Hi Youenn,

OK thanks! this takes me a little but futher now and I see some good
stuff in my logging.

I'm testing on a Windows 10 Machine which is not member of an AD or
so, so that might be my issue for now ?

When testing on the samba box itself as my user I get:


[myusername@smb-01 ~]$ smbclient //smb-01.domain.local/shares

...
Checking NTLMSSP password for MSP\myusername failed: NT_STATUS_WRONG_PASSWORD
...
SPNEGO login failed: NT_STATUS_WRONG_PASSWORD


Maybe I have an issue with encrypted passwords ?


When we have this all working, I think we have a howto :D

Thanks!

Matt

2015-08-13 10:53 GMT+02:00 Youenn PIOLET <piole...@gmail.com>:
> Hi Matt
>
> - CentOS : Did you copy ipasam.so and change your smb.conf accordingly?
> sambaSamAccount is not needed anymore that way.
> - Default IPA Way : won't work if your Windows is not part of a domain
> controller. DOMAIN\username may work for some users using Windows 7 - not 8
> nor 10 (it did for me but I was the only one at the office... quite useless)
>
> This config may work on your CentOS (for the ipasam way):
> workgroup = TEST
> realm = TEST.NET
> kerberos method = dedicated keytab
> dedicated keytab file = FILE:/<.....>/samba.keytab
> create krb5 conf = no
> security = user
> encrypt passwords = true
> passdb backend = ipasam:ldaps://youripa.test.net
> ldapsam:trusted = yes
> ldapsuffix = test.net
> ldap user suffix = cn=users,cn=accounts
> ldap group suffix = cn=groups,cn=accounts
>
>
> --
> Youenn Piolet
> piole...@gmail.com
>
>
> 2015-08-12 22:15 GMT+02:00 Matt . <yamakasi....@gmail.com>:
>>
>> Hi,
>>
>> OK the default IPA way works great actually when testing it as described
>> here:
>>
>> http://www.freeipa.org/page/Howto/Integrating_a_Samba_File_Server_With_IPA
>>
>> On the samba server I can auth and see my share where I want to connect
>> to.
>>
>> The issue is, on Windows I cannot auth, even when I do DOMAIN\username
>> as username
>>
>> So, the IPA way should work.
>>
>> Any comments here ?
>>
>> Cheers,
>>
>> Matt
>>
>> 2015-08-12 19:00 GMT+02:00 Matt . <yamakasi....@gmail.com>:
>> > HI GUys,
>> >
>> > I'm testing this out and I think I almost setup, this on a CentOS samba
>> > server.
>> >
>> > I'm using the ipa-adtrust way of Youeen but it seems we still need to
>> > add (objectclass=sambaSamAccount)) ?
>> >
>> > Info is welcome!
>> >
>> > I will report back when I have it working.
>> >
>> > Thanks!
>> >
>> > Matt
>> >
>> > 2015-08-10 11:16 GMT+02:00 Christopher Lamb
>> > <christopher.l...@ch.ibm.com>:
>> >> The next route I will try - is the one Youeen took, using ipa-adtrust
>> >>
>> >>
>> >>
>> >> From:   "Matt ." <yamakasi....@gmail.com>
>> >> To:     Christopher Lamb/Switzerland/IBM@IBMCH,
>> >>             "freeipa-users@redhat.com" <freeipa-users@redhat.com>
>> >> Date:   10.08.2015 10:03
>> >> Subject:        Re: [Freeipa-users] Ubuntu Samba Server Auth against
>> >> IPA
>> >>
>> >>
>> >>
>> >> Hi Chris,
>> >>
>> >> Okay this is good to hear.
>> >>
>> >> But don't we want a IPA managed Scheme ?
>> >>
>> >> When I did a "ipa-adtrust-install --add-sids" it also wanted a local
>> >> installed Samba and I wonder why.
>> >>
>> >> Good that we make some progres on making it all clear.
>> >>
>> >> Cheers,
>> >>
>> >> Matt
>> >>
>> >> 2015-08-10 6:12 GMT+02:00 Christopher Lamb
>> >> <christopher.l...@ch.ibm.com>:
>> >>> ldapsam + the samba extensions, pretty much as described in the
>> >> Techslaves
>> >>> article. Once I have a draft for the wiki page, I will mail you.
>> >>>
>> >>>
>> >>>
>> >>> From:   "Matt ." <yamakasi....@gmail.com>
>> >>> To:     Christopher Lamb/Switzerland/IBM@IBMCH,
>> >>>             "freeipa-users@redhat.com" <freeipa-users@redhat.com>
>> >>> Date:   09.08.2015 21:17
>> >>> Subject:        Re: [Freeipa-users] Ubuntu Samba Server Auth against
>> >>> IPA
>> >>>
>> >>>
>> >>>
>> >>> Hi,
>> >>>
>> >>> Yes I know about "anything" but which way did you use now ?
>> >>>
>> >>>
>> >>>
>> >>> 2015-08-09 20:56 GMT+02:00 Christopher Lamb
>> >> <christopher.l...@ch.ibm.com>:
>> >>>> Hi Matt
>> >>>>
>> >>>> I am on OEL 7.1. - so anything that works on that should be good for
>> >> RHEL
>> >>>> and Centos 7.x
>> >>>>
>> >>>> I intend to add a how-to to the FreeIPA Wiki over the next few days.
>> >>>> As
>> >>> we
>> >>>> have suggested earlier, we will likely end up with several, one for
>> >>>> each
>> >>> of
>> >>>> the possible integration paths.
>> >>>>
>> >>>> Chris
>> >>>>
>> >>>>
>> >>>>
>> >>>>
>> >>>>
>> >>>> From:   "Matt ." <yamakasi....@gmail.com>
>> >>>> To:     Christopher Lamb/Switzerland/IBM@IBMCH,
>> >>>>             "freeipa-users@redhat.com" <freeipa-users@redhat.com>
>> >>>> Date:   09.08.2015 16:45
>> >>>> Subject:        Re: [Freeipa-users] Ubuntu Samba Server Auth against
>> >>>> IPA
>> >>>>
>> >>>>
>> >>>>
>> >>>> Hi Chris,
>> >>>>
>> >>>> This sounds great!
>> >>>>
>> >>>> What are you using now, both CentOS ? So Samba and FreeIPA ?
>> >>>>
>> >>>> Maybe it's good to explain which way you used now in steps too, so we
>> >>>> can combine or create multiple howto's ?
>> >>>>
>> >>>> At least we are going somewhere!
>> >>>>
>> >>>> Thanks,
>> >>>>
>> >>>> Matt
>> >>>>
>> >>>> 2015-08-09 14:54 GMT+02:00 Christopher Lamb
>> >>> <christopher.l...@ch.ibm.com>:
>> >>>>> Hi Matt
>> >>>>>
>> >>>>> My test integration of FreeIPA 4.x and Samba 4.x with the "good old
>> >>> Samba
>> >>>>> Schema extensions) is up and working, almost flawlessly.
>> >>>>>
>> >>>>> I can add users and groups via the FreeIPA CLI, and they get the
>> >> correct
>> >>>>> ObjectClasses / attributes required for Samba.
>> >>>>>
>> >>>>> So far I have not yet bothered to try the extensions to the WebUI,
>> >>>> because
>> >>>>> it is currently giving me the classic "Your session has expired.
>> >>>>> Please
>> >>>>> re-login." error which renders the WebUI useless.
>> >>>>>
>> >>>>> The only problem I have so far encountered managing Samba / FreeIPA
>> >>> users
>> >>>>> via FreeIPA CLI commands is with the handling of the attribute
>> >>>>> sambaPwdLastSet. This is the subject of an existing thread, also
>> >> updated
>> >>>>> today.
>> >>>>>
>> >>>>> There is also an existing alternative to hacking group.py, using
>> >>>>> "Class
>> >>>> of
>> >>>>> Service" (Cos) documented in this thread from February 2015
>> >>>>>
>> >>>
>> >>> https://www.redhat.com/archives/freeipa-users/2015-February/msg00172.html
>> >>>> .
>> >>>>> I have not yet tried it, but it sounds reasonable.
>> >>>>>
>> >>>>> Chris
>> >>>>>
>> >>>>>
>> >>>>>
>> >>>>>
>> >>>>>
>> >>>>> From:   "Matt ." <yamakasi....@gmail.com>
>> >>>>> To:     Christopher Lamb/Switzerland/IBM@IBMCH
>> >>>>> Cc:     "freeipa-users@redhat.com" <freeipa-users@redhat.com>,
>> >>>>> Youenn
>> >>>>>             PIOLET <piole...@gmail.com>
>> >>>>> Date:   06.08.2015 16:19
>> >>>>> Subject:        Re: [Freeipa-users] Ubuntu Samba Server Auth against
>> >> IPA
>> >>>>>
>> >>>>>
>> >>>>>
>> >>>>> Hi Chris,
>> >>>>>
>> >>>>> OK, than we might create two different versions of the wiki, I think
>> >>>>> this is nice.
>> >>>>>
>> >>>>> I'm still figuring out why I get that:
>> >>>>>
>> >>>>> IPA Error 4205: ObjectclassViolation
>> >>>>>
>> >>>>> missing attribute "sambaGroupType" required by object class
>> >>>>> "sambaGroupMapping"
>> >>>>>
>> >>>>> Matt
>> >>>>>
>> >>>>> 2015-08-06 16:09 GMT+02:00 Christopher Lamb
>> >>>> <christopher.l...@ch.ibm.com>:
>> >>>>>> Hi Matt
>> >>>>>>
>> >>>>>> As far as I can make out, there are at least 2 viable Samba /
>> >>>>>> FreeIPA
>> >>>>>> integration paths.
>> >>>>>>
>> >>>>>> The route I took is suited where there is no Active Directory
>> >> involved:
>> >>>>> In
>> >>>>>> my case all the Windows, OSX and Linux clients are islands that sit
>> >>>>>> on
>> >>>>> the
>> >>>>>> same network.
>> >>>>>>
>> >>>>>> The route that Youenn has taken (unless I have got completely the
>> >> wrong
>> >>>>> end
>> >>>>>> of the stick) requires Active Directory in the architecture.
>> >>>>>>
>> >>>>>> Chris
>> >>>>>>
>> >>>>>>
>> >>>>>>
>> >>>>>> From:   "Matt ." <yamakasi....@gmail.com>
>> >>>>>> To:     Youenn PIOLET <piole...@gmail.com>
>> >>>>>> Cc:     Christopher Lamb/Switzerland/IBM@IBMCH,
>> >>>>>>             "freeipa-users@redhat.com" <freeipa-users@redhat.com>
>> >>>>>> Date:   06.08.2015 14:42
>> >>>>>> Subject:        Re: [Freeipa-users] Ubuntu Samba Server Auth
>> >>>>>> against
>> >>> IPA
>> >>>>>>
>> >>>>>>
>> >>>>>>
>> >>>>>> Hi,
>> >>>>>>
>> >>>>>> OK, this sounds already quite logical, but I'm still refering to
>> >>>>>> the
>> >>>>>> old howto we found earlier, does that one still apply somewhere or
>> >>>>>> not
>> >>>>>> at all ?
>> >>>>>>
>> >>>>>> Thanks,
>> >>>>>>
>> >>>>>> Matt
>> >>>>>>
>> >>>>>>
>> >>>>>>
>> >>>>>> 2015-08-06 12:23 GMT+02:00 Youenn PIOLET <piole...@gmail.com>:
>> >>>>>>> Hey guys,
>> >>>>>>>
>> >>>>>>> I'll try to make a tutorial soon, sorry I'm quite in a rush these
>> >>>>> days :)
>> >>>>>>>
>> >>>>>>> General idea:
>> >>>>>>>
>> >>>>>>> On FreeIPA (4.1)
>> >>>>>>> - `ipa-adtrust-install --add-sids` (creates
>> >>>>>>> ipaNTsecurityidentifier
>> >>>>>>> attribude, also known as SID)
>> >>>>>>> - regenerate each user password to build ipaNTHash attribute, not
>> >> here
>> >>>>> by
>> >>>>>>> default on users
>> >>>>>>> - use your ldap browser to check ipaNTHash values are here on user
>> >>>>>> objects
>> >>>>>>> - create a CIFS service for your samba server
>> >>>>>>> - Create user roles/permissions as described here:
>> >>>>>>>
>> >>>>>>
>> >>>>>
>> >>>>
>> >>>
>> >>
>> >> http://freeipa-users.redhat.narkive.com/ez2uKpFS/authenticate-samba-3-or-4-with-freeipa
>> >>
>> >>>
>> >>>>
>> >>>>>
>> >>>>>>
>> >>>>>>> so that CIFS service will be able to read ipaNTsecurityidentifier
>> >>>>>>> and
>> >>>>>>> ipaNTHash attributes in LDAP (ACI)
>> >>>>>>> - SCP ipasam.so module to your cifs server (this is the magic
>> >> trick) :
>> >>>>>> scp
>> >>>>>>> /usr/lib64/samba/pdb/ipasam.so
>> >>>>>>> root@samba-server.domain:/usr/lib64/samba/pdb/ You can also try to
>> >>>>>> recompile
>> >>>>>>> it.
>> >>>>>>>
>> >>>>>>> On SAMBA Server side (CentOS 7...)
>> >>>>>>> - Install server keytab file for CIFS
>> >>>>>>> - check ipasam.so is here.
>> >>>>>>> - check you can read password hash in LDAP with `ldapsearch -Y
>> >>>>>>> GSSAPI
>> >>>>>>> uid=admin ipaNTHash` thanks to kerberos
>> >>>>>>> - make your smb.conf following the linked thread and restart
>> >>>>>>> service
>> >>>>>>>
>> >>>>>>> I don't know if it works in Ubuntu. I know sssd has evolved
>> >>>>>>> quickly
>> >>> and
>> >>>>>>> ipasam may use quite recent functionalities, the best is to just
>> >>>>>>> try.
>> >>>>> You
>> >>>>>>> can read in previous thread : "If you insist on Ubuntu you need to
>> >> get
>> >>>>>>> ipasam somewhere, most likely to compile it yourself".
>> >>>>>>>
>> >>>>>>> Make sure your user has ipaNTHash attribute :)
>> >>>>>>>
>> >>>>>>> You may want to debug authentication on samba server, I usually do
>> >>>> this:
>> >>>>>>> `tail -f /var/log/samba/log* | grep <username>
>> >>>>>>>
>> >>>>>>> Cheers
>> >>>>>>> --
>> >>>>>>> Youenn Piolet
>> >>>>>>> piole...@gmail.com
>> >>>>>>>
>> >>>>>>>
>> >>>>>>> 2015-08-05 17:40 GMT+02:00 Matt . <yamakasi....@gmail.com>:
>> >>>>>>>>
>> >>>>>>>> Hi,
>> >>>>>>>>
>> >>>>>>>> This sounds great to me too, but a howto would help to make it
>> >>>>>>>> more
>> >>>>>>>> clear about what you have done here. The thread confuses me a
>> >>>>>>>> little
>> >>>>>>>> bit.
>> >>>>>>>>
>> >>>>>>>> Can you paste your commands so we can test out too and report
>> >>>>>>>> back ?
>> >>>>>>>>
>> >>>>>>>> Thanks!
>> >>>>>>>>
>> >>>>>>>> Matt
>> >>>>>>>>
>> >>>>>>>> 2015-08-05 15:18 GMT+02:00 Christopher Lamb
>> >>>>>> <christopher.l...@ch.ibm.com>:
>> >>>>>>>> > Hi Youenn
>> >>>>>>>> >
>> >>>>>>>> > Good news that you have got an integration working
>> >>>>>>>> >
>> >>>>>>>> > Now you have got it going, and the solution is fresh in your
>> >>>>>>>> > mind,
>> >>>>> how
>> >>>>>>>> > about adding a How-to page on this solution to the FreeIPA
>> >>>>>>>> > wiki?
>> >>>>>>>> >
>> >>>>>>>> > Chris
>> >>>>>>>> >
>> >>>>>>>> >
>> >>>>>>>> >
>> >>>>>>>> > From:   Youenn PIOLET <piole...@gmail.com>
>> >>>>>>>> > To:     "Matt ." <yamakasi....@gmail.com>
>> >>>>>>>> > Cc:     Christopher Lamb/Switzerland/IBM@IBMCH,
>> >>>>>>>> >             "freeipa-users@redhat.com"
>> >>>>>>>> > <freeipa-users@redhat.com>
>> >>>>>>>> > Date:   05.08.2015 14:51
>> >>>>>>>> > Subject:        Re: [Freeipa-users] Ubuntu Samba Server Auth
>> >>> against
>> >>>>>> IPA
>> >>>>>>>> >
>> >>>>>>>> >
>> >>>>>>>> >
>> >>>>>>>> > Hi guys,
>> >>>>>>>> >
>> >>>>>>>> > Thank you so much your previous answers.
>> >>>>>>>> > I realised my SID were stored in ipaNTsecurityidentifier,
>> >>>>>>>> > thanks
>> >> to
>> >>>>>>>> > ipa-adtrust-install --add-sids
>> >>>>>>>> >
>> >>>>>>>> > I found an other way to configure smb here:
>> >>>>>>>> >
>> >>>>>>>> >
>> >>>>>>
>> >>>>>
>> >>>>
>> >>>
>> >>
>> >> http://freeipa-users.redhat.narkive.com/ez2uKpFS/authenticate-samba-3-or-4-with-freeipa
>> >>
>> >>>
>> >>>>
>> >>>>>
>> >>>>>>
>> >>>>>>>> > It works perfectly.
>> >>>>>>>> >
>> >>>>>>>> > I'm using module ipasam.so I have manually scp to the samba
>> >> server,
>> >>>>>>>> > Samba is set to use kerberos + ldapsam via this ipasam module.
>> >>>>>>>> > Following the instructions, I created a user role allowing
>> >>>>>>>> > service
>> >>>>>>>> > principal to read ipaNTHash value from the LDAP.
>> >>>>>>>> > ipaNTHash are generated each time a user changes his password.
>> >>>>>>>> > Authentication works perfectly on Windows 7, 8 and 10.
>> >>>>>>>> >
>> >>>>>>>> > For more details, the previously linked thread is quite clear.
>> >>>>>>>> >
>> >>>>>>>> > Cheers
>> >>>>>>>> >
>> >>>>>>>> > --
>> >>>>>>>> > Youenn Piolet
>> >>>>>>>> > piole...@gmail.com
>> >>>>>>>> >
>> >>>>>>>> >
>> >>>>>>>> > 2015-08-05 11:10 GMT+02:00 Matt . <yamakasi....@gmail.com>:
>> >>>>>>>> >   Hi Chris.
>> >>>>>>>> >
>> >>>>>>>> >   Yes, Apache Studio did that but I was not sure why it
>> >>>>>>>> > complained
>> >>>> it
>> >>>>>>>> >   was "already" there.
>> >>>>>>>> >
>> >>>>>>>> >   I'm still getting:
>> >>>>>>>> >
>> >>>>>>>> >   IPA Error 4205: ObjectclassViolation
>> >>>>>>>> >
>> >>>>>>>> >   missing attribute "sambaGroupType" required by object class
>> >>>>>>>> >   "sambaGroupMapping"
>> >>>>>>>> >
>> >>>>>>>> >   When adding a user.
>> >>>>>>>> >
>> >>>>>>>> >   I also see "class" as fielname under my "Last name", this is
>> >>>>>>>> > not
>> >>>> OK
>> >>>>>>>> > also.
>> >>>>>>>> >
>> >>>>>>>> >
>> >>>>>>>> >
>> >>>>>>>> >   We sure need to make some howto, I think we can nail this
>> >> down :)
>> >>>>>>>> >
>> >>>>>>>> >   Thanks for the heads up!
>> >>>>>>>> >
>> >>>>>>>> >   Matthijs
>> >>>>>>>> >
>> >>>>>>>> >   2015-08-05 7:51 GMT+02:00 Christopher Lamb
>> >>>>>>>> > <christopher.l...@ch.ibm.com>:
>> >>>>>>>> >   > Hi Matt
>> >>>>>>>> >   >
>> >>>>>>>> >   > If I use Apache Directory Studio to add an attribute
>> >>>>>> ipaCustomFields
>> >>>>>>>> > to
>> >>>>>>>> >   > cn=ipaConfig,cn=etc, the operation it performs is a modify,
>> >>>>>>>> > as
>> >>>>>> shown
>> >>>>>>>> >   below:
>> >>>>>>>> >   >
>> >>>>>>>> >   > #!RESULT OK
>> >>>>>>>> >   > #!CONNECTION ldap://xxx-ldap2.my.silly.example.com:yyy
>> >>>>>>>> >   > #!DATE 2015-08-05T05:45:04.608
>> >>>>>>>> >   > dn: cn=ipaConfig,cn=etc,dc=my,dc=silly,dc=example,dc=com
>> >>>>>>>> >   > changetype: modify
>> >>>>>>>> >   > add: ipaCustomFields
>> >>>>>>>> >   > ipaCustomFields: Samba Group Type,sambagrouptype,true
>> >>>>>>>> >   >
>> >>>>>>>> >   > After that I then have a visible attribute ipaCustomFields
>> >>>>>>>> > as
>> >>>>>>>> > expected.
>> >>>>>>>> >   >
>> >>>>>>>> >   > When adding the attribute, the wizard offered me
>> >>>>> "ipaCustomFields"
>> >>>>>>>> > as
>> >>>>>>>> >   > attribute type in a drop down list.
>> >>>>>>>> >   >
>> >>>>>>>> >   > Once we get this cracked, we really must write a how-to on
>> >>>>>>>> > the
>> >>>>>>>> > FreeIPA
>> >>>>>>>> >   > Wiki.
>> >>>>>>>> >   >
>> >>>>>>>> >   > Chris
>> >>>>>>>> >   >
>> >>>>>>>> >   >
>> >>>>>>>> >   >
>> >>>>>>>> >   > From:   Christopher Lamb/Switzerland/IBM@IBMCH
>> >>>>>>>> >   > To:     "Matt ." <yamakasi....@gmail.com>
>> >>>>>>>> >   > Cc:     "freeipa-users@redhat.com"
>> >>>>>>>> > <freeipa-users@redhat.com>
>> >>>>>>>> >   > Date:   05.08.2015 07:31
>> >>>>>>>> >   > Subject:        Re: [Freeipa-users] Ubuntu Samba Server
>> >>>>>>>> > Auth
>> >>>>>> against
>> >>>>>>>> >   IPA
>> >>>>>>>> >   > Sent by:        freeipa-users-boun...@redhat.com
>> >>>>>>>> >   >
>> >>>>>>>> >   >
>> >>>>>>>> >   >
>> >>>>>>>> >   > Hi Matt
>> >>>>>>>> >   >
>> >>>>>>>> >   > I also got the same result at that step, but can see
>> >>>>>>>> > nothing
>> >> in
>> >>>>>>>> > Apache
>> >>>>>>>> >   > Directory Studio.
>> >>>>>>>> >   >
>> >>>>>>>> >   > As I am using existing Samba / FreeIPA groups migrated
>> >>>>>>>> > across,
>> >>>>>> they
>> >>>>>>>> >   > probably were migrated with all the required attributes.
>> >>>>>>>> >   >
>> >>>>>>>> >   > Looking more closely at that LDIF: I wonder should it not
>> >>>>>>>> > be:
>> >>>>>>>> >   >
>> >>>>>>>> >   > ldapmodify -Y GSSAPI <<EOF
>> >>>>>>>> >   > dn: cn=ipaconfig,cn=etc,dc=domain,dc=tld
>> >>>>>>>> >   > changetype: modify
>> >>>>>>>> >   > add: ipaCustomFields
>> >>>>>>>> >   > ipaCustomFields: "Samba Group Type,sambagrouptype,true"
>> >>>>>>>> >   > EOF
>> >>>>>>>> >   >
>> >>>>>>>> >   > i.e. changetype: modify, instead of changetype add ?
>> >>>>>>>> >   >
>> >>>>>>>> >   > I don't want to play around with my prod directory - I will
>> >>>> setup
>> >>>>>> an
>> >>>>>>>> > EL
>> >>>>>>>> >   7.1
>> >>>>>>>> >   > VM and install FreeIPA 4.x and Samba 4.x That will allow me
>> >>>>>>>> > to
>> >>>>>> play
>> >>>>>>>> >   around
>> >>>>>>>> >   > more destructively.
>> >>>>>>>> >   >
>> >>>>>>>> >   > Chris
>> >>>>>>>> >   >
>> >>>>>>>> >   >
>> >>>>>>>> >   >
>> >>>>>>>> >   >
>> >>>>>>>> >   >
>> >>>>>>>> >   > From:            "Matt ." <yamakasi....@gmail.com>
>> >>>>>>>> >   > To:              Christopher Lamb/Switzerland/IBM@IBMCH
>> >>>>>>>> >   > Cc:              Youenn PIOLET <piole...@gmail.com>, "
>> >>>>>>>> >   freeipa-users@redhat.com"
>> >>>>>>>> >   >             <freeipa-users@redhat.com>
>> >>>>>>>> >   > Date:            05.08.2015 01:01
>> >>>>>>>> >   > Subject:                 Re: [Freeipa-users] Ubuntu Samba
>> >>> Server
>> >>>>>>>> > Auth
>> >>>>>>>> >   against IPA
>> >>>>>>>> >   >
>> >>>>>>>> >   >
>> >>>>>>>> >   >
>> >>>>>>>> >   > Hi Chris,
>> >>>>>>>> >   >
>> >>>>>>>> >   > I'm at the right path, but my issue is that:
>> >>>>>>>> >   >
>> >>>>>>>> >   > ldapmodify -Y GSSAPI <<EOF
>> >>>>>>>> >   > dn: cn=ipaconfig,cn=etc,dc=domain,dc=tld
>> >>>>>>>> >   > changetype: add
>> >>>>>>>> >   > add: ipaCustomFields
>> >>>>>>>> >   > ipaCustomFields: "Samba Group Type,sambagrouptype,true"
>> >>>>>>>> >   > EOF
>> >>>>>>>> >   >
>> >>>>>>>> >   > Does say it exists, my ldap explorer doesn't show it, and
>> >>>>>>>> > when
>> >>> I
>> >>>>>> add
>> >>>>>>>> >   > it manually as an attribute it still fails when I add a
>> >>>>>>>> > user
>> >> on
>> >>>>>> this
>> >>>>>>>> >   > sambagrouptype as it's needed by the other attributes
>> >>>>>>>> >   >
>> >>>>>>>> >   > So that is my issue I think so far.
>> >>>>>>>> >   >
>> >>>>>>>> >   > Any clue about that ?
>> >>>>>>>> >   >
>> >>>>>>>> >   > No problem "you don't know something or are no guru" we are
>> >> all
>> >>>>>>>> >   > learning! :)
>> >>>>>>>> >   >
>> >>>>>>>> >   > Cheers,
>> >>>>>>>> >   >
>> >>>>>>>> >   > Matt
>> >>>>>>>> >   >
>> >>>>>>>> >   >
>> >>>>>>>> >   > 2015-08-04 21:22 GMT+02:00 Christopher Lamb <
>> >>>>>>>> >   christopher.l...@ch.ibm.com>:
>> >>>>>>>> >   >> Hi Matt, Youeen
>> >>>>>>>> >   >>
>> >>>>>>>> >   >> Just to set the background properly, I did not invent this
>> >>>>>> process.
>> >>>>>>>> > I
>> >>>>>>>> >   > know
>> >>>>>>>> >   >> only a little about FreeIPA, and almost nothing about
>> >>>>>>>> > Samba,
>> >>>> but
>> >>>>>> I
>> >>>>>>>> >   guess
>> >>>>>>>> >   > I
>> >>>>>>>> >   >> was lucky enough to get the integration working on a
>> >>>>>>>> > Sunday
>> >>>>>>>> > afternoon.
>> >>>>>>>> >   (I
>> >>>>>>>> >   >> did have an older FreeIPA 3.x / Samba 3.x installation as
>> >>>>>>>> > a
>> >>>>>>>> >   reference).
>> >>>>>>>> >   >>
>> >>>>>>>> >   >> It sounds like we need to step back, and look at the test
>> >> user
>> >>>>>> and
>> >>>>>>>> >   group
>> >>>>>>>> >   > in
>> >>>>>>>> >   >> the FreeIPA LDAP tree. I find using an LDAP browser makes
>> >> this
>> >>>>>> much
>> >>>>>>>> >   > easier.
>> >>>>>>>> >   >>
>> >>>>>>>> >   >> My FreeIPA / Samba Users have the following Samba
>> >>>>>>>> > extensions
>> >>> in
>> >>>>>>>> >   FreeIPA
>> >>>>>>>> >   >> (cn=accounts, cn=users):
>> >>>>>>>> >   >>
>> >>>>>>>> >   >> * objectClass: sambasamaccount
>> >>>>>>>> >   >>
>> >>>>>>>> >   >> * Attributes: sambaSID, sambaNTPassword, sambaPwdLastSet
>> >>>>>>>> >   >>
>> >>>>>>>> >   >> My FreeIPA / Samba Groups have the following Samba
>> >>>>>>>> > extensions
>> >>>> in
>> >>>>>>>> >   FreeIPA
>> >>>>>>>> >   >> (cn=accounts, cn=groups):
>> >>>>>>>> >   >>
>> >>>>>>>> >   >> * objectClass: sambaGroupMapping
>> >>>>>>>> >   >>
>> >>>>>>>> >   >> * Attributes: sambaGroupType, sambaSID
>> >>>>>>>> >   >>
>> >>>>>>>> >   >> The Users must belong to one or more of the samba groups
>> >>>>>>>> > that
>> >>>>> you
>> >>>>>>>> > have
>> >>>>>>>> >   >> setup.
>> >>>>>>>> >   >>
>> >>>>>>>> >   >> If you don't have something similar to the above (which
>> >> sounds
>> >>>>>> like
>> >>>>>>>> > it
>> >>>>>>>> >   is
>> >>>>>>>> >   >> the case), then something went wrong applying the
>> >>>>>>>> > extensions.
>> >>>> It
>> >>>>>>>> > would
>> >>>>>>>> >   be
>> >>>>>>>> >   >> worth testing comparing a new user / group created post
>> >> adding
>> >>>>>> the
>> >>>>>>>> >   >> extensions to a previous existing user.
>> >>>>>>>> >   >>
>> >>>>>>>> >   >> i.e.
>> >>>>>>>> >   >> are the extensions missing on existing users / groups?
>> >>>>>>>> >   >> are the extensions missing on new users / groups?
>> >>>>>>>> >   >>
>> >>>>>>>> >   >> Cheers
>> >>>>>>>> >   >>
>> >>>>>>>> >   >> Chris
>> >>>>>>>> >   >>
>> >>>>>>>> >   >>
>> >>>>>>>> >   >>
>> >>>>>>>> >   >>
>> >>>>>>>> >   >>
>> >>>>>>>> >   >> From:   Youenn PIOLET <piole...@gmail.com>
>> >>>>>>>> >   >> To:     "Matt ." <yamakasi....@gmail.com>
>> >>>>>>>> >   >> Cc:     Christopher Lamb/Switzerland/IBM@IBMCH,
>> >>>>>>>> >   >>             "freeipa-users@redhat.com"
>> >>>>> <freeipa-users@redhat.com>
>> >>>>>>>> >   >> Date:   04.08.2015 18:56
>> >>>>>>>> >   >> Subject:        Re: [Freeipa-users] Ubuntu Samba Server
>> >>>>>>>> > Auth
>> >>>>>>>> > against
>> >>>>>>>> >   IPA
>> >>>>>>>> >   >>
>> >>>>>>>> >   >>
>> >>>>>>>> >   >>
>> >>>>>>>> >   >> Hi there,
>> >>>>>>>> >   >>
>> >>>>>>>> >   >> I have difficulties to follow you at this point :)
>> >>>>>>>> >   >> Here is what I've done and what I've understood:
>> >>>>>>>> >   >>
>> >>>>>>>> >   >> ## SMB Side
>> >>>>>>>> >   >> - Testparm OK
>> >>>>>>>> >   >> - I've got the same NT_STATUS_NO_SUCH_USER when I try to
>> >>>>> connect.
>> >>>>>>>> >   >> - pdbedit -Lv output is all successfull but I can see
>> >>>>>>>> > there
>> >> is
>> >>>> a
>> >>>>>>>> >   filter :
>> >>>>>>>> >   >> (&(uid=*)(objectclass=sambaSamAccount). In LDAP, the users
>> >>>> don't
>> >>>>>>>> > have
>> >>>>>>>> >   >> sambaSamAccount.
>> >>>>>>>> >   >>
>> >>>>>>>> >   >> ## LDAP / FreeIPA side
>> >>>>>>>> >   >> - Since SMB server uses LDAP, I did ipa-adtrust-install on
>> >>>>>>>> > my
>> >>>>>>>> > FreeIPA
>> >>>>>>>> >   >> server to get samba LDAP extensions.
>> >>>>>>>> >   >> - I can see samba classes exist in LDAP but are not used
>> >>>>>>>> > on
>> >> my
>> >>>>>>>> > group
>> >>>>>>>> >   >> objects nor my user objects
>> >>>>>>>> >   >> - I have add sambaSamAccount in FreeIPA default user
>> >>>>>>>> > classes,
>> >>>>>>>> >   >> and sambaGroupMapping to default group classes. In that
>> >>>>>>>> > state
>> >>> I
>> >>>>>>>> > can't
>> >>>>>>>> >   >> create user nor groups anymore, as new samba attributes
>> >>>>>>>> > are
>> >>>>>> needed
>> >>>>>>>> > for
>> >>>>>>>> >   >> instantiation.
>> >>>>>>>> >   >> - I have add in etc ipaCustomFields: 'Samba Group
>> >>>>>>>> >   > Type,sambagrouptype,true'
>> >>>>>>>> >   >> but I don't get what it does.
>> >>>>>>>> >   >> - I tried to add the samba.js plugin. It works, and adds
>> >>>>>>>> > the
>> >>>>>>>> > "local"
>> >>>>>>>> >   > option
>> >>>>>>>> >   >> when creating a group in FreeIPA, supposed to set
>> >>>> sambagrouptype
>> >>>>>> to
>> >>>>>>>> > 4
>> >>>>>>>> >   or
>> >>>>>>>> >   > 2
>> >>>>>>>> >   >> (domain). It doesn't work and tells that sambagrouptype
>> >>>>> attribute
>> >>>>>>>> >   doesn't
>> >>>>>>>> >   >> exist (but it should now I put sambaGroupType class by
>> >>>>>> default...)
>> >>>>>>>> >   >>
>> >>>>>>>> >   >> ## Questions
>> >>>>>>>> >   >> 0) Can I ask samba not to search sambaSamAccount and use
>> >>> unix /
>> >>>>>>>> > posix
>> >>>>>>>> >   >> instead? I guess no.
>> >>>>>>>> >   >> 1) How to generate the user/group SIDs ? They are
>> >>>>>>>> > requested
>> >> to
>> >>>>>> add
>> >>>>>>>> >   >> sambaSamAccount classes.
>> >>>>>>>> >   >> This article doesn't seem relevant since we don't use
>> >>>>>>>> > domain
>> >>>>>>>> >   controller
>> >>>>>>>> >   >>
>> >>>>>>>> >   >
>> >>>>>>>> >
>> >>>>>>>> >
>> >>>>>>
>> >>>>>
>> >>>>
>> >>>
>> >>
>> >> http://docs.fedoraproject.org/en-US/Fedora/17/html/FreeIPA_Guide/cifs.html
>> >>>>>>>> >
>> >>>>>>>> >   >> and netgetlocalsid returns an error.
>> >>>>>>>> >   >> 2) How to fix samba.js plugin?
>> >>>>>>>> >   >> 3) I guess an equivalent of samba.js is needed for user
>> >>>>> creation,
>> >>>>>>>> >   where
>> >>>>>>>> >   > can
>> >>>>>>>> >   >> I find it?
>> >>>>>>>> >   >> 4) Is your setup working with Windows 8 / Windows 10 and
>> >>>>>>>> > not
>> >>>>> only
>> >>>>>>>> >   Windows
>> >>>>>>>> >   >> 7?
>> >>>>>>>> >   >>
>> >>>>>>>> >   >> Thanks a lot for your previous and future answers
>> >>>>>>>> >   >>
>> >>>>>>>> >   >> --
>> >>>>>>>> >   >> Youenn Piolet
>> >>>>>>>> >   >> piole...@gmail.com
>> >>>>>>>> >   >>
>> >>>>>>>> >   >>
>> >>>>>>>> >   >> 2015-08-04 17:55 GMT+02:00 Matt .
>> >>>>>>>> > <yamakasi....@gmail.com>:
>> >>>>>>>> >   >>   Hi,
>> >>>>>>>> >   >>
>> >>>>>>>> >   >>   Yes, log is anonymised.
>> >>>>>>>> >   >>
>> >>>>>>>> >   >>   It's strange, my user doesn't have a SambaPwdLastSet,
>> >>>>>>>> > also
>> >>>>> when
>> >>>>>> I
>> >>>>>>>> >   >>   change it's password it doesn't get it in ldap.
>> >>>>>>>> >   >>
>> >>>>>>>> >   >>   There must be something going wrong I guess.
>> >>>>>>>> >   >>
>> >>>>>>>> >   >>   Matt
>> >>>>>>>> >   >>
>> >>>>>>>> >   >>   2015-08-04 17:45 GMT+02:00 Christopher Lamb
>> >>>>>>>> >   > <christopher.l...@ch.ibm.com
>> >>>>>>>> >   >>   >:
>> >>>>>>>> >   >>   > Hi Matt
>> >>>>>>>> >   >>   >
>> >>>>>>>> >   >>   > I assume [username] is a real username, identical to
>> >>>>>>>> > that
>> >>>> in
>> >>>>>>>> > the
>> >>>>>>>> >   >>   FreeIPA
>> >>>>>>>> >   >>   > cn=accounts, cn=users tree? (i.e. you anonymised the
>> >>>>>>>> > log
>> >>>>>>>> > extract).
>> >>>>>>>> >   >>   >
>> >>>>>>>> >   >>   > You user should be a member of the appropriate samba
>> >>> groups
>> >>>>>>>> > that
>> >>>>>>>> >   you
>> >>>>>>>> >   >>   setup
>> >>>>>>>> >   >>   > in FreeIPA.
>> >>>>>>>> >   >>   >
>> >>>>>>>> >   >>   > You should check that the user attribute
>> >>>>>>>> > SambaPwdLastSet
>> >>> is
>> >>>>>> set
>> >>>>>>>> > to
>> >>>>>>>> >   a
>> >>>>>>>> >   >>   > positive value (e.g. 1). If not you get an error in
>> >>>>>>>> > the
>> >>>>> Samba
>> >>>>>>>> > logs
>> >>>>>>>> >   -
>> >>>>>>>> >   > I
>> >>>>>>>> >   >>   > would need to play around again with a test user to
>> >>>>>>>> > find
>> >>>> out
>> >>>>>>>> > the
>> >>>>>>>> >   > exact
>> >>>>>>>> >   >>   > error.
>> >>>>>>>> >   >>   >
>> >>>>>>>> >   >>   > I don't understand what you mean about syncing the
>> >>>>>>>> > users
>> >>>>>> local,
>> >>>>>>>> >   but
>> >>>>>>>> >   > we
>> >>>>>>>> >   >>   did
>> >>>>>>>> >   >>   > not need to do anything like that.
>> >>>>>>>> >   >>   >
>> >>>>>>>> >   >>   > Chris
>> >>>>>>>> >   >>   >
>> >>>>>>>> >   >>   >
>> >>>>>>>> >   >>   >
>> >>>>>>>> >   >>   >
>> >>>>>>>> >   >>   > From:   "Matt ." <yamakasi....@gmail.com>
>> >>>>>>>> >   >>   > To:     Christopher Lamb/Switzerland/IBM@IBMCH
>> >>>>>>>> >   >>   > Cc:     "freeipa-users@redhat.com"
>> >>>>> <freeipa-users@redhat.com>
>> >>>>>>>> >   >>   > Date:   04.08.2015 15:33
>> >>>>>>>> >   >>   > Subject:        Re: [Freeipa-users] Ubuntu Samba
>> >>>>>>>> > Server
>> >>>> Auth
>> >>>>>>>> >   against
>> >>>>>>>> >   >>   IPA
>> >>>>>>>> >   >>   >
>> >>>>>>>> >   >>   >
>> >>>>>>>> >   >>   >
>> >>>>>>>> >   >>   > Hi Chris,
>> >>>>>>>> >   >>   >
>> >>>>>>>> >   >>   > A puppet run added another passdb backend, that was
>> >>> causing
>> >>>>>> my
>> >>>>>>>> >   issue.
>> >>>>>>>> >   >>   >
>> >>>>>>>> >   >>   > What I still experience is:
>> >>>>>>>> >   >>   >
>> >>>>>>>> >   >>   >
>> >>>>>>>> >   >>   > [2015/08/04 15:29:45.477783,  3]
>> >>>>>>>> >   >>   > ../source3/auth/check_samsec.c:399(check_sam_security)
>> >>>>>>>> >   >>   >   check_sam_security: Couldn't find user 'username' in
>> >>>>>> passdb.
>> >>>>>>>> >   >>   > [2015/08/04 15:29:45.478026,  2]
>> >>>>>>>> >   >>   > ../source3/auth/auth.c:288(auth_check_ntlm_password)
>> >>>>>>>> >   >>   >   check_ntlm_password:  Authentication for user
>> >> [username]
>> >>>>> ->
>> >>>>>>>> >   >>   > [username] FAILED with error NT_STATUS_NO_SUCH_USER
>> >>>>>>>> >   >>   >
>> >>>>>>>> >   >>   >
>> >>>>>>>> >   >>   > I also wonder if I shall still sync the users local,
>> >>>>>>>> > or
>> >> is
>> >>>>> it
>> >>>>>>>> >   > needed ?
>> >>>>>>>> >   >>   >
>> >>>>>>>> >   >>   > Thanks again,
>> >>>>>>>> >   >>   >
>> >>>>>>>> >   >>   > Matt
>> >>>>>>>> >   >>   >
>> >>>>>>>> >   >>   > 2015-08-04 14:16 GMT+02:00 Christopher Lamb <
>> >>>>>>>> >   >>   christopher.l...@ch.ibm.com>:
>> >>>>>>>> >   >>   >> Hi Matt
>> >>>>>>>> >   >>   >>
>> >>>>>>>> >   >>   >> From our smb.conf file:
>> >>>>>>>> >   >>   >>
>> >>>>>>>> >   >>   >> [global]
>> >>>>>>>> >   >>   >>    security = user
>> >>>>>>>> >   >>   >>    passdb backend =
>> >>>>>>>> > ldapsam:ldap://xxx-ldap2.my.silly.example.com
>> >>>>>>>> >   >>   >>    ldap suffix = dc=my,dc=silly,dc=example,dc=com
>> >>>>>>>> >   >>   >>    ldap admin dn = cn=Directory Manager
>> >>>>>>>> >   >>   >>
>> >>>>>>>> >   >>   >> So yes, we use Directory Manager, it works for us. I
>> >> have
>> >>>>>> not
>> >>>>>>>> >   tried
>> >>>>>>>> >   >>   with
>> >>>>>>>> >   >>   > a
>> >>>>>>>> >   >>   >> less powerful user, but it is conceivable that a
>> >>>>>>>> > lesser
>> >>>>> user
>> >>>>>>>> > may
>> >>>>>>>> >   not
>> >>>>>>>> >   >>   see
>> >>>>>>>> >   >>   >> all the required attributes, resulting in "no such
>> >>>>>>>> > user"
>> >>>>>>>> > errors.
>> >>>>>>>> >   >>   >>
>> >>>>>>>> >   >>   >> Chris
>> >>>>>>>> >   >>   >>
>> >>>>>>>> >   >>   >>
>> >>>>>>>> >   >>   >>
>> >>>>>>>> >   >>   >>
>> >>>>>>>> >   >>   >> From:   "Matt ." <yamakasi....@gmail.com>
>> >>>>>>>> >   >>   >> To:     Christopher Lamb/Switzerland/IBM@IBMCH
>> >>>>>>>> >   >>   >> Cc:     "freeipa-users@redhat.com"
>> >>>>>> <freeipa-users@redhat.com>
>> >>>>>>>> >   >>   >> Date:   04.08.2015 13:32
>> >>>>>>>> >   >>   >> Subject:        Re: [Freeipa-users] Ubuntu Samba
>> >>>>>>>> > Server
>> >>>>> Auth
>> >>>>>>>> >   against
>> >>>>>>>> >   >>   IPA
>> >>>>>>>> >   >>   >>
>> >>>>>>>> >   >>   >>
>> >>>>>>>> >   >>   >>
>> >>>>>>>> >   >>   >> Hi Chris,
>> >>>>>>>> >   >>   >>
>> >>>>>>>> >   >>   >> Thanks for the heads up, indeed local is 4 I see now
>> >> when
>> >>>> I
>> >>>>>>>> > add a
>> >>>>>>>> >   >>   >> group from the GUI, great thanks!
>> >>>>>>>> >   >>   >>
>> >>>>>>>> >   >>   >> But do you use Directory Manager as ldap admin user
>> >>>>>>>> > or
>> >>>> some
>> >>>>>>>> > other
>> >>>>>>>> >   >>   >> admin account ?
>> >>>>>>>> >   >>   >>
>> >>>>>>>> >   >>   >> I'm not sure id DM is needed and it should get that
>> >>>>>>>> > deep
>> >>>>>> into
>> >>>>>>>> >   IPA.
>> >>>>>>>> >   >>   >> Also when starting samba it cannot find "such user"
>> >>>>>>>> > as
>> >>>> that
>> >>>>>>>> >   sounds
>> >>>>>>>> >   >>   >> quite known as it has no UID.
>> >>>>>>>> >   >>   >>
>> >>>>>>>> >   >>   >> From your config I see you use DM, this should work ?
>> >>>>>>>> >   >>   >>
>> >>>>>>>> >   >>   >> Thanks!
>> >>>>>>>> >   >>   >>
>> >>>>>>>> >   >>   >>
>> >>>>>>>> >   >>   >> Matt
>> >>>>>>>> >   >>   >>
>> >>>>>>>> >   >>   >>
>> >>>>>>>> >   >>   >
>> >>>>>>>> >   >>   >
>> >>>>>>>> >   >>   >
>> >>>>>>>> >   >>   >
>> >>>>>>>> >   >>
>> >>>>>>>> >   >>   --
>> >>>>>>>> >   >>   Manage your subscription for the Freeipa-users mailing
>> >> list:
>> >>>>>>>> >   >>   https://www.redhat.com/mailman/listinfo/freeipa-users
>> >>>>>>>> >   >>   Go to http://freeipa.org for more info on the project
>> >>>>>>>> >   >>
>> >>>>>>>> >   >>
>> >>>>>>>> >   >>
>> >>>>>>>> >   >
>> >>>>>>>> >   >
>> >>>>>>>> >   >
>> >>>>>>>> >   >
>> >>>>>>>> >   > --
>> >>>>>>>> >   > Manage your subscription for the Freeipa-users mailing
>> >>>>>>>> > list:
>> >>>>>>>> >   > https://www.redhat.com/mailman/listinfo/freeipa-users
>> >>>>>>>> >   > Go to http://freeipa.org for more info on the project
>> >>>>>>>> >   >
>> >>>>>>>> >   >
>> >>>>>>>> >   >
>> >>>>>>>> >   >
>> >>>>>>>> >
>> >>>>>>>> >   --
>> >>>>>>>> >   Manage your subscription for the Freeipa-users mailing list:
>> >>>>>>>> >   https://www.redhat.com/mailman/listinfo/freeipa-users
>> >>>>>>>> >   Go to http://freeipa.org for more info on the project
>> >>>>>>>> >
>> >>>>>>>> >
>> >>>>>>>> >
>> >>>>>>>
>> >>>>>>>
>> >>>>>>
>> >>>>>>
>> >>>>>>
>> >>>>>>
>> >>>>>
>> >>>>>
>> >>>>>
>> >>>>>
>> >>>>
>> >>>>
>> >>>>
>> >>>>
>> >>>
>> >>>
>> >>>
>> >>>
>> >>
>> >>
>> >>
>> >>
>
>

-- 
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go to http://freeipa.org for more info on the project

Reply via email to