Hi Chris, OK, than we might create two different versions of the wiki, I think this is nice.
I'm still figuring out why I get that: IPA Error 4205: ObjectclassViolation missing attribute "sambaGroupType" required by object class "sambaGroupMapping" Matt 2015-08-06 16:09 GMT+02:00 Christopher Lamb <christopher.l...@ch.ibm.com>: > Hi Matt > > As far as I can make out, there are at least 2 viable Samba / FreeIPA > integration paths. > > The route I took is suited where there is no Active Directory involved: In > my case all the Windows, OSX and Linux clients are islands that sit on the > same network. > > The route that Youenn has taken (unless I have got completely the wrong end > of the stick) requires Active Directory in the architecture. > > Chris > > > > From: "Matt ." <yamakasi....@gmail.com> > To: Youenn PIOLET <piole...@gmail.com> > Cc: Christopher Lamb/Switzerland/IBM@IBMCH, > "freeipa-users@redhat.com" <freeipa-users@redhat.com> > Date: 06.08.2015 14:42 > Subject: Re: [Freeipa-users] Ubuntu Samba Server Auth against IPA > > > > Hi, > > OK, this sounds already quite logical, but I'm still refering to the > old howto we found earlier, does that one still apply somewhere or not > at all ? > > Thanks, > > Matt > > > > 2015-08-06 12:23 GMT+02:00 Youenn PIOLET <piole...@gmail.com>: >> Hey guys, >> >> I'll try to make a tutorial soon, sorry I'm quite in a rush these days :) >> >> General idea: >> >> On FreeIPA (4.1) >> - `ipa-adtrust-install --add-sids` (creates ipaNTsecurityidentifier >> attribude, also known as SID) >> - regenerate each user password to build ipaNTHash attribute, not here by >> default on users >> - use your ldap browser to check ipaNTHash values are here on user > objects >> - create a CIFS service for your samba server >> - Create user roles/permissions as described here: >> > http://freeipa-users.redhat.narkive.com/ez2uKpFS/authenticate-samba-3-or-4-with-freeipa > >> so that CIFS service will be able to read ipaNTsecurityidentifier and >> ipaNTHash attributes in LDAP (ACI) >> - SCP ipasam.so module to your cifs server (this is the magic trick) : > scp >> /usr/lib64/samba/pdb/ipasam.so >> root@samba-server.domain:/usr/lib64/samba/pdb/ You can also try to > recompile >> it. >> >> On SAMBA Server side (CentOS 7...) >> - Install server keytab file for CIFS >> - check ipasam.so is here. >> - check you can read password hash in LDAP with `ldapsearch -Y GSSAPI >> uid=admin ipaNTHash` thanks to kerberos >> - make your smb.conf following the linked thread and restart service >> >> I don't know if it works in Ubuntu. I know sssd has evolved quickly and >> ipasam may use quite recent functionalities, the best is to just try. You >> can read in previous thread : "If you insist on Ubuntu you need to get >> ipasam somewhere, most likely to compile it yourself". >> >> Make sure your user has ipaNTHash attribute :) >> >> You may want to debug authentication on samba server, I usually do this: >> `tail -f /var/log/samba/log* | grep <username> >> >> Cheers >> -- >> Youenn Piolet >> piole...@gmail.com >> >> >> 2015-08-05 17:40 GMT+02:00 Matt . <yamakasi....@gmail.com>: >>> >>> Hi, >>> >>> This sounds great to me too, but a howto would help to make it more >>> clear about what you have done here. The thread confuses me a little >>> bit. >>> >>> Can you paste your commands so we can test out too and report back ? >>> >>> Thanks! >>> >>> Matt >>> >>> 2015-08-05 15:18 GMT+02:00 Christopher Lamb > <christopher.l...@ch.ibm.com>: >>> > Hi Youenn >>> > >>> > Good news that you have got an integration working >>> > >>> > Now you have got it going, and the solution is fresh in your mind, how >>> > about adding a How-to page on this solution to the FreeIPA wiki? >>> > >>> > Chris >>> > >>> > >>> > >>> > From: Youenn PIOLET <piole...@gmail.com> >>> > To: "Matt ." <yamakasi....@gmail.com> >>> > Cc: Christopher Lamb/Switzerland/IBM@IBMCH, >>> > "freeipa-users@redhat.com" <freeipa-users@redhat.com> >>> > Date: 05.08.2015 14:51 >>> > Subject: Re: [Freeipa-users] Ubuntu Samba Server Auth against > IPA >>> > >>> > >>> > >>> > Hi guys, >>> > >>> > Thank you so much your previous answers. >>> > I realised my SID were stored in ipaNTsecurityidentifier, thanks to >>> > ipa-adtrust-install --add-sids >>> > >>> > I found an other way to configure smb here: >>> > >>> > > http://freeipa-users.redhat.narkive.com/ez2uKpFS/authenticate-samba-3-or-4-with-freeipa > >>> > It works perfectly. >>> > >>> > I'm using module ipasam.so I have manually scp to the samba server, >>> > Samba is set to use kerberos + ldapsam via this ipasam module. >>> > Following the instructions, I created a user role allowing service >>> > principal to read ipaNTHash value from the LDAP. >>> > ipaNTHash are generated each time a user changes his password. >>> > Authentication works perfectly on Windows 7, 8 and 10. >>> > >>> > For more details, the previously linked thread is quite clear. >>> > >>> > Cheers >>> > >>> > -- >>> > Youenn Piolet >>> > piole...@gmail.com >>> > >>> > >>> > 2015-08-05 11:10 GMT+02:00 Matt . <yamakasi....@gmail.com>: >>> > Hi Chris. >>> > >>> > Yes, Apache Studio did that but I was not sure why it complained it >>> > was "already" there. >>> > >>> > I'm still getting: >>> > >>> > IPA Error 4205: ObjectclassViolation >>> > >>> > missing attribute "sambaGroupType" required by object class >>> > "sambaGroupMapping" >>> > >>> > When adding a user. >>> > >>> > I also see "class" as fielname under my "Last name", this is not OK >>> > also. >>> > >>> > >>> > >>> > We sure need to make some howto, I think we can nail this down :) >>> > >>> > Thanks for the heads up! >>> > >>> > Matthijs >>> > >>> > 2015-08-05 7:51 GMT+02:00 Christopher Lamb >>> > <christopher.l...@ch.ibm.com>: >>> > > Hi Matt >>> > > >>> > > If I use Apache Directory Studio to add an attribute > ipaCustomFields >>> > to >>> > > cn=ipaConfig,cn=etc, the operation it performs is a modify, as > shown >>> > below: >>> > > >>> > > #!RESULT OK >>> > > #!CONNECTION ldap://xxx-ldap2.my.silly.example.com:yyy >>> > > #!DATE 2015-08-05T05:45:04.608 >>> > > dn: cn=ipaConfig,cn=etc,dc=my,dc=silly,dc=example,dc=com >>> > > changetype: modify >>> > > add: ipaCustomFields >>> > > ipaCustomFields: Samba Group Type,sambagrouptype,true >>> > > >>> > > After that I then have a visible attribute ipaCustomFields as >>> > expected. >>> > > >>> > > When adding the attribute, the wizard offered me "ipaCustomFields" >>> > as >>> > > attribute type in a drop down list. >>> > > >>> > > Once we get this cracked, we really must write a how-to on the >>> > FreeIPA >>> > > Wiki. >>> > > >>> > > Chris >>> > > >>> > > >>> > > >>> > > From: Christopher Lamb/Switzerland/IBM@IBMCH >>> > > To: "Matt ." <yamakasi....@gmail.com> >>> > > Cc: "freeipa-users@redhat.com" <freeipa-users@redhat.com> >>> > > Date: 05.08.2015 07:31 >>> > > Subject: Re: [Freeipa-users] Ubuntu Samba Server Auth > against >>> > IPA >>> > > Sent by: freeipa-users-boun...@redhat.com >>> > > >>> > > >>> > > >>> > > Hi Matt >>> > > >>> > > I also got the same result at that step, but can see nothing in >>> > Apache >>> > > Directory Studio. >>> > > >>> > > As I am using existing Samba / FreeIPA groups migrated across, > they >>> > > probably were migrated with all the required attributes. >>> > > >>> > > Looking more closely at that LDIF: I wonder should it not be: >>> > > >>> > > ldapmodify -Y GSSAPI <<EOF >>> > > dn: cn=ipaconfig,cn=etc,dc=domain,dc=tld >>> > > changetype: modify >>> > > add: ipaCustomFields >>> > > ipaCustomFields: "Samba Group Type,sambagrouptype,true" >>> > > EOF >>> > > >>> > > i.e. changetype: modify, instead of changetype add ? >>> > > >>> > > I don't want to play around with my prod directory - I will setup > an >>> > EL >>> > 7.1 >>> > > VM and install FreeIPA 4.x and Samba 4.x That will allow me to > play >>> > around >>> > > more destructively. >>> > > >>> > > Chris >>> > > >>> > > >>> > > >>> > > >>> > > >>> > > From: "Matt ." <yamakasi....@gmail.com> >>> > > To: Christopher Lamb/Switzerland/IBM@IBMCH >>> > > Cc: Youenn PIOLET <piole...@gmail.com>, " >>> > freeipa-users@redhat.com" >>> > > <freeipa-users@redhat.com> >>> > > Date: 05.08.2015 01:01 >>> > > Subject: Re: [Freeipa-users] Ubuntu Samba Server >>> > Auth >>> > against IPA >>> > > >>> > > >>> > > >>> > > Hi Chris, >>> > > >>> > > I'm at the right path, but my issue is that: >>> > > >>> > > ldapmodify -Y GSSAPI <<EOF >>> > > dn: cn=ipaconfig,cn=etc,dc=domain,dc=tld >>> > > changetype: add >>> > > add: ipaCustomFields >>> > > ipaCustomFields: "Samba Group Type,sambagrouptype,true" >>> > > EOF >>> > > >>> > > Does say it exists, my ldap explorer doesn't show it, and when I > add >>> > > it manually as an attribute it still fails when I add a user on > this >>> > > sambagrouptype as it's needed by the other attributes >>> > > >>> > > So that is my issue I think so far. >>> > > >>> > > Any clue about that ? >>> > > >>> > > No problem "you don't know something or are no guru" we are all >>> > > learning! :) >>> > > >>> > > Cheers, >>> > > >>> > > Matt >>> > > >>> > > >>> > > 2015-08-04 21:22 GMT+02:00 Christopher Lamb < >>> > christopher.l...@ch.ibm.com>: >>> > >> Hi Matt, Youeen >>> > >> >>> > >> Just to set the background properly, I did not invent this > process. >>> > I >>> > > know >>> > >> only a little about FreeIPA, and almost nothing about Samba, but > I >>> > guess >>> > > I >>> > >> was lucky enough to get the integration working on a Sunday >>> > afternoon. >>> > (I >>> > >> did have an older FreeIPA 3.x / Samba 3.x installation as a >>> > reference). >>> > >> >>> > >> It sounds like we need to step back, and look at the test user > and >>> > group >>> > > in >>> > >> the FreeIPA LDAP tree. I find using an LDAP browser makes this > much >>> > > easier. >>> > >> >>> > >> My FreeIPA / Samba Users have the following Samba extensions in >>> > FreeIPA >>> > >> (cn=accounts, cn=users): >>> > >> >>> > >> * objectClass: sambasamaccount >>> > >> >>> > >> * Attributes: sambaSID, sambaNTPassword, sambaPwdLastSet >>> > >> >>> > >> My FreeIPA / Samba Groups have the following Samba extensions in >>> > FreeIPA >>> > >> (cn=accounts, cn=groups): >>> > >> >>> > >> * objectClass: sambaGroupMapping >>> > >> >>> > >> * Attributes: sambaGroupType, sambaSID >>> > >> >>> > >> The Users must belong to one or more of the samba groups that you >>> > have >>> > >> setup. >>> > >> >>> > >> If you don't have something similar to the above (which sounds > like >>> > it >>> > is >>> > >> the case), then something went wrong applying the extensions. It >>> > would >>> > be >>> > >> worth testing comparing a new user / group created post adding > the >>> > >> extensions to a previous existing user. >>> > >> >>> > >> i.e. >>> > >> are the extensions missing on existing users / groups? >>> > >> are the extensions missing on new users / groups? >>> > >> >>> > >> Cheers >>> > >> >>> > >> Chris >>> > >> >>> > >> >>> > >> >>> > >> >>> > >> >>> > >> From: Youenn PIOLET <piole...@gmail.com> >>> > >> To: "Matt ." <yamakasi....@gmail.com> >>> > >> Cc: Christopher Lamb/Switzerland/IBM@IBMCH, >>> > >> "freeipa-users@redhat.com" <freeipa-users@redhat.com> >>> > >> Date: 04.08.2015 18:56 >>> > >> Subject: Re: [Freeipa-users] Ubuntu Samba Server Auth >>> > against >>> > IPA >>> > >> >>> > >> >>> > >> >>> > >> Hi there, >>> > >> >>> > >> I have difficulties to follow you at this point :) >>> > >> Here is what I've done and what I've understood: >>> > >> >>> > >> ## SMB Side >>> > >> - Testparm OK >>> > >> - I've got the same NT_STATUS_NO_SUCH_USER when I try to connect. >>> > >> - pdbedit -Lv output is all successfull but I can see there is a >>> > filter : >>> > >> (&(uid=*)(objectclass=sambaSamAccount). In LDAP, the users don't >>> > have >>> > >> sambaSamAccount. >>> > >> >>> > >> ## LDAP / FreeIPA side >>> > >> - Since SMB server uses LDAP, I did ipa-adtrust-install on my >>> > FreeIPA >>> > >> server to get samba LDAP extensions. >>> > >> - I can see samba classes exist in LDAP but are not used on my >>> > group >>> > >> objects nor my user objects >>> > >> - I have add sambaSamAccount in FreeIPA default user classes, >>> > >> and sambaGroupMapping to default group classes. In that state I >>> > can't >>> > >> create user nor groups anymore, as new samba attributes are > needed >>> > for >>> > >> instantiation. >>> > >> - I have add in etc ipaCustomFields: 'Samba Group >>> > > Type,sambagrouptype,true' >>> > >> but I don't get what it does. >>> > >> - I tried to add the samba.js plugin. It works, and adds the >>> > "local" >>> > > option >>> > >> when creating a group in FreeIPA, supposed to set sambagrouptype > to >>> > 4 >>> > or >>> > > 2 >>> > >> (domain). It doesn't work and tells that sambagrouptype attribute >>> > doesn't >>> > >> exist (but it should now I put sambaGroupType class by > default...) >>> > >> >>> > >> ## Questions >>> > >> 0) Can I ask samba not to search sambaSamAccount and use unix / >>> > posix >>> > >> instead? I guess no. >>> > >> 1) How to generate the user/group SIDs ? They are requested to > add >>> > >> sambaSamAccount classes. >>> > >> This article doesn't seem relevant since we don't use domain >>> > controller >>> > >> >>> > > >>> > >>> > > http://docs.fedoraproject.org/en-US/Fedora/17/html/FreeIPA_Guide/cifs.html >>> > >>> > >> and netgetlocalsid returns an error. >>> > >> 2) How to fix samba.js plugin? >>> > >> 3) I guess an equivalent of samba.js is needed for user creation, >>> > where >>> > > can >>> > >> I find it? >>> > >> 4) Is your setup working with Windows 8 / Windows 10 and not only >>> > Windows >>> > >> 7? >>> > >> >>> > >> Thanks a lot for your previous and future answers >>> > >> >>> > >> -- >>> > >> Youenn Piolet >>> > >> piole...@gmail.com >>> > >> >>> > >> >>> > >> 2015-08-04 17:55 GMT+02:00 Matt . <yamakasi....@gmail.com>: >>> > >> Hi, >>> > >> >>> > >> Yes, log is anonymised. >>> > >> >>> > >> It's strange, my user doesn't have a SambaPwdLastSet, also when > I >>> > >> change it's password it doesn't get it in ldap. >>> > >> >>> > >> There must be something going wrong I guess. >>> > >> >>> > >> Matt >>> > >> >>> > >> 2015-08-04 17:45 GMT+02:00 Christopher Lamb >>> > > <christopher.l...@ch.ibm.com >>> > >> >: >>> > >> > Hi Matt >>> > >> > >>> > >> > I assume [username] is a real username, identical to that in >>> > the >>> > >> FreeIPA >>> > >> > cn=accounts, cn=users tree? (i.e. you anonymised the log >>> > extract). >>> > >> > >>> > >> > You user should be a member of the appropriate samba groups >>> > that >>> > you >>> > >> setup >>> > >> > in FreeIPA. >>> > >> > >>> > >> > You should check that the user attribute SambaPwdLastSet is > set >>> > to >>> > a >>> > >> > positive value (e.g. 1). If not you get an error in the Samba >>> > logs >>> > - >>> > > I >>> > >> > would need to play around again with a test user to find out >>> > the >>> > > exact >>> > >> > error. >>> > >> > >>> > >> > I don't understand what you mean about syncing the users > local, >>> > but >>> > > we >>> > >> did >>> > >> > not need to do anything like that. >>> > >> > >>> > >> > Chris >>> > >> > >>> > >> > >>> > >> > >>> > >> > >>> > >> > From: "Matt ." <yamakasi....@gmail.com> >>> > >> > To: Christopher Lamb/Switzerland/IBM@IBMCH >>> > >> > Cc: "freeipa-users@redhat.com" <freeipa-users@redhat.com> >>> > >> > Date: 04.08.2015 15:33 >>> > >> > Subject: Re: [Freeipa-users] Ubuntu Samba Server Auth >>> > against >>> > >> IPA >>> > >> > >>> > >> > >>> > >> > >>> > >> > Hi Chris, >>> > >> > >>> > >> > A puppet run added another passdb backend, that was causing > my >>> > issue. >>> > >> > >>> > >> > What I still experience is: >>> > >> > >>> > >> > >>> > >> > [2015/08/04 15:29:45.477783, 3] >>> > >> > ../source3/auth/check_samsec.c:399(check_sam_security) >>> > >> > check_sam_security: Couldn't find user 'username' in > passdb. >>> > >> > [2015/08/04 15:29:45.478026, 2] >>> > >> > ../source3/auth/auth.c:288(auth_check_ntlm_password) >>> > >> > check_ntlm_password: Authentication for user [username] -> >>> > >> > [username] FAILED with error NT_STATUS_NO_SUCH_USER >>> > >> > >>> > >> > >>> > >> > I also wonder if I shall still sync the users local, or is it >>> > > needed ? >>> > >> > >>> > >> > Thanks again, >>> > >> > >>> > >> > Matt >>> > >> > >>> > >> > 2015-08-04 14:16 GMT+02:00 Christopher Lamb < >>> > >> christopher.l...@ch.ibm.com>: >>> > >> >> Hi Matt >>> > >> >> >>> > >> >> From our smb.conf file: >>> > >> >> >>> > >> >> [global] >>> > >> >> security = user >>> > >> >> passdb backend = >>> > ldapsam:ldap://xxx-ldap2.my.silly.example.com >>> > >> >> ldap suffix = dc=my,dc=silly,dc=example,dc=com >>> > >> >> ldap admin dn = cn=Directory Manager >>> > >> >> >>> > >> >> So yes, we use Directory Manager, it works for us. I have > not >>> > tried >>> > >> with >>> > >> > a >>> > >> >> less powerful user, but it is conceivable that a lesser user >>> > may >>> > not >>> > >> see >>> > >> >> all the required attributes, resulting in "no such user" >>> > errors. >>> > >> >> >>> > >> >> Chris >>> > >> >> >>> > >> >> >>> > >> >> >>> > >> >> >>> > >> >> From: "Matt ." <yamakasi....@gmail.com> >>> > >> >> To: Christopher Lamb/Switzerland/IBM@IBMCH >>> > >> >> Cc: "freeipa-users@redhat.com" > <freeipa-users@redhat.com> >>> > >> >> Date: 04.08.2015 13:32 >>> > >> >> Subject: Re: [Freeipa-users] Ubuntu Samba Server Auth >>> > against >>> > >> IPA >>> > >> >> >>> > >> >> >>> > >> >> >>> > >> >> Hi Chris, >>> > >> >> >>> > >> >> Thanks for the heads up, indeed local is 4 I see now when I >>> > add a >>> > >> >> group from the GUI, great thanks! >>> > >> >> >>> > >> >> But do you use Directory Manager as ldap admin user or some >>> > other >>> > >> >> admin account ? >>> > >> >> >>> > >> >> I'm not sure id DM is needed and it should get that deep > into >>> > IPA. >>> > >> >> Also when starting samba it cannot find "such user" as that >>> > sounds >>> > >> >> quite known as it has no UID. >>> > >> >> >>> > >> >> From your config I see you use DM, this should work ? >>> > >> >> >>> > >> >> Thanks! >>> > >> >> >>> > >> >> >>> > >> >> Matt >>> > >> >> >>> > >> >> >>> > >> > >>> > >> > >>> > >> > >>> > >> > >>> > >> >>> > >> -- >>> > >> Manage your subscription for the Freeipa-users mailing list: >>> > >> https://www.redhat.com/mailman/listinfo/freeipa-users >>> > >> Go to http://freeipa.org for more info on the project >>> > >> >>> > >> >>> > >> >>> > > >>> > > >>> > > >>> > > >>> > > -- >>> > > Manage your subscription for the Freeipa-users mailing list: >>> > > https://www.redhat.com/mailman/listinfo/freeipa-users >>> > > Go to http://freeipa.org for more info on the project >>> > > >>> > > >>> > > >>> > > >>> > >>> > -- >>> > Manage your subscription for the Freeipa-users mailing list: >>> > https://www.redhat.com/mailman/listinfo/freeipa-users >>> > Go to http://freeipa.org for more info on the project >>> > >>> > >>> > >> >> > > > > -- Manage your subscription for the Freeipa-users mailing list: https://www.redhat.com/mailman/listinfo/freeipa-users Go to http://freeipa.org for more info on the project