerberos
>>>>>>>> >>>>>>> - make your smb.conf following the linked thread and restart
>>>>>>>> >>>>>>> service
>>>>>>>> >>>>>>>
>>>>>>>> >>>>>>> I don't know if it works in Ubuntu. I know sssd has evolved
>>>>>>>> >>>>>>> quickly
>>>>>>>> >>> and
>>>>>>>> >>>>>>> ipasam may use quite recent functionalities, the best is to
>>>> just
>>>>>>>> >>>>>>> try.
>>>>>>>> >>>>> You
>>>>>>>> >>>>>>> can read in previous thread : "If you insist on Ubuntu you
>>>> need to
>>>>>>>> >> get
>>>>>>>> >>>>>>> ipasam somewhere, most likely to compile it yourself".
>>>>>>>> >>>>>>>
>>>>>>>> >>>>>>> Make sure your user has ipaNTHash attribute :)
>>>>>>>> >>>>>>>
>>>>>>>> >>>>>>> You may want to debug authentication on samba server, I
>>>> usually do
>>>>>>>> >>>> this:
>>>>>>>> >>>>>>> `tail -f /var/log/samba/log* | grep <username>
>>>>>>>> >>>>>>>
>>>>>>>> >>>>>>> Cheers
>>>>>>>> >>>>>>> --
>>>>>>>> >>>>>>> Youenn Piolet
>>>>>>>> >>>>>>> piolet.y at gmail.com
>>>>>>>> >>>>>>>
>>>>>>>> >>>>>>>
>>>>>>>> >>>>>>> 2015-08-05 17:40 GMT+02:00 Matt . <yamakasi.014 at gmail.com>:
>>>>>>>> >>>>>>>>
>>>>>>>> >>>>>>>> Hi,
>>>>>>>> >>>>>>>>
>>>>>>>> >>>>>>>> This sounds great to me too, but a howto would help to make
>>>> it
>>>>>>>> >>>>>>>> more
>>>>>>>> >>>>>>>> clear about what you have done here. The thread confuses me a
>>>>>>>> >>>>>>>> little
>>>>>>>> >>>>>>>> bit.
>>>>>>>> >>>>>>>>
>>>>>>>> >>>>>>>> Can you paste your commands so we can test out too and report
>>>>>>>> >>>>>>>> back ?
>>>>>>>> >>>>>>>>
>>>>>>>> >>>>>>>> Thanks!
>>>>>>>> >>>>>>>>
>>>>>>>> >>>>>>>> Matt
>>>>>>>> >>>>>>>>
>>>>>>>> >>>>>>>> 2015-08-05 15:18 GMT+02:00 Christopher Lamb
>>>>>>>> >>>>>> <christopher.lamb at ch.ibm.com>:
>>>>>>>> >>>>>>>> > Hi Youenn
>>>>>>>> >>>>>>>> >
>>>>>>>> >>>>>>>> > Good news that you have got an integration working
>>>>>>>> >>>>>>>> >
>>>>>>>> >>>>>>>> > Now you have got it going, and the solution is fresh in
>>>> your
>>>>>>>> >>>>>>>> > mind,
>>>>>>>> >>>>> how
>>>>>>>> >>>>>>>> > about adding a How-to page on this solution to the FreeIPA
>>>>>>>> >>>>>>>> > wiki?
>>>>>>>> >>>>>>>> >
>>>>>>>> >>>>>>>> > Chris
>>>>>>>> >>>>>>>> >
>>>>>>>> >>>>>>>> >
>>>>>>>> >>>>>>>> >
>>>>>>>> >>>>>>>> > From: Youenn PIOLET <piolet.y at gmail.com>
>>>>>>>> >>>>>>>> > To: "Matt ." <yamakasi.014 at gmail.com>
>>>>>>>> >>>>>>>> > Cc: Christopher Lamb/Switzerland/IBM at IBMCH,
>>>>>>>> >>>>>>>> > "freeipa-users at redhat.com"
>>>>>>>> >>>>>>>> > <freeipa-users at redhat.com>
>>>>>>>> >>>>>>>> > Date: 05.08.2015 14:51
>>>>>>>> >>>>>>>> > Subject: Re: [Freeipa-users] Ubuntu Samba Server
>>>> Auth
>>>>>>>> >>> against
>>>>>>>> >>>>>> IPA
>>>>>>>> >>>>>>>> >
>>>>>>>> >>>>>>>> >
>>>>>>>> >>>>>>>> >
>>>>>>>> >>>>>>>> > Hi guys,
>>>>>>>> >>>>>>>> >
>>>>>>>> >>>>>>>> > Thank you so much your previous answers.
>>>>>>>> >>>>>>>> > I realised my SID were stored in ipaNTsecurityidentifier,
>>>>>>>> >>>>>>>> > thanks
>>>>>>>> >> to
>>>>>>>> >>>>>>>> > ipa-adtrust-install --add-sids
>>>>>>>> >>>>>>>> >
>>>>>>>> >>>>>>>> > I found an other way to configure smb here:
>>>>>>>> >>>>>>>> >
>>>>>>>> >>>>>>>> >
>>>>>>>> >>>>>>
>>>>>>>> >>>>>
>>>>>>>> >>>>
>>>>>>>> >>>
>>>>>>>> >>
>>>>>>>> >>
>>>> http://freeipa-users.redhat.narkive.com/ez2uKpFS/authenticate-samba-3-or-4-with-freeipa
>>>>
>>>>>>>> >>
>>>>>>>> >>>
>>>>>>>> >>>>
>>>>>>>> >>>>>
>>>>>>>> >>>>>>
>>>>>>>> >>>>>>>> > It works perfectly.
>>>>>>>> >>>>>>>> >
>>>>>>>> >>>>>>>> > I'm using module ipasam.so I have manually scp to the samba
>>>>>>>> >> server,
>>>>>>>> >>>>>>>> > Samba is set to use kerberos + ldapsam via this ipasam
>>>> module.
>>>>>>>> >>>>>>>> > Following the instructions, I created a user role allowing
>>>>>>>> >>>>>>>> > service
>>>>>>>> >>>>>>>> > principal to read ipaNTHash value from the LDAP.
>>>>>>>> >>>>>>>> > ipaNTHash are generated each time a user changes his
>>>> password.
>>>>>>>> >>>>>>>> > Authentication works perfectly on Windows 7, 8 and 10.
>>>>>>>> >>>>>>>> >
>>>>>>>> >>>>>>>> > For more details, the previously linked thread is quite
>>>> clear.
>>>>>>>> >>>>>>>> >
>>>>>>>> >>>>>>>> > Cheers
>>>>>>>> >>>>>>>> >
>>>>>>>> >>>>>>>> > --
>>>>>>>> >>>>>>>> > Youenn Piolet
>>>>>>>> >>>>>>>> > piolet.y at gmail.com
>>>>>>>> >>>>>>>> >
>>>>>>>> >>>>>>>> >
>>>>>>>> >>>>>>>> > 2015-08-05 11:10 GMT+02:00 Matt . <yamakasi.014 at gmail.com>:
>>>>>>>> >>>>>>>> > Hi Chris.
>>>>>>>> >>>>>>>> >
>>>>>>>> >>>>>>>> > Yes, Apache Studio did that but I was not sure why it
>>>>>>>> >>>>>>>> > complained
>>>>>>>> >>>> it
>>>>>>>> >>>>>>>> > was "already" there.
>>>>>>>> >>>>>>>> >
>>>>>>>> >>>>>>>> > I'm still getting:
>>>>>>>> >>>>>>>> >
>>>>>>>> >>>>>>>> > IPA Error 4205: ObjectclassViolation
>>>>>>>> >>>>>>>> >
>>>>>>>> >>>>>>>> > missing attribute "sambaGroupType" required by object
>>>> class
>>>>>>>> >>>>>>>> > "sambaGroupMapping"
>>>>>>>> >>>>>>>> >
>>>>>>>> >>>>>>>> > When adding a user.
>>>>>>>> >>>>>>>> >
>>>>>>>> >>>>>>>> > I also see "class" as fielname under my "Last name", this
>>>> is
>>>>>>>> >>>>>>>> > not
>>>>>>>> >>>> OK
>>>>>>>> >>>>>>>> > also.
>>>>>>>> >>>>>>>> >
>>>>>>>> >>>>>>>> >
>>>>>>>> >>>>>>>> >
>>>>>>>> >>>>>>>> > We sure need to make some howto, I think we can nail this
>>>>>>>> >> down :)
>>>>>>>> >>>>>>>> >
>>>>>>>> >>>>>>>> > Thanks for the heads up!
>>>>>>>> >>>>>>>> >
>>>>>>>> >>>>>>>> > Matthijs
>>>>>>>> >>>>>>>> >
>>>>>>>> >>>>>>>> > 2015-08-05 7:51 GMT+02:00 Christopher Lamb
>>>>>>>> >>>>>>>> > <christopher.lamb at ch.ibm.com>:
>>>>>>>> >>>>>>>> > > Hi Matt
>>>>>>>> >>>>>>>> > >
>>>>>>>> >>>>>>>> > > If I use Apache Directory Studio to add an attribute
>>>>>>>> >>>>>> ipaCustomFields
>>>>>>>> >>>>>>>> > to
>>>>>>>> >>>>>>>> > > cn=ipaConfig,cn=etc, the operation it performs is a
>>>> modify,
>>>>>>>> >>>>>>>> > as
>>>>>>>> >>>>>> shown
>>>>>>>> >>>>>>>> > below:
>>>>>>>> >>>>>>>> > >
>>>>>>>> >>>>>>>> > > #!RESULT OK
>>>>>>>> >>>>>>>> > > #!CONNECTION ldap://xxx-ldap2.my.silly.example.com:yyy
>>>>>>>> >>>>>>>> > > #!DATE 2015-08-05T05:45:04.608
>>>>>>>> >>>>>>>> > > dn:
>>>> cn=ipaConfig,cn=etc,dc=my,dc=silly,dc=example,dc=com
>>>>>>>> >>>>>>>> > > changetype: modify
>>>>>>>> >>>>>>>> > > add: ipaCustomFields
>>>>>>>> >>>>>>>> > > ipaCustomFields: Samba Group Type,sambagrouptype,true
>>>>>>>> >>>>>>>> > >
>>>>>>>> >>>>>>>> > > After that I then have a visible attribute
>>>> ipaCustomFields
>>>>>>>> >>>>>>>> > as
>>>>>>>> >>>>>>>> > expected.
>>>>>>>> >>>>>>>> > >
>>>>>>>> >>>>>>>> > > When adding the attribute, the wizard offered me
>>>>>>>> >>>>> "ipaCustomFields"
>>>>>>>> >>>>>>>> > as
>>>>>>>> >>>>>>>> > > attribute type in a drop down list.
>>>>>>>> >>>>>>>> > >
>>>>>>>> >>>>>>>> > > Once we get this cracked, we really must write a how-to
>>>> on
>>>>>>>> >>>>>>>> > the
>>>>>>>> >>>>>>>> > FreeIPA
>>>>>>>> >>>>>>>> > > Wiki.
>>>>>>>> >>>>>>>> > >
>>>>>>>> >>>>>>>> > > Chris
>>>>>>>> >>>>>>>> > >
>>>>>>>> >>>>>>>> > >
>>>>>>>> >>>>>>>> > >
>>>>>>>> >>>>>>>> > > From: Christopher Lamb/Switzerland/IBM at IBMCH
>>>>>>>> >>>>>>>> > > To: "Matt ." <yamakasi.014 at gmail.com>
>>>>>>>> >>>>>>>> > > Cc: "freeipa-users at redhat.com"
>>>>>>>> >>>>>>>> > <freeipa-users at redhat.com>
>>>>>>>> >>>>>>>> > > Date: 05.08.2015 07:31
>>>>>>>> >>>>>>>> > > Subject: Re: [Freeipa-users] Ubuntu Samba Server
>>>>>>>> >>>>>>>> > Auth
>>>>>>>> >>>>>> against
>>>>>>>> >>>>>>>> > IPA
>>>>>>>> >>>>>>>> > > Sent by: freeipa-users-bounces at redhat.com
>>>>>>>> >>>>>>>> > >
>>>>>>>> >>>>>>>> > >
>>>>>>>> >>>>>>>> > >
>>>>>>>> >>>>>>>> > > Hi Matt
>>>>>>>> >>>>>>>> > >
>>>>>>>> >>>>>>>> > > I also got the same result at that step, but can see
>>>>>>>> >>>>>>>> > nothing
>>>>>>>> >> in
>>>>>>>> >>>>>>>> > Apache
>>>>>>>> >>>>>>>> > > Directory Studio.
>>>>>>>> >>>>>>>> > >
>>>>>>>> >>>>>>>> > > As I am using existing Samba / FreeIPA groups migrated
>>>>>>>> >>>>>>>> > across,
>>>>>>>> >>>>>> they
>>>>>>>> >>>>>>>> > > probably were migrated with all the required
>>>> attributes.
>>>>>>>> >>>>>>>> > >
>>>>>>>> >>>>>>>> > > Looking more closely at that LDIF: I wonder should it
>>>> not
>>>>>>>> >>>>>>>> > be:
>>>>>>>> >>>>>>>> > >
>>>>>>>> >>>>>>>> > > ldapmodify -Y GSSAPI <<EOF
>>>>>>>> >>>>>>>> > > dn: cn=ipaconfig,cn=etc,dc=domain,dc=tld
>>>>>>>> >>>>>>>> > > changetype: modify
>>>>>>>> >>>>>>>> > > add: ipaCustomFields
>>>>>>>> >>>>>>>> > > ipaCustomFields: "Samba Group Type,sambagrouptype,true"
>>>>>>>> >>>>>>>> > > EOF
>>>>>>>> >>>>>>>> > >
>>>>>>>> >>>>>>>> > > i.e. changetype: modify, instead of changetype add ?
>>>>>>>> >>>>>>>> > >
>>>>>>>> >>>>>>>> > > I don't want to play around with my prod directory - I
>>>> will
>>>>>>>> >>>> setup
>>>>>>>> >>>>>> an
>>>>>>>> >>>>>>>> > EL
>>>>>>>> >>>>>>>> > 7.1
>>>>>>>> >>>>>>>> > > VM and install FreeIPA 4.x and Samba 4.x That will
>>>> allow me
>>>>>>>> >>>>>>>> > to
>>>>>>>> >>>>>> play
>>>>>>>> >>>>>>>> > around
>>>>>>>> >>>>>>>> > > more destructively.
>>>>>>>> >>>>>>>> > >
>>>>>>>> >>>>>>>> > > Chris
>>>>>>>> >>>>>>>> > >
>>>>>>>> >>>>>>>> > >
>>>>>>>> >>>>>>>> > >
>>>>>>>> >>>>>>>> > >
>>>>>>>> >>>>>>>> > >
>>>>>>>> >>>>>>>> > > From: "Matt ." <yamakasi.014 at gmail.com>
>>>>>>>> >>>>>>>> > > To: Christopher Lamb/Switzerland/IBM at IBMCH
>>>>>>>> >>>>>>>> > > Cc: Youenn PIOLET <piolet.y at gmail.com>, "
>>>>>>>> >>>>>>>> > freeipa-users at redhat.com"
>>>>>>>> >>>>>>>> > > <freeipa-users at redhat.com>
>>>>>>>> >>>>>>>> > > Date: 05.08.2015 01:01
>>>>>>>> >>>>>>>> > > Subject: Re: [Freeipa-users] Ubuntu
>>>> Samba
>>>>>>>> >>> Server
>>>>>>>> >>>>>>>> > Auth
>>>>>>>> >>>>>>>> > against IPA
>>>>>>>> >>>>>>>> > >
>>>>>>>> >>>>>>>> > >
>>>>>>>> >>>>>>>> > >
>>>>>>>> >>>>>>>> > > Hi Chris,
>>>>>>>> >>>>>>>> > >
>>>>>>>> >>>>>>>> > > I'm at the right path, but my issue is that:
>>>>>>>> >>>>>>>> > >
>>>>>>>> >>>>>>>> > > ldapmodify -Y GSSAPI <<EOF
>>>>>>>> >>>>>>>> > > dn: cn=ipaconfig,cn=etc,dc=domain,dc=tld
>>>>>>>> >>>>>>>> > > changetype: add
>>>>>>>> >>>>>>>> > > add: ipaCustomFields
>>>>>>>> >>>>>>>> > > ipaCustomFields: "Samba Group Type,sambagrouptype,true"
>>>>>>>> >>>>>>>> > > EOF
>>>>>>>> >>>>>>>> > >
>>>>>>>> >>>>>>>> > > Does say it exists, my ldap explorer doesn't show it,
>>>> and
>>>>>>>> >>>>>>>> > when
>>>>>>>> >>> I
>>>>>>>> >>>>>> add
>>>>>>>> >>>>>>>> > > it manually as an attribute it still fails when I add a
>>>>>>>> >>>>>>>> > user
>>>>>>>> >> on
>>>>>>>> >>>>>> this
>>>>>>>> >>>>>>>> > > sambagrouptype as it's needed by the other attributes
>>>>>>>> >>>>>>>> > >
>>>>>>>> >>>>>>>> > > So that is my issue I think so far.
>>>>>>>> >>>>>>>> > >
>>>>>>>> >>>>>>>> > > Any clue about that ?
>>>>>>>> >>>>>>>> > >
>>>>>>>> >>>>>>>> > > No problem "you don't know something or are no guru" we
>>>> are
>>>>>>>> >> all
>>>>>>>> >>>>>>>> > > learning! :)
>>>>>>>> >>>>>>>> > >
>>>>>>>> >>>>>>>> > > Cheers,
>>>>>>>> >>>>>>>> > >
>>>>>>>> >>>>>>>> > > Matt
>>>>>>>> >>>>>>>> > >
>>>>>>>> >>>>>>>> > >
>>>>>>>> >>>>>>>> > > 2015-08-04 21:22 GMT+02:00 Christopher Lamb <
>>>>>>>> >>>>>>>> > christopher.lamb at ch.ibm.com>:
>>>>>>>> >>>>>>>> > >> Hi Matt, Youeen
>>>>>>>> >>>>>>>> > >>
>>>>>>>> >>>>>>>> > >> Just to set the background properly, I did not invent
>>>> this
>>>>>>>> >>>>>> process.
>>>>>>>> >>>>>>>> > I
>>>>>>>> >>>>>>>> > > know
>>>>>>>> >>>>>>>> > >> only a little about FreeIPA, and almost nothing about
>>>>>>>> >>>>>>>> > Samba,
>>>>>>>> >>>> but
>>>>>>>> >>>>>> I
>>>>>>>> >>>>>>>> > guess
>>>>>>>> >>>>>>>> > > I
>>>>>>>> >>>>>>>> > >> was lucky enough to get the integration working on a
>>>>>>>> >>>>>>>> > Sunday
>>>>>>>> >>>>>>>> > afternoon.
>>>>>>>> >>>>>>>> > (I
>>>>>>>> >>>>>>>> > >> did have an older FreeIPA 3.x / Samba 3.x installation
>>>> as
>>>>>>>> >>>>>>>> > a
>>>>>>>> >>>>>>>> > reference).
>>>>>>>> >>>>>>>> > >>
>>>>>>>> >>>>>>>> > >> It sounds like we need to step back, and look at the
>>>> test
>>>>>>>> >> user
>>>>>>>> >>>>>> and
>>>>>>>> >>>>>>>> > group
>>>>>>>> >>>>>>>> > > in
>>>>>>>> >>>>>>>> > >> the FreeIPA LDAP tree. I find using an LDAP browser
>>>> makes
>>>>>>>> >> this
>>>>>>>> >>>>>> much
>>>>>>>> >>>>>>>> > > easier.
>>>>>>>> >>>>>>>> > >>
>>>>>>>> >>>>>>>> > >> My FreeIPA / Samba Users have the following Samba
>>>>>>>> >>>>>>>> > extensions
>>>>>>>> >>> in
>>>>>>>> >>>>>>>> > FreeIPA
>>>>>>>> >>>>>>>> > >> (cn=accounts, cn=users):
>>>>>>>> >>>>>>>> > >>
>>>>>>>> >>>>>>>> > >> * objectClass: sambasamaccount
>>>>>>>> >>>>>>>> > >>
>>>>>>>> >>>>>>>> > >> * Attributes: sambaSID, sambaNTPassword,
>>>> sambaPwdLastSet
>>>>>>>> >>>>>>>> > >>
>>>>>>>> >>>>>>>> > >> My FreeIPA / Samba Groups have the following Samba
>>>>>>>> >>>>>>>> > extensions
>>>>>>>> >>>> in
>>>>>>>> >>>>>>>> > FreeIPA
>>>>>>>> >>>>>>>> > >> (cn=accounts, cn=groups):
>>>>>>>> >>>>>>>> > >>
>>>>>>>> >>>>>>>> > >> * objectClass: sambaGroupMapping
>>>>>>>> >>>>>>>> > >>
>>>>>>>> >>>>>>>> > >> * Attributes: sambaGroupType, sambaSID
>>>>>>>> >>>>>>>> > >>
>>>>>>>> >>>>>>>> > >> The Users must belong to one or more of the samba
>>>> groups
>>>>>>>> >>>>>>>> > that
>>>>>>>> >>>>> you
>>>>>>>> >>>>>>>> > have
>>>>>>>> >>>>>>>> > >> setup.
>>>>>>>> >>>>>>>> > >>
>>>>>>>> >>>>>>>> > >> If you don't have something similar to the above
>>>> (which
>>>>>>>> >> sounds
>>>>>>>> >>>>>> like
>>>>>>>> >>>>>>>> > it
>>>>>>>> >>>>>>>> > is
>>>>>>>> >>>>>>>> > >> the case), then something went wrong applying the
>>>>>>>> >>>>>>>> > extensions.
>>>>>>>> >>>> It
>>>>>>>> >>>>>>>> > would
>>>>>>>> >>>>>>>> > be
>>>>>>>> >>>>>>>> > >> worth testing comparing a new user / group created
>>>> post
>>>>>>>> >> adding
>>>>>>>> >>>>>> the
>>>>>>>> >>>>>>>> > >> extensions to a previous existing user.
>>>>>>>> >>>>>>>> > >>
>>>>>>>> >>>>>>>> > >> i.e.
>>>>>>>> >>>>>>>> > >> are the extensions missing on existing users / groups?
>>>>>>>> >>>>>>>> > >> are the extensions missing on new users / groups?
>>>>>>>> >>>>>>>> > >>
>>>>>>>> >>>>>>>> > >> Cheers
>>>>>>>> >>>>>>>> > >>
>>>>>>>> >>>>>>>> > >> Chris
>>>>>>>> >>>>>>>> > >>
>>>>>>>> >>>>>>>> > >>
>>>>>>>> >>>>>>>> > >>
>>>>>>>> >>>>>>>> > >>
>>>>>>>> >>>>>>>> > >>
>>>>>>>> >>>>>>>> > >> From: Youenn PIOLET <piolet.y at gmail.com>
>>>>>>>> >>>>>>>> > >> To: "Matt ." <yamakasi.014 at gmail.com>
>>>>>>>> >>>>>>>> > >> Cc: Christopher Lamb/Switzerland/IBM at IBMCH,
>>>>>>>> >>>>>>>> > >> "freeipa-users at redhat.com"
>>>>>>>> >>>>> <freeipa-users at redhat.com>
>>>>>>>> >>>>>>>> > >> Date: 04.08.2015 18:56
>>>>>>>> >>>>>>>> > >> Subject: Re: [Freeipa-users] Ubuntu Samba
>>>> Server
>>>>>>>> >>>>>>>> > Auth
>>>>>>>> >>>>>>>> > against
>>>>>>>> >>>>>>>> > IPA
>>>>>>>> >>>>>>>> > >>
>>>>>>>> >>>>>>>> > >>
>>>>>>>> >>>>>>>> > >>
>>>>>>>> >>>>>>>> > >> Hi there,
>>>>>>>> >>>>>>>> > >>
>>>>>>>> >>>>>>>> > >> I have difficulties to follow you at this point :)
>>>>>>>> >>>>>>>> > >> Here is what I've done and what I've understood:
>>>>>>>> >>>>>>>> > >>
>>>>>>>> >>>>>>>> > >> ## SMB Side
>>>>>>>> >>>>>>>> > >> - Testparm OK
>>>>>>>> >>>>>>>> > >> - I've got the same NT_STATUS_NO_SUCH_USER when I try
>>>> to
>>>>>>>> >>>>> connect.
>>>>>>>> >>>>>>>> > >> - pdbedit -Lv output is all successfull but I can see
>>>>>>>> >>>>>>>> > there
>>>>>>>> >> is
>>>>>>>> >>>> a
>>>>>>>> >>>>>>>> > filter :
>>>>>>>> >>>>>>>> > >> (&(uid=*)(objectclass=sambaSamAccount). In LDAP, the
>>>> users
>>>>>>>> >>>> don't
>>>>>>>> >>>>>>>> > have
>>>>>>>> >>>>>>>> > >> sambaSamAccount.
>>>>>>>> >>>>>>>> > >>
>>>>>>>> >>>>>>>> > >> ## LDAP / FreeIPA side
>>>>>>>> >>>>>>>> > >> - Since SMB server uses LDAP, I did
>>>> ipa-adtrust-install on
>>>>>>>> >>>>>>>> > my
>>>>>>>> >>>>>>>> > FreeIPA
>>>>>>>> >>>>>>>> > >> server to get samba LDAP extensions.
>>>>>>>> >>>>>>>> > >> - I can see samba classes exist in LDAP but are not
>>>> used
>>>>>>>> >>>>>>>> > on
>>>>>>>> >> my
>>>>>>>> >>>>>>>> > group
>>>>>>>> >>>>>>>> > >> objects nor my user objects
>>>>>>>> >>>>>>>> > >> - I have add sambaSamAccount in FreeIPA default user
>>>>>>>> >>>>>>>> > classes,
>>>>>>>> >>>>>>>> > >> and sambaGroupMapping to default group classes. In
>>>> that
>>>>>>>> >>>>>>>> > state
>>>>>>>> >>> I
>>>>>>>> >>>>>>>> > can't
>>>>>>>> >>>>>>>> > >> create user nor groups anymore, as new samba
>>>> attributes
>>>>>>>> >>>>>>>> > are
>>>>>>>> >>>>>> needed
>>>>>>>> >>>>>>>> > for
>>>>>>>> >>>>>>>> > >> instantiation.
>>>>>>>> >>>>>>>> > >> - I have add in etc ipaCustomFields: 'Samba Group
>>>>>>>> >>>>>>>> > > Type,sambagrouptype,true'
>>>>>>>> >>>>>>>> > >> but I don't get what it does.
>>>>>>>> >>>>>>>> > >> - I tried to add the samba.js plugin. It works, and
>>>> adds
>>>>>>>> >>>>>>>> > the
>>>>>>>> >>>>>>>> > "local"
>>>>>>>> >>>>>>>> > > option
>>>>>>>> >>>>>>>> > >> when creating a group in FreeIPA, supposed to set
>>>>>>>> >>>> sambagrouptype
>>>>>>>> >>>>>> to
>>>>>>>> >>>>>>>> > 4
>>>>>>>> >>>>>>>> > or
>>>>>>>> >>>>>>>> > > 2
>>>>>>>> >>>>>>>> > >> (domain). It doesn't work and tells that
>>>> sambagrouptype
>>>>>>>> >>>>> attribute
>>>>>>>> >>>>>>>> > doesn't
>>>>>>>> >>>>>>>> > >> exist (but it should now I put sambaGroupType class by
>>>>>>>> >>>>>> default...)
>>>>>>>> >>>>>>>> > >>
>>>>>>>> >>>>>>>> > >> ## Questions
>>>>>>>> >>>>>>>> > >> 0) Can I ask samba not to search sambaSamAccount and
>>>> use
>>>>>>>> >>> unix /
>>>>>>>> >>>>>>>> > posix
>>>>>>>> >>>>>>>> > >> instead? I guess no.
>>>>>>>> >>>>>>>> > >> 1) How to generate the user/group SIDs ? They are
>>>>>>>> >>>>>>>> > requested
>>>>>>>> >> to
>>>>>>>> >>>>>> add
>>>>>>>> >>>>>>>> > >> sambaSamAccount classes.
>>>>>>>> >>>>>>>> > >> This article doesn't seem relevant since we don't use
>>>>>>>> >>>>>>>> > domain
>>>>>>>> >>>>>>>> > controller
>>>>>>>> >>>>>>>> > >>
>>>>>>>> >>>>>>>> > >
>>>>>>>> >>>>>>>> >
>>>>>>>> >>>>>>>> >
>>>>>>>> >>>>>>
>>>>>>>> >>>>>
>>>>>>>> >>>>
>>>>>>>> >>>
>>>>>>>> >>
>>>>>>>> >>
>>>> http://docs.fedoraproject.org/en-US/Fedora/17/html/FreeIPA_Guide/cifs.html
>>>>>>>> >>>>>>>> >
>>>>>>>> >>>>>>>> > >> and netgetlocalsid returns an error.
>>>>>>>> >>>>>>>> > >> 2) How to fix samba.js plugin?
>>>>>>>> >>>>>>>> > >> 3) I guess an equivalent of samba.js is needed for
>>>> user
>>>>>>>> >>>>> creation,
>>>>>>>> >>>>>>>> > where
>>>>>>>> >>>>>>>> > > can
>>>>>>>> >>>>>>>> > >> I find it?
>>>>>>>> >>>>>>>> > >> 4) Is your setup working with Windows 8 / Windows 10
>>>> and
>>>>>>>> >>>>>>>> > not
>>>>>>>> >>>>> only
>>>>>>>> >>>>>>>> > Windows
>>>>>>>> >>>>>>>> > >> 7?
>>>>>>>> >>>>>>>> > >>
>>>>>>>> >>>>>>>> > >> Thanks a lot for your previous and future answers
>>>>>>>> >>>>>>>> > >>
>>>>>>>> >>>>>>>> > >> --
>>>>>>>> >>>>>>>> > >> Youenn Piolet
>>>>>>>> >>>>>>>> > >> piolet.y at gmail.com
>>>>>>>> >>>>>>>> > >>
>>>>>>>> >>>>>>>> > >>
>>>>>>>> >>>>>>>> > >> 2015-08-04 17:55 GMT+02:00 Matt .
>>>>>>>> >>>>>>>> > <yamakasi.014 at gmail.com>:
>>>>>>>> >>>>>>>> > >> Hi,
>>>>>>>> >>>>>>>> > >>
>>>>>>>> >>>>>>>> > >> Yes, log is anonymised.
>>>>>>>> >>>>>>>> > >>
>>>>>>>> >>>>>>>> > >> It's strange, my user doesn't have a
>>>> SambaPwdLastSet,
>>>>>>>> >>>>>>>> > also
>>>>>>>> >>>>> when
>>>>>>>> >>>>>> I
>>>>>>>> >>>>>>>> > >> change it's password it doesn't get it in ldap.
>>>>>>>> >>>>>>>> > >>
>>>>>>>> >>>>>>>> > >> There must be something going wrong I guess.
>>>>>>>> >>>>>>>> > >>
>>>>>>>> >>>>>>>> > >> Matt
>>>>>>>> >>>>>>>> > >>
>>>>>>>> >>>>>>>> > >> 2015-08-04 17:45 GMT+02:00 Christopher Lamb
>>>>>>>> >>>>>>>> > > <christopher.lamb at ch.ibm.com
>>>>>>>> >>>>>>>> > >> >:
>>>>>>>> >>>>>>>> > >> > Hi Matt
>>>>>>>> >>>>>>>> > >> >
>>>>>>>> >>>>>>>> > >> > I assume [username] is a real username, identical
>>>> to
>>>>>>>> >>>>>>>> > that
>>>>>>>> >>>> in
>>>>>>>> >>>>>>>> > the
>>>>>>>> >>>>>>>> > >> FreeIPA
>>>>>>>> >>>>>>>> > >> > cn=accounts, cn=users tree? (i.e. you anonymised
>>>> the
>>>>>>>> >>>>>>>> > log
>>>>>>>> >>>>>>>> > extract).
>>>>>>>> >>>>>>>> > >> >
>>>>>>>> >>>>>>>> > >> > You user should be a member of the appropriate
>>>> samba
>>>>>>>> >>> groups
>>>>>>>> >>>>>>>> > that
>>>>>>>> >>>>>>>> > you
>>>>>>>> >>>>>>>> > >> setup
>>>>>>>> >>>>>>>> > >> > in FreeIPA.
>>>>>>>> >>>>>>>> > >> >
>>>>>>>> >>>>>>>> > >> > You should check that the user attribute
>>>>>>>> >>>>>>>> > SambaPwdLastSet
>>>>>>>> >>> is
>>>>>>>> >>>>>> set
>>>>>>>> >>>>>>>> > to
>>>>>>>> >>>>>>>> > a
>>>>>>>> >>>>>>>> > >> > positive value (e.g. 1). If not you get an error
>>>> in
>>>>>>>> >>>>>>>> > the
>>>>>>>> >>>>> Samba
>>>>>>>> >>>>>>>> > logs
>>>>>>>> >>>>>>>> > -
>>>>>>>> >>>>>>>> > > I
>>>>>>>> >>>>>>>> > >> > would need to play around again with a test user
>>>> to
>>>>>>>> >>>>>>>> > find
>>>>>>>> >>>> out
>>>>>>>> >>>>>>>> > the
>>>>>>>> >>>>>>>> > > exact
>>>>>>>> >>>>>>>> > >> > error.
>>>>>>>> >>>>>>>> > >> >
>>>>>>>> >>>>>>>> > >> > I don't understand what you mean about syncing the
>>>>>>>> >>>>>>>> > users
>>>>>>>> >>>>>> local,
>>>>>>>> >>>>>>>> > but
>>>>>>>> >>>>>>>> > > we
>>>>>>>> >>>>>>>> > >> did
>>>>>>>> >>>>>>>> > >> > not need to do anything like that.
>>>>>>>> >>>>>>>> > >> >
>>>>>>>> >>>>>>>> > >> > Chris
>>>>>>>> >>>>>>>> > >> >
>>>>>>>> >>>>>>>> > >> >
>>>>>>>> >>>>>>>> > >> >
>>>>>>>> >>>>>>>> > >> >
>>>>>>>> >>>>>>>> > >> > From: "Matt ." <yamakasi.014 at gmail.com>
>>>>>>>> >>>>>>>> > >> > To: Christopher Lamb/Switzerland/IBM at IBMCH
>>>>>>>> >>>>>>>> > >> > Cc: "freeipa-users at redhat.com"
>>>>>>>> >>>>> <freeipa-users at redhat.com>
>>>>>>>> >>>>>>>> > >> > Date: 04.08.2015 15:33
>>>>>>>> >>>>>>>> > >> > Subject: Re: [Freeipa-users] Ubuntu Samba
>>>>>>>> >>>>>>>> > Server
>>>>>>>> >>>> Auth
>>>>>>>> >>>>>>>> > against
>>>>>>>> >>>>>>>> > >> IPA
>>>>>>>> >>>>>>>> > >> >
>>>>>>>> >>>>>>>> > >> >
>>>>>>>> >>>>>>>> > >> >
>>>>>>>> >>>>>>>> > >> > Hi Chris,
>>>>>>>> >>>>>>>> > >> >
>>>>>>>> >>>>>>>> > >> > A puppet run added another passdb backend, that
>>>> was
>>>>>>>> >>> causing
>>>>>>>> >>>>>> my
>>>>>>>> >>>>>>>> > issue.
>>>>>>>> >>>>>>>> > >> >
>>>>>>>> >>>>>>>> > >> > What I still experience is:
>>>>>>>> >>>>>>>> > >> >
>>>>>>>> >>>>>>>> > >> >
>>>>>>>> >>>>>>>> > >> > [2015/08/04 15:29:45.477783, 3]
>>>>>>>> >>>>>>>> > >> > ../source3/auth/check_samsec.c:399
>>>> (check_sam_security)
>>>>>>>> >>>>>>>> > >> > check_sam_security: Couldn't find user
>>>> 'username' in
>>>>>>>> >>>>>> passdb.
>>>>>>>> >>>>>>>> > >> > [2015/08/04 15:29:45.478026, 2]
>>>>>>>> >>>>>>>> > >> > ../source3/auth/auth.c:288
>>>> (auth_check_ntlm_password)
>>>>>>>> >>>>>>>> > >> > check_ntlm_password: Authentication for user
>>>>>>>> >> [username]
>>>>>>>> >>>>> ->
>>>>>>>> >>>>>>>> > >> > [username] FAILED with error
>>>> NT_STATUS_NO_SUCH_USER
>>>>>>>> >>>>>>>> > >> >
>>>>>>>> >>>>>>>> > >> >
>>>>>>>> >>>>>>>> > >> > I also wonder if I shall still sync the users
>>>> local,
>>>>>>>> >>>>>>>> > or
>>>>>>>> >> is
>>>>>>>> >>>>> it
>>>>>>>> >>>>>>>> > > needed ?
>>>>>>>> >>>>>>>> > >> >
>>>>>>>> >>>>>>>> > >> > Thanks again,
>>>>>>>> >>>>>>>> > >> >
>>>>>>>> >>>>>>>> > >> > Matt
>>>>>>>> >>>>>>>> > >> >
>>>>>>>> >>>>>>>> > >> > 2015-08-04 14:16 GMT+02:00 Christopher Lamb <
>>>>>>>> >>>>>>>> > >> christopher.lamb at ch.ibm.com>:
>>>>>>>> >>>>>>>> > >> >> Hi Matt
>>>>>>>> >>>>>>>> > >> >>
>>>>>>>> >>>>>>>> > >> >> From our smb.conf file:
>>>>>>>> >>>>>>>> > >> >>
>>>>>>>> >>>>>>>> > >> >> [global]
>>>>>>>> >>>>>>>> > >> >> security = user
>>>>>>>> >>>>>>>> > >> >> passdb backend =
>>>>>>>> >>>>>>>> > ldapsam:ldap://xxx-ldap2.my.silly.example.com
>>>>>>>> >>>>>>>> > >> >> ldap suffix = dc=my,dc=silly,dc=example,dc=com
>>>>>>>> >>>>>>>> > >> >> ldap admin dn = cn=Directory Manager
>>>>>>>> >>>>>>>> > >> >>
>>>>>>>> >>>>>>>> > >> >> So yes, we use Directory Manager, it works for
>>>> us. I
>>>>>>>> >> have
>>>>>>>> >>>>>> not
>>>>>>>> >>>>>>>> > tried
>>>>>>>> >>>>>>>> > >> with
>>>>>>>> >>>>>>>> > >> > a
>>>>>>>> >>>>>>>> > >> >> less powerful user, but it is conceivable that a
>>>>>>>> >>>>>>>> > lesser
>>>>>>>> >>>>> user
>>>>>>>> >>>>>>>> > may
>>>>>>>> >>>>>>>> > not
>>>>>>>> >>>>>>>> > >> see
>>>>>>>> >>>>>>>> > >> >> all the required attributes, resulting in "no
>>>> such
>>>>>>>> >>>>>>>> > user"
>>>>>>>> >>>>>>>> > errors.
>>>>>>>> >>>>>>>> > >> >>
>>>>>>>> >>>>>>>> > >> >> Chris
>>>>>>>> >>>>>>>> > >> >>
>>>>>>>> >>>>>>>> > >> >>
>>>>>>>> >>>>>>>> > >> >>
>>>>>>>> >>>>>>>> > >> >>
>>>>>>>> >>>>>>>> > >> >> From: "Matt ." <yamakasi.014 at gmail.com>
>>>>>>>> >>>>>>>> > >> >> To: Christopher Lamb/Switzerland/IBM at IBMCH
>>>>>>>> >>>>>>>> > >> >> Cc: "freeipa-users at redhat.com"
>>>>>>>> >>>>>> <freeipa-users at redhat.com>
>>>>>>>> >>>>>>>> > >> >> Date: 04.08.2015 13:32
>>>>>>>> >>>>>>>> > >> >> Subject: Re: [Freeipa-users] Ubuntu Samba
>>>>>>>> >>>>>>>> > Server
>>>>>>>> >>>>> Auth
>>>>>>>> >>>>>>>> > against
>>>>>>>> >>>>>>>> > >> IPA
>>>>>>>> >>>>>>>> > >> >>
>>>>>>>> >>>>>>>> > >> >>
>>>>>>>> >>>>>>>> > >> >>
>>>>>>>> >>>>>>>> > >> >> Hi Chris,
>>>>>>>> >>>>>>>> > >> >>
>>>>>>>> >>>>>>>> > >> >> Thanks for the heads up, indeed local is 4 I see
>>>> now
>>>>>>>> >> when
>>>>>>>> >>>> I
>>>>>>>> >>>>>>>> > add a
>>>>>>>> >>>>>>>> > >> >> group from the GUI, great thanks!
>>>>>>>> >>>>>>>> > >> >>
>>>>>>>> >>>>>>>> > >> >> But do you use Directory Manager as ldap admin
>>>> user
>>>>>>>> >>>>>>>> > or
>>>>>>>> >>>> some
>>>>>>>> >>>>>>>> > other
>>>>>>>> >>>>>>>> > >> >> admin account ?
>>>>>>>> >>>>>>>> > >> >>
>>>>>>>> >>>>>>>> > >> >> I'm not sure id DM is needed and it should get
>>>> that
>>>>>>>> >>>>>>>> > deep
>>>>>>>> >>>>>> into
>>>>>>>> >>>>>>>> > IPA.
>>>>>>>> >>>>>>>> > >> >> Also when starting samba it cannot find "such
>>>> user"
>>>>>>>> >>>>>>>> > as
>>>>>>>> >>>> that
>>>>>>>> >>>>>>>> > sounds
>>>>>>>> >>>>>>>> > >> >> quite known as it has no UID.
>>>>>>>> >>>>>>>> > >> >>
>>>>>>>> >>>>>>>> > >> >> From your config I see you use DM, this should
>>>> work ?
>>>>>>>> >>>>>>>> > >> >>
>>>>>>>> >>>>>>>> > >> >> Thanks!
>>>>>>>> >>>>>>>> > >> >>
>>>>>>>> >>>>>>>> > >> >>
>>>>>>>> >>>>>>>> > >> >> Matt
>>>>>>>> >>>>>>>> > >> >>
>>>>>>>> >>>>>>>> > >> >>
>>>>>>>> >>>>>>>> > >> >
>>>>>>>> >>>>>>>> > >> >
>>>>>>>> >>>>>>>> > >> >
>>>>>>>> >>>>>>>> > >> >
>>>>>>>> >>>>>>>> > >>
>>>>>>>> >>>>>>>> > >> --
>>>>>>>> >>>>>>>> > >> Manage your subscription for the Freeipa-users
>>>> mailing
>>>>>>>> >> list:
>>>>>>>> >>>>>>>> > >>
>>>> https://www.redhat.com/mailman/listinfo/freeipa-users
>>>>>>>> >>>>>>>> > >> Go to http://freeipa.org for more info on the
>>>> project
>>>>>>>> >>>>>>>> > >>
>>>>>>>> >>>>>>>> > >>
>>>>>>>> >>>>>>>> > >>
>>>>>>>> >>>>>>>> > >
>>>>>>>> >>>>>>>> > >
>>>>>>>> >>>>>>>> > >
>>>>>>>> >>>>>>>> > >
>>>>>>>> >>>>>>>> > > --
>>>>>>>> >>>>>>>> > > Manage your subscription for the Freeipa-users mailing
>>>>>>>> >>>>>>>> > list:
>>>>>>>> >>>>>>>> > > https://www.redhat.com/mailman/listinfo/freeipa-users
>>>>>>>> >>>>>>>> > > Go to http://freeipa.org for more info on the project
>>>>>>>> >>>>>>>> > >
>>>>>>>> >>>>>>>> > >
>>>>>>>> >>>>>>>> > >
>>>>>>>> >>>>>>>> > >
>>>>>>>> >>>>>>>> >
>>>>>>>> >>>>>>>> > --
>>>>>>>> >>>>>>>> > Manage your subscription for the Freeipa-users mailing
>>>> list:
>>>>>>>> >>>>>>>> > https://www.redhat.com/mailman/listinfo/freeipa-users
>>>>>>>> >>>>>>>> > Go to http://freeipa.org for more info on the project
>>>>>>>> >>>>>>>> >
>>>>>>>> >>>>>>>> >
>>>>>>>> >>>>>>>> >
>>>>>>>> >>>>>>>
>>>>>>>> >>>>>>>
>>>>>>>> >>>>>>
>>>>>>>> >>>>>>
>>>>>>>> >>>>>>
>>>>>>>> >>>>>>
>>>>>>>> >>>>>
>>>>>>>> >>>>>
>>>>>>>> >>>>>
>>>>>>>> >>>>>
>>>>>>>> >>>>
>>>>>>>> >>>>
>>>>>>>> >>>>
>>>>>>>> >>>>
>>>>>>>> >>>
>>>>>>>> >>>
>>>>>>>> >>>
>>>>>>>> >>>
>>>>>>>> >>
>>>>>>>> >>
>>>>>>>> >>
>>>>>>>> >>
>>>>>>>
>>>>>>>
>>>>
>>>>
>>>>
>>>>
More information about the Freeipa-users
mailing list