Hi,

I might have found somthing which I already seen in the logs.

I did a smbpasswd my username on the samba server, it connects to ldap
very well. I give my new password and get the following:

smbldap_search_ext: base => [dc=my,dc=domain], filter =>
[(&(objectClass=ipaNTGroupAttrs)(|(ipaNTSecurityIdentifier=S-1----my--sid---)))],
scope => [2]
Attribute [displayName] not found.
Could not retrieve 'displayName' attribute from cn=Default SMB
Group,cn=groups,cn=accounts,dc=my,dc=domain
Sid S-1----my--sid--- -> MYDOMAIN\Default SMB Group(2)

So something is missing!

Thanks so far guys!

Cheers,

Matt

2015-08-13 12:02 GMT+02:00 Matt . <yamakasi....@gmail.com>:
> Hi Youenn,
>
> OK thanks! this takes me a little but futher now and I see some good
> stuff in my logging.
>
> I'm testing on a Windows 10 Machine which is not member of an AD or
> so, so that might be my issue for now ?
>
> When testing on the samba box itself as my user I get:
>
>
> [myusername@smb-01 ~]$ smbclient //smb-01.domain.local/shares
>
> ...
> Checking NTLMSSP password for MSP\myusername failed: NT_STATUS_WRONG_PASSWORD
> ...
> SPNEGO login failed: NT_STATUS_WRONG_PASSWORD
>
>
> Maybe I have an issue with encrypted passwords ?
>
>
> When we have this all working, I think we have a howto :D
>
> Thanks!
>
> Matt
>
> 2015-08-13 10:53 GMT+02:00 Youenn PIOLET <piole...@gmail.com>:
>> Hi Matt
>>
>> - CentOS : Did you copy ipasam.so and change your smb.conf accordingly?
>> sambaSamAccount is not needed anymore that way.
>> - Default IPA Way : won't work if your Windows is not part of a domain
>> controller. DOMAIN\username may work for some users using Windows 7 - not 8
>> nor 10 (it did for me but I was the only one at the office... quite useless)
>>
>> This config may work on your CentOS (for the ipasam way):
>> workgroup = TEST
>> realm = TEST.NET
>> kerberos method = dedicated keytab
>> dedicated keytab file = FILE:/<.....>/samba.keytab
>> create krb5 conf = no
>> security = user
>> encrypt passwords = true
>> passdb backend = ipasam:ldaps://youripa.test.net
>> ldapsam:trusted = yes
>> ldapsuffix = test.net
>> ldap user suffix = cn=users,cn=accounts
>> ldap group suffix = cn=groups,cn=accounts
>>
>>
>> --
>> Youenn Piolet
>> piole...@gmail.com
>>
>>
>> 2015-08-12 22:15 GMT+02:00 Matt . <yamakasi....@gmail.com>:
>>>
>>> Hi,
>>>
>>> OK the default IPA way works great actually when testing it as described
>>> here:
>>>
>>> http://www.freeipa.org/page/Howto/Integrating_a_Samba_File_Server_With_IPA
>>>
>>> On the samba server I can auth and see my share where I want to connect
>>> to.
>>>
>>> The issue is, on Windows I cannot auth, even when I do DOMAIN\username
>>> as username
>>>
>>> So, the IPA way should work.
>>>
>>> Any comments here ?
>>>
>>> Cheers,
>>>
>>> Matt
>>>
>>> 2015-08-12 19:00 GMT+02:00 Matt . <yamakasi....@gmail.com>:
>>> > HI GUys,
>>> >
>>> > I'm testing this out and I think I almost setup, this on a CentOS samba
>>> > server.
>>> >
>>> > I'm using the ipa-adtrust way of Youeen but it seems we still need to
>>> > add (objectclass=sambaSamAccount)) ?
>>> >
>>> > Info is welcome!
>>> >
>>> > I will report back when I have it working.
>>> >
>>> > Thanks!
>>> >
>>> > Matt
>>> >
>>> > 2015-08-10 11:16 GMT+02:00 Christopher Lamb
>>> > <christopher.l...@ch.ibm.com>:
>>> >> The next route I will try - is the one Youeen took, using ipa-adtrust
>>> >>
>>> >>
>>> >>
>>> >> From:   "Matt ." <yamakasi....@gmail.com>
>>> >> To:     Christopher Lamb/Switzerland/IBM@IBMCH,
>>> >>             "freeipa-users@redhat.com" <freeipa-users@redhat.com>
>>> >> Date:   10.08.2015 10:03
>>> >> Subject:        Re: [Freeipa-users] Ubuntu Samba Server Auth against
>>> >> IPA
>>> >>
>>> >>
>>> >>
>>> >> Hi Chris,
>>> >>
>>> >> Okay this is good to hear.
>>> >>
>>> >> But don't we want a IPA managed Scheme ?
>>> >>
>>> >> When I did a "ipa-adtrust-install --add-sids" it also wanted a local
>>> >> installed Samba and I wonder why.
>>> >>
>>> >> Good that we make some progres on making it all clear.
>>> >>
>>> >> Cheers,
>>> >>
>>> >> Matt
>>> >>
>>> >> 2015-08-10 6:12 GMT+02:00 Christopher Lamb
>>> >> <christopher.l...@ch.ibm.com>:
>>> >>> ldapsam + the samba extensions, pretty much as described in the
>>> >> Techslaves
>>> >>> article. Once I have a draft for the wiki page, I will mail you.
>>> >>>
>>> >>>
>>> >>>
>>> >>> From:   "Matt ." <yamakasi....@gmail.com>
>>> >>> To:     Christopher Lamb/Switzerland/IBM@IBMCH,
>>> >>>             "freeipa-users@redhat.com" <freeipa-users@redhat.com>
>>> >>> Date:   09.08.2015 21:17
>>> >>> Subject:        Re: [Freeipa-users] Ubuntu Samba Server Auth against
>>> >>> IPA
>>> >>>
>>> >>>
>>> >>>
>>> >>> Hi,
>>> >>>
>>> >>> Yes I know about "anything" but which way did you use now ?
>>> >>>
>>> >>>
>>> >>>
>>> >>> 2015-08-09 20:56 GMT+02:00 Christopher Lamb
>>> >> <christopher.l...@ch.ibm.com>:
>>> >>>> Hi Matt
>>> >>>>
>>> >>>> I am on OEL 7.1. - so anything that works on that should be good for
>>> >> RHEL
>>> >>>> and Centos 7.x
>>> >>>>
>>> >>>> I intend to add a how-to to the FreeIPA Wiki over the next few days.
>>> >>>> As
>>> >>> we
>>> >>>> have suggested earlier, we will likely end up with several, one for
>>> >>>> each
>>> >>> of
>>> >>>> the possible integration paths.
>>> >>>>
>>> >>>> Chris
>>> >>>>
>>> >>>>
>>> >>>>
>>> >>>>
>>> >>>>
>>> >>>> From:   "Matt ." <yamakasi....@gmail.com>
>>> >>>> To:     Christopher Lamb/Switzerland/IBM@IBMCH,
>>> >>>>             "freeipa-users@redhat.com" <freeipa-users@redhat.com>
>>> >>>> Date:   09.08.2015 16:45
>>> >>>> Subject:        Re: [Freeipa-users] Ubuntu Samba Server Auth against
>>> >>>> IPA
>>> >>>>
>>> >>>>
>>> >>>>
>>> >>>> Hi Chris,
>>> >>>>
>>> >>>> This sounds great!
>>> >>>>
>>> >>>> What are you using now, both CentOS ? So Samba and FreeIPA ?
>>> >>>>
>>> >>>> Maybe it's good to explain which way you used now in steps too, so we
>>> >>>> can combine or create multiple howto's ?
>>> >>>>
>>> >>>> At least we are going somewhere!
>>> >>>>
>>> >>>> Thanks,
>>> >>>>
>>> >>>> Matt
>>> >>>>
>>> >>>> 2015-08-09 14:54 GMT+02:00 Christopher Lamb
>>> >>> <christopher.l...@ch.ibm.com>:
>>> >>>>> Hi Matt
>>> >>>>>
>>> >>>>> My test integration of FreeIPA 4.x and Samba 4.x with the "good old
>>> >>> Samba
>>> >>>>> Schema extensions) is up and working, almost flawlessly.
>>> >>>>>
>>> >>>>> I can add users and groups via the FreeIPA CLI, and they get the
>>> >> correct
>>> >>>>> ObjectClasses / attributes required for Samba.
>>> >>>>>
>>> >>>>> So far I have not yet bothered to try the extensions to the WebUI,
>>> >>>> because
>>> >>>>> it is currently giving me the classic "Your session has expired.
>>> >>>>> Please
>>> >>>>> re-login." error which renders the WebUI useless.
>>> >>>>>
>>> >>>>> The only problem I have so far encountered managing Samba / FreeIPA
>>> >>> users
>>> >>>>> via FreeIPA CLI commands is with the handling of the attribute
>>> >>>>> sambaPwdLastSet. This is the subject of an existing thread, also
>>> >> updated
>>> >>>>> today.
>>> >>>>>
>>> >>>>> There is also an existing alternative to hacking group.py, using
>>> >>>>> "Class
>>> >>>> of
>>> >>>>> Service" (Cos) documented in this thread from February 2015
>>> >>>>>
>>> >>>
>>> >>> https://www.redhat.com/archives/freeipa-users/2015-February/msg00172.html
>>> >>>> .
>>> >>>>> I have not yet tried it, but it sounds reasonable.
>>> >>>>>
>>> >>>>> Chris
>>> >>>>>
>>> >>>>>
>>> >>>>>
>>> >>>>>
>>> >>>>>
>>> >>>>> From:   "Matt ." <yamakasi....@gmail.com>
>>> >>>>> To:     Christopher Lamb/Switzerland/IBM@IBMCH
>>> >>>>> Cc:     "freeipa-users@redhat.com" <freeipa-users@redhat.com>,
>>> >>>>> Youenn
>>> >>>>>             PIOLET <piole...@gmail.com>
>>> >>>>> Date:   06.08.2015 16:19
>>> >>>>> Subject:        Re: [Freeipa-users] Ubuntu Samba Server Auth against
>>> >> IPA
>>> >>>>>
>>> >>>>>
>>> >>>>>
>>> >>>>> Hi Chris,
>>> >>>>>
>>> >>>>> OK, than we might create two different versions of the wiki, I think
>>> >>>>> this is nice.
>>> >>>>>
>>> >>>>> I'm still figuring out why I get that:
>>> >>>>>
>>> >>>>> IPA Error 4205: ObjectclassViolation
>>> >>>>>
>>> >>>>> missing attribute "sambaGroupType" required by object class
>>> >>>>> "sambaGroupMapping"
>>> >>>>>
>>> >>>>> Matt
>>> >>>>>
>>> >>>>> 2015-08-06 16:09 GMT+02:00 Christopher Lamb
>>> >>>> <christopher.l...@ch.ibm.com>:
>>> >>>>>> Hi Matt
>>> >>>>>>
>>> >>>>>> As far as I can make out, there are at least 2 viable Samba /
>>> >>>>>> FreeIPA
>>> >>>>>> integration paths.
>>> >>>>>>
>>> >>>>>> The route I took is suited where there is no Active Directory
>>> >> involved:
>>> >>>>> In
>>> >>>>>> my case all the Windows, OSX and Linux clients are islands that sit
>>> >>>>>> on
>>> >>>>> the
>>> >>>>>> same network.
>>> >>>>>>
>>> >>>>>> The route that Youenn has taken (unless I have got completely the
>>> >> wrong
>>> >>>>> end
>>> >>>>>> of the stick) requires Active Directory in the architecture.
>>> >>>>>>
>>> >>>>>> Chris
>>> >>>>>>
>>> >>>>>>
>>> >>>>>>
>>> >>>>>> From:   "Matt ." <yamakasi....@gmail.com>
>>> >>>>>> To:     Youenn PIOLET <piole...@gmail.com>
>>> >>>>>> Cc:     Christopher Lamb/Switzerland/IBM@IBMCH,
>>> >>>>>>             "freeipa-users@redhat.com" <freeipa-users@redhat.com>
>>> >>>>>> Date:   06.08.2015 14:42
>>> >>>>>> Subject:        Re: [Freeipa-users] Ubuntu Samba Server Auth
>>> >>>>>> against
>>> >>> IPA
>>> >>>>>>
>>> >>>>>>
>>> >>>>>>
>>> >>>>>> Hi,
>>> >>>>>>
>>> >>>>>> OK, this sounds already quite logical, but I'm still refering to
>>> >>>>>> the
>>> >>>>>> old howto we found earlier, does that one still apply somewhere or
>>> >>>>>> not
>>> >>>>>> at all ?
>>> >>>>>>
>>> >>>>>> Thanks,
>>> >>>>>>
>>> >>>>>> Matt
>>> >>>>>>
>>> >>>>>>
>>> >>>>>>
>>> >>>>>> 2015-08-06 12:23 GMT+02:00 Youenn PIOLET <piole...@gmail.com>:
>>> >>>>>>> Hey guys,
>>> >>>>>>>
>>> >>>>>>> I'll try to make a tutorial soon, sorry I'm quite in a rush these
>>> >>>>> days :)
>>> >>>>>>>
>>> >>>>>>> General idea:
>>> >>>>>>>
>>> >>>>>>> On FreeIPA (4.1)
>>> >>>>>>> - `ipa-adtrust-install --add-sids` (creates
>>> >>>>>>> ipaNTsecurityidentifier
>>> >>>>>>> attribude, also known as SID)
>>> >>>>>>> - regenerate each user password to build ipaNTHash attribute, not
>>> >> here
>>> >>>>> by
>>> >>>>>>> default on users
>>> >>>>>>> - use your ldap browser to check ipaNTHash values are here on user
>>> >>>>>> objects
>>> >>>>>>> - create a CIFS service for your samba server
>>> >>>>>>> - Create user roles/permissions as described here:
>>> >>>>>>>
>>> >>>>>>
>>> >>>>>
>>> >>>>
>>> >>>
>>> >>
>>> >> http://freeipa-users.redhat.narkive.com/ez2uKpFS/authenticate-samba-3-or-4-with-freeipa
>>> >>
>>> >>>
>>> >>>>
>>> >>>>>
>>> >>>>>>
>>> >>>>>>> so that CIFS service will be able to read ipaNTsecurityidentifier
>>> >>>>>>> and
>>> >>>>>>> ipaNTHash attributes in LDAP (ACI)
>>> >>>>>>> - SCP ipasam.so module to your cifs server (this is the magic
>>> >> trick) :
>>> >>>>>> scp
>>> >>>>>>> /usr/lib64/samba/pdb/ipasam.so
>>> >>>>>>> root@samba-server.domain:/usr/lib64/samba/pdb/ You can also try to
>>> >>>>>> recompile
>>> >>>>>>> it.
>>> >>>>>>>
>>> >>>>>>> On SAMBA Server side (CentOS 7...)
>>> >>>>>>> - Install server keytab file for CIFS
>>> >>>>>>> - check ipasam.so is here.
>>> >>>>>>> - check you can read password hash in LDAP with `ldapsearch -Y
>>> >>>>>>> GSSAPI
>>> >>>>>>> uid=admin ipaNTHash` thanks to kerberos
>>> >>>>>>> - make your smb.conf following the linked thread and restart
>>> >>>>>>> service
>>> >>>>>>>
>>> >>>>>>> I don't know if it works in Ubuntu. I know sssd has evolved
>>> >>>>>>> quickly
>>> >>> and
>>> >>>>>>> ipasam may use quite recent functionalities, the best is to just
>>> >>>>>>> try.
>>> >>>>> You
>>> >>>>>>> can read in previous thread : "If you insist on Ubuntu you need to
>>> >> get
>>> >>>>>>> ipasam somewhere, most likely to compile it yourself".
>>> >>>>>>>
>>> >>>>>>> Make sure your user has ipaNTHash attribute :)
>>> >>>>>>>
>>> >>>>>>> You may want to debug authentication on samba server, I usually do
>>> >>>> this:
>>> >>>>>>> `tail -f /var/log/samba/log* | grep <username>
>>> >>>>>>>
>>> >>>>>>> Cheers
>>> >>>>>>> --
>>> >>>>>>> Youenn Piolet
>>> >>>>>>> piole...@gmail.com
>>> >>>>>>>
>>> >>>>>>>
>>> >>>>>>> 2015-08-05 17:40 GMT+02:00 Matt . <yamakasi....@gmail.com>:
>>> >>>>>>>>
>>> >>>>>>>> Hi,
>>> >>>>>>>>
>>> >>>>>>>> This sounds great to me too, but a howto would help to make it
>>> >>>>>>>> more
>>> >>>>>>>> clear about what you have done here. The thread confuses me a
>>> >>>>>>>> little
>>> >>>>>>>> bit.
>>> >>>>>>>>
>>> >>>>>>>> Can you paste your commands so we can test out too and report
>>> >>>>>>>> back ?
>>> >>>>>>>>
>>> >>>>>>>> Thanks!
>>> >>>>>>>>
>>> >>>>>>>> Matt
>>> >>>>>>>>
>>> >>>>>>>> 2015-08-05 15:18 GMT+02:00 Christopher Lamb
>>> >>>>>> <christopher.l...@ch.ibm.com>:
>>> >>>>>>>> > Hi Youenn
>>> >>>>>>>> >
>>> >>>>>>>> > Good news that you have got an integration working
>>> >>>>>>>> >
>>> >>>>>>>> > Now you have got it going, and the solution is fresh in your
>>> >>>>>>>> > mind,
>>> >>>>> how
>>> >>>>>>>> > about adding a How-to page on this solution to the FreeIPA
>>> >>>>>>>> > wiki?
>>> >>>>>>>> >
>>> >>>>>>>> > Chris
>>> >>>>>>>> >
>>> >>>>>>>> >
>>> >>>>>>>> >
>>> >>>>>>>> > From:   Youenn PIOLET <piole...@gmail.com>
>>> >>>>>>>> > To:     "Matt ." <yamakasi....@gmail.com>
>>> >>>>>>>> > Cc:     Christopher Lamb/Switzerland/IBM@IBMCH,
>>> >>>>>>>> >             "freeipa-users@redhat.com"
>>> >>>>>>>> > <freeipa-users@redhat.com>
>>> >>>>>>>> > Date:   05.08.2015 14:51
>>> >>>>>>>> > Subject:        Re: [Freeipa-users] Ubuntu Samba Server Auth
>>> >>> against
>>> >>>>>> IPA
>>> >>>>>>>> >
>>> >>>>>>>> >
>>> >>>>>>>> >
>>> >>>>>>>> > Hi guys,
>>> >>>>>>>> >
>>> >>>>>>>> > Thank you so much your previous answers.
>>> >>>>>>>> > I realised my SID were stored in ipaNTsecurityidentifier,
>>> >>>>>>>> > thanks
>>> >> to
>>> >>>>>>>> > ipa-adtrust-install --add-sids
>>> >>>>>>>> >
>>> >>>>>>>> > I found an other way to configure smb here:
>>> >>>>>>>> >
>>> >>>>>>>> >
>>> >>>>>>
>>> >>>>>
>>> >>>>
>>> >>>
>>> >>
>>> >> http://freeipa-users.redhat.narkive.com/ez2uKpFS/authenticate-samba-3-or-4-with-freeipa
>>> >>
>>> >>>
>>> >>>>
>>> >>>>>
>>> >>>>>>
>>> >>>>>>>> > It works perfectly.
>>> >>>>>>>> >
>>> >>>>>>>> > I'm using module ipasam.so I have manually scp to the samba
>>> >> server,
>>> >>>>>>>> > Samba is set to use kerberos + ldapsam via this ipasam module.
>>> >>>>>>>> > Following the instructions, I created a user role allowing
>>> >>>>>>>> > service
>>> >>>>>>>> > principal to read ipaNTHash value from the LDAP.
>>> >>>>>>>> > ipaNTHash are generated each time a user changes his password.
>>> >>>>>>>> > Authentication works perfectly on Windows 7, 8 and 10.
>>> >>>>>>>> >
>>> >>>>>>>> > For more details, the previously linked thread is quite clear.
>>> >>>>>>>> >
>>> >>>>>>>> > Cheers
>>> >>>>>>>> >
>>> >>>>>>>> > --
>>> >>>>>>>> > Youenn Piolet
>>> >>>>>>>> > piole...@gmail.com
>>> >>>>>>>> >
>>> >>>>>>>> >
>>> >>>>>>>> > 2015-08-05 11:10 GMT+02:00 Matt . <yamakasi....@gmail.com>:
>>> >>>>>>>> >   Hi Chris.
>>> >>>>>>>> >
>>> >>>>>>>> >   Yes, Apache Studio did that but I was not sure why it
>>> >>>>>>>> > complained
>>> >>>> it
>>> >>>>>>>> >   was "already" there.
>>> >>>>>>>> >
>>> >>>>>>>> >   I'm still getting:
>>> >>>>>>>> >
>>> >>>>>>>> >   IPA Error 4205: ObjectclassViolation
>>> >>>>>>>> >
>>> >>>>>>>> >   missing attribute "sambaGroupType" required by object class
>>> >>>>>>>> >   "sambaGroupMapping"
>>> >>>>>>>> >
>>> >>>>>>>> >   When adding a user.
>>> >>>>>>>> >
>>> >>>>>>>> >   I also see "class" as fielname under my "Last name", this is
>>> >>>>>>>> > not
>>> >>>> OK
>>> >>>>>>>> > also.
>>> >>>>>>>> >
>>> >>>>>>>> >
>>> >>>>>>>> >
>>> >>>>>>>> >   We sure need to make some howto, I think we can nail this
>>> >> down :)
>>> >>>>>>>> >
>>> >>>>>>>> >   Thanks for the heads up!
>>> >>>>>>>> >
>>> >>>>>>>> >   Matthijs
>>> >>>>>>>> >
>>> >>>>>>>> >   2015-08-05 7:51 GMT+02:00 Christopher Lamb
>>> >>>>>>>> > <christopher.l...@ch.ibm.com>:
>>> >>>>>>>> >   > Hi Matt
>>> >>>>>>>> >   >
>>> >>>>>>>> >   > If I use Apache Directory Studio to add an attribute
>>> >>>>>> ipaCustomFields
>>> >>>>>>>> > to
>>> >>>>>>>> >   > cn=ipaConfig,cn=etc, the operation it performs is a modify,
>>> >>>>>>>> > as
>>> >>>>>> shown
>>> >>>>>>>> >   below:
>>> >>>>>>>> >   >
>>> >>>>>>>> >   > #!RESULT OK
>>> >>>>>>>> >   > #!CONNECTION ldap://xxx-ldap2.my.silly.example.com:yyy
>>> >>>>>>>> >   > #!DATE 2015-08-05T05:45:04.608
>>> >>>>>>>> >   > dn: cn=ipaConfig,cn=etc,dc=my,dc=silly,dc=example,dc=com
>>> >>>>>>>> >   > changetype: modify
>>> >>>>>>>> >   > add: ipaCustomFields
>>> >>>>>>>> >   > ipaCustomFields: Samba Group Type,sambagrouptype,true
>>> >>>>>>>> >   >
>>> >>>>>>>> >   > After that I then have a visible attribute ipaCustomFields
>>> >>>>>>>> > as
>>> >>>>>>>> > expected.
>>> >>>>>>>> >   >
>>> >>>>>>>> >   > When adding the attribute, the wizard offered me
>>> >>>>> "ipaCustomFields"
>>> >>>>>>>> > as
>>> >>>>>>>> >   > attribute type in a drop down list.
>>> >>>>>>>> >   >
>>> >>>>>>>> >   > Once we get this cracked, we really must write a how-to on
>>> >>>>>>>> > the
>>> >>>>>>>> > FreeIPA
>>> >>>>>>>> >   > Wiki.
>>> >>>>>>>> >   >
>>> >>>>>>>> >   > Chris
>>> >>>>>>>> >   >
>>> >>>>>>>> >   >
>>> >>>>>>>> >   >
>>> >>>>>>>> >   > From:   Christopher Lamb/Switzerland/IBM@IBMCH
>>> >>>>>>>> >   > To:     "Matt ." <yamakasi....@gmail.com>
>>> >>>>>>>> >   > Cc:     "freeipa-users@redhat.com"
>>> >>>>>>>> > <freeipa-users@redhat.com>
>>> >>>>>>>> >   > Date:   05.08.2015 07:31
>>> >>>>>>>> >   > Subject:        Re: [Freeipa-users] Ubuntu Samba Server
>>> >>>>>>>> > Auth
>>> >>>>>> against
>>> >>>>>>>> >   IPA
>>> >>>>>>>> >   > Sent by:        freeipa-users-boun...@redhat.com
>>> >>>>>>>> >   >
>>> >>>>>>>> >   >
>>> >>>>>>>> >   >
>>> >>>>>>>> >   > Hi Matt
>>> >>>>>>>> >   >
>>> >>>>>>>> >   > I also got the same result at that step, but can see
>>> >>>>>>>> > nothing
>>> >> in
>>> >>>>>>>> > Apache
>>> >>>>>>>> >   > Directory Studio.
>>> >>>>>>>> >   >
>>> >>>>>>>> >   > As I am using existing Samba / FreeIPA groups migrated
>>> >>>>>>>> > across,
>>> >>>>>> they
>>> >>>>>>>> >   > probably were migrated with all the required attributes.
>>> >>>>>>>> >   >
>>> >>>>>>>> >   > Looking more closely at that LDIF: I wonder should it not
>>> >>>>>>>> > be:
>>> >>>>>>>> >   >
>>> >>>>>>>> >   > ldapmodify -Y GSSAPI <<EOF
>>> >>>>>>>> >   > dn: cn=ipaconfig,cn=etc,dc=domain,dc=tld
>>> >>>>>>>> >   > changetype: modify
>>> >>>>>>>> >   > add: ipaCustomFields
>>> >>>>>>>> >   > ipaCustomFields: "Samba Group Type,sambagrouptype,true"
>>> >>>>>>>> >   > EOF
>>> >>>>>>>> >   >
>>> >>>>>>>> >   > i.e. changetype: modify, instead of changetype add ?
>>> >>>>>>>> >   >
>>> >>>>>>>> >   > I don't want to play around with my prod directory - I will
>>> >>>> setup
>>> >>>>>> an
>>> >>>>>>>> > EL
>>> >>>>>>>> >   7.1
>>> >>>>>>>> >   > VM and install FreeIPA 4.x and Samba 4.x That will allow me
>>> >>>>>>>> > to
>>> >>>>>> play
>>> >>>>>>>> >   around
>>> >>>>>>>> >   > more destructively.
>>> >>>>>>>> >   >
>>> >>>>>>>> >   > Chris
>>> >>>>>>>> >   >
>>> >>>>>>>> >   >
>>> >>>>>>>> >   >
>>> >>>>>>>> >   >
>>> >>>>>>>> >   >
>>> >>>>>>>> >   > From:            "Matt ." <yamakasi....@gmail.com>
>>> >>>>>>>> >   > To:              Christopher Lamb/Switzerland/IBM@IBMCH
>>> >>>>>>>> >   > Cc:              Youenn PIOLET <piole...@gmail.com>, "
>>> >>>>>>>> >   freeipa-users@redhat.com"
>>> >>>>>>>> >   >             <freeipa-users@redhat.com>
>>> >>>>>>>> >   > Date:            05.08.2015 01:01
>>> >>>>>>>> >   > Subject:                 Re: [Freeipa-users] Ubuntu Samba
>>> >>> Server
>>> >>>>>>>> > Auth
>>> >>>>>>>> >   against IPA
>>> >>>>>>>> >   >
>>> >>>>>>>> >   >
>>> >>>>>>>> >   >
>>> >>>>>>>> >   > Hi Chris,
>>> >>>>>>>> >   >
>>> >>>>>>>> >   > I'm at the right path, but my issue is that:
>>> >>>>>>>> >   >
>>> >>>>>>>> >   > ldapmodify -Y GSSAPI <<EOF
>>> >>>>>>>> >   > dn: cn=ipaconfig,cn=etc,dc=domain,dc=tld
>>> >>>>>>>> >   > changetype: add
>>> >>>>>>>> >   > add: ipaCustomFields
>>> >>>>>>>> >   > ipaCustomFields: "Samba Group Type,sambagrouptype,true"
>>> >>>>>>>> >   > EOF
>>> >>>>>>>> >   >
>>> >>>>>>>> >   > Does say it exists, my ldap explorer doesn't show it, and
>>> >>>>>>>> > when
>>> >>> I
>>> >>>>>> add
>>> >>>>>>>> >   > it manually as an attribute it still fails when I add a
>>> >>>>>>>> > user
>>> >> on
>>> >>>>>> this
>>> >>>>>>>> >   > sambagrouptype as it's needed by the other attributes
>>> >>>>>>>> >   >
>>> >>>>>>>> >   > So that is my issue I think so far.
>>> >>>>>>>> >   >
>>> >>>>>>>> >   > Any clue about that ?
>>> >>>>>>>> >   >
>>> >>>>>>>> >   > No problem "you don't know something or are no guru" we are
>>> >> all
>>> >>>>>>>> >   > learning! :)
>>> >>>>>>>> >   >
>>> >>>>>>>> >   > Cheers,
>>> >>>>>>>> >   >
>>> >>>>>>>> >   > Matt
>>> >>>>>>>> >   >
>>> >>>>>>>> >   >
>>> >>>>>>>> >   > 2015-08-04 21:22 GMT+02:00 Christopher Lamb <
>>> >>>>>>>> >   christopher.l...@ch.ibm.com>:
>>> >>>>>>>> >   >> Hi Matt, Youeen
>>> >>>>>>>> >   >>
>>> >>>>>>>> >   >> Just to set the background properly, I did not invent this
>>> >>>>>> process.
>>> >>>>>>>> > I
>>> >>>>>>>> >   > know
>>> >>>>>>>> >   >> only a little about FreeIPA, and almost nothing about
>>> >>>>>>>> > Samba,
>>> >>>> but
>>> >>>>>> I
>>> >>>>>>>> >   guess
>>> >>>>>>>> >   > I
>>> >>>>>>>> >   >> was lucky enough to get the integration working on a
>>> >>>>>>>> > Sunday
>>> >>>>>>>> > afternoon.
>>> >>>>>>>> >   (I
>>> >>>>>>>> >   >> did have an older FreeIPA 3.x / Samba 3.x installation as
>>> >>>>>>>> > a
>>> >>>>>>>> >   reference).
>>> >>>>>>>> >   >>
>>> >>>>>>>> >   >> It sounds like we need to step back, and look at the test
>>> >> user
>>> >>>>>> and
>>> >>>>>>>> >   group
>>> >>>>>>>> >   > in
>>> >>>>>>>> >   >> the FreeIPA LDAP tree. I find using an LDAP browser makes
>>> >> this
>>> >>>>>> much
>>> >>>>>>>> >   > easier.
>>> >>>>>>>> >   >>
>>> >>>>>>>> >   >> My FreeIPA / Samba Users have the following Samba
>>> >>>>>>>> > extensions
>>> >>> in
>>> >>>>>>>> >   FreeIPA
>>> >>>>>>>> >   >> (cn=accounts, cn=users):
>>> >>>>>>>> >   >>
>>> >>>>>>>> >   >> * objectClass: sambasamaccount
>>> >>>>>>>> >   >>
>>> >>>>>>>> >   >> * Attributes: sambaSID, sambaNTPassword, sambaPwdLastSet
>>> >>>>>>>> >   >>
>>> >>>>>>>> >   >> My FreeIPA / Samba Groups have the following Samba
>>> >>>>>>>> > extensions
>>> >>>> in
>>> >>>>>>>> >   FreeIPA
>>> >>>>>>>> >   >> (cn=accounts, cn=groups):
>>> >>>>>>>> >   >>
>>> >>>>>>>> >   >> * objectClass: sambaGroupMapping
>>> >>>>>>>> >   >>
>>> >>>>>>>> >   >> * Attributes: sambaGroupType, sambaSID
>>> >>>>>>>> >   >>
>>> >>>>>>>> >   >> The Users must belong to one or more of the samba groups
>>> >>>>>>>> > that
>>> >>>>> you
>>> >>>>>>>> > have
>>> >>>>>>>> >   >> setup.
>>> >>>>>>>> >   >>
>>> >>>>>>>> >   >> If you don't have something similar to the above (which
>>> >> sounds
>>> >>>>>> like
>>> >>>>>>>> > it
>>> >>>>>>>> >   is
>>> >>>>>>>> >   >> the case), then something went wrong applying the
>>> >>>>>>>> > extensions.
>>> >>>> It
>>> >>>>>>>> > would
>>> >>>>>>>> >   be
>>> >>>>>>>> >   >> worth testing comparing a new user / group created post
>>> >> adding
>>> >>>>>> the
>>> >>>>>>>> >   >> extensions to a previous existing user.
>>> >>>>>>>> >   >>
>>> >>>>>>>> >   >> i.e.
>>> >>>>>>>> >   >> are the extensions missing on existing users / groups?
>>> >>>>>>>> >   >> are the extensions missing on new users / groups?
>>> >>>>>>>> >   >>
>>> >>>>>>>> >   >> Cheers
>>> >>>>>>>> >   >>
>>> >>>>>>>> >   >> Chris
>>> >>>>>>>> >   >>
>>> >>>>>>>> >   >>
>>> >>>>>>>> >   >>
>>> >>>>>>>> >   >>
>>> >>>>>>>> >   >>
>>> >>>>>>>> >   >> From:   Youenn PIOLET <piole...@gmail.com>
>>> >>>>>>>> >   >> To:     "Matt ." <yamakasi....@gmail.com>
>>> >>>>>>>> >   >> Cc:     Christopher Lamb/Switzerland/IBM@IBMCH,
>>> >>>>>>>> >   >>             "freeipa-users@redhat.com"
>>> >>>>> <freeipa-users@redhat.com>
>>> >>>>>>>> >   >> Date:   04.08.2015 18:56
>>> >>>>>>>> >   >> Subject:        Re: [Freeipa-users] Ubuntu Samba Server
>>> >>>>>>>> > Auth
>>> >>>>>>>> > against
>>> >>>>>>>> >   IPA
>>> >>>>>>>> >   >>
>>> >>>>>>>> >   >>
>>> >>>>>>>> >   >>
>>> >>>>>>>> >   >> Hi there,
>>> >>>>>>>> >   >>
>>> >>>>>>>> >   >> I have difficulties to follow you at this point :)
>>> >>>>>>>> >   >> Here is what I've done and what I've understood:
>>> >>>>>>>> >   >>
>>> >>>>>>>> >   >> ## SMB Side
>>> >>>>>>>> >   >> - Testparm OK
>>> >>>>>>>> >   >> - I've got the same NT_STATUS_NO_SUCH_USER when I try to
>>> >>>>> connect.
>>> >>>>>>>> >   >> - pdbedit -Lv output is all successfull but I can see
>>> >>>>>>>> > there
>>> >> is
>>> >>>> a
>>> >>>>>>>> >   filter :
>>> >>>>>>>> >   >> (&(uid=*)(objectclass=sambaSamAccount). In LDAP, the users
>>> >>>> don't
>>> >>>>>>>> > have
>>> >>>>>>>> >   >> sambaSamAccount.
>>> >>>>>>>> >   >>
>>> >>>>>>>> >   >> ## LDAP / FreeIPA side
>>> >>>>>>>> >   >> - Since SMB server uses LDAP, I did ipa-adtrust-install on
>>> >>>>>>>> > my
>>> >>>>>>>> > FreeIPA
>>> >>>>>>>> >   >> server to get samba LDAP extensions.
>>> >>>>>>>> >   >> - I can see samba classes exist in LDAP but are not used
>>> >>>>>>>> > on
>>> >> my
>>> >>>>>>>> > group
>>> >>>>>>>> >   >> objects nor my user objects
>>> >>>>>>>> >   >> - I have add sambaSamAccount in FreeIPA default user
>>> >>>>>>>> > classes,
>>> >>>>>>>> >   >> and sambaGroupMapping to default group classes. In that
>>> >>>>>>>> > state
>>> >>> I
>>> >>>>>>>> > can't
>>> >>>>>>>> >   >> create user nor groups anymore, as new samba attributes
>>> >>>>>>>> > are
>>> >>>>>> needed
>>> >>>>>>>> > for
>>> >>>>>>>> >   >> instantiation.
>>> >>>>>>>> >   >> - I have add in etc ipaCustomFields: 'Samba Group
>>> >>>>>>>> >   > Type,sambagrouptype,true'
>>> >>>>>>>> >   >> but I don't get what it does.
>>> >>>>>>>> >   >> - I tried to add the samba.js plugin. It works, and adds
>>> >>>>>>>> > the
>>> >>>>>>>> > "local"
>>> >>>>>>>> >   > option
>>> >>>>>>>> >   >> when creating a group in FreeIPA, supposed to set
>>> >>>> sambagrouptype
>>> >>>>>> to
>>> >>>>>>>> > 4
>>> >>>>>>>> >   or
>>> >>>>>>>> >   > 2
>>> >>>>>>>> >   >> (domain). It doesn't work and tells that sambagrouptype
>>> >>>>> attribute
>>> >>>>>>>> >   doesn't
>>> >>>>>>>> >   >> exist (but it should now I put sambaGroupType class by
>>> >>>>>> default...)
>>> >>>>>>>> >   >>
>>> >>>>>>>> >   >> ## Questions
>>> >>>>>>>> >   >> 0) Can I ask samba not to search sambaSamAccount and use
>>> >>> unix /
>>> >>>>>>>> > posix
>>> >>>>>>>> >   >> instead? I guess no.
>>> >>>>>>>> >   >> 1) How to generate the user/group SIDs ? They are
>>> >>>>>>>> > requested
>>> >> to
>>> >>>>>> add
>>> >>>>>>>> >   >> sambaSamAccount classes.
>>> >>>>>>>> >   >> This article doesn't seem relevant since we don't use
>>> >>>>>>>> > domain
>>> >>>>>>>> >   controller
>>> >>>>>>>> >   >>
>>> >>>>>>>> >   >
>>> >>>>>>>> >
>>> >>>>>>>> >
>>> >>>>>>
>>> >>>>>
>>> >>>>
>>> >>>
>>> >>
>>> >> http://docs.fedoraproject.org/en-US/Fedora/17/html/FreeIPA_Guide/cifs.html
>>> >>>>>>>> >
>>> >>>>>>>> >   >> and netgetlocalsid returns an error.
>>> >>>>>>>> >   >> 2) How to fix samba.js plugin?
>>> >>>>>>>> >   >> 3) I guess an equivalent of samba.js is needed for user
>>> >>>>> creation,
>>> >>>>>>>> >   where
>>> >>>>>>>> >   > can
>>> >>>>>>>> >   >> I find it?
>>> >>>>>>>> >   >> 4) Is your setup working with Windows 8 / Windows 10 and
>>> >>>>>>>> > not
>>> >>>>> only
>>> >>>>>>>> >   Windows
>>> >>>>>>>> >   >> 7?
>>> >>>>>>>> >   >>
>>> >>>>>>>> >   >> Thanks a lot for your previous and future answers
>>> >>>>>>>> >   >>
>>> >>>>>>>> >   >> --
>>> >>>>>>>> >   >> Youenn Piolet
>>> >>>>>>>> >   >> piole...@gmail.com
>>> >>>>>>>> >   >>
>>> >>>>>>>> >   >>
>>> >>>>>>>> >   >> 2015-08-04 17:55 GMT+02:00 Matt .
>>> >>>>>>>> > <yamakasi....@gmail.com>:
>>> >>>>>>>> >   >>   Hi,
>>> >>>>>>>> >   >>
>>> >>>>>>>> >   >>   Yes, log is anonymised.
>>> >>>>>>>> >   >>
>>> >>>>>>>> >   >>   It's strange, my user doesn't have a SambaPwdLastSet,
>>> >>>>>>>> > also
>>> >>>>> when
>>> >>>>>> I
>>> >>>>>>>> >   >>   change it's password it doesn't get it in ldap.
>>> >>>>>>>> >   >>
>>> >>>>>>>> >   >>   There must be something going wrong I guess.
>>> >>>>>>>> >   >>
>>> >>>>>>>> >   >>   Matt
>>> >>>>>>>> >   >>
>>> >>>>>>>> >   >>   2015-08-04 17:45 GMT+02:00 Christopher Lamb
>>> >>>>>>>> >   > <christopher.l...@ch.ibm.com
>>> >>>>>>>> >   >>   >:
>>> >>>>>>>> >   >>   > Hi Matt
>>> >>>>>>>> >   >>   >
>>> >>>>>>>> >   >>   > I assume [username] is a real username, identical to
>>> >>>>>>>> > that
>>> >>>> in
>>> >>>>>>>> > the
>>> >>>>>>>> >   >>   FreeIPA
>>> >>>>>>>> >   >>   > cn=accounts, cn=users tree? (i.e. you anonymised the
>>> >>>>>>>> > log
>>> >>>>>>>> > extract).
>>> >>>>>>>> >   >>   >
>>> >>>>>>>> >   >>   > You user should be a member of the appropriate samba
>>> >>> groups
>>> >>>>>>>> > that
>>> >>>>>>>> >   you
>>> >>>>>>>> >   >>   setup
>>> >>>>>>>> >   >>   > in FreeIPA.
>>> >>>>>>>> >   >>   >
>>> >>>>>>>> >   >>   > You should check that the user attribute
>>> >>>>>>>> > SambaPwdLastSet
>>> >>> is
>>> >>>>>> set
>>> >>>>>>>> > to
>>> >>>>>>>> >   a
>>> >>>>>>>> >   >>   > positive value (e.g. 1). If not you get an error in
>>> >>>>>>>> > the
>>> >>>>> Samba
>>> >>>>>>>> > logs
>>> >>>>>>>> >   -
>>> >>>>>>>> >   > I
>>> >>>>>>>> >   >>   > would need to play around again with a test user to
>>> >>>>>>>> > find
>>> >>>> out
>>> >>>>>>>> > the
>>> >>>>>>>> >   > exact
>>> >>>>>>>> >   >>   > error.
>>> >>>>>>>> >   >>   >
>>> >>>>>>>> >   >>   > I don't understand what you mean about syncing the
>>> >>>>>>>> > users
>>> >>>>>> local,
>>> >>>>>>>> >   but
>>> >>>>>>>> >   > we
>>> >>>>>>>> >   >>   did
>>> >>>>>>>> >   >>   > not need to do anything like that.
>>> >>>>>>>> >   >>   >
>>> >>>>>>>> >   >>   > Chris
>>> >>>>>>>> >   >>   >
>>> >>>>>>>> >   >>   >
>>> >>>>>>>> >   >>   >
>>> >>>>>>>> >   >>   >
>>> >>>>>>>> >   >>   > From:   "Matt ." <yamakasi....@gmail.com>
>>> >>>>>>>> >   >>   > To:     Christopher Lamb/Switzerland/IBM@IBMCH
>>> >>>>>>>> >   >>   > Cc:     "freeipa-users@redhat.com"
>>> >>>>> <freeipa-users@redhat.com>
>>> >>>>>>>> >   >>   > Date:   04.08.2015 15:33
>>> >>>>>>>> >   >>   > Subject:        Re: [Freeipa-users] Ubuntu Samba
>>> >>>>>>>> > Server
>>> >>>> Auth
>>> >>>>>>>> >   against
>>> >>>>>>>> >   >>   IPA
>>> >>>>>>>> >   >>   >
>>> >>>>>>>> >   >>   >
>>> >>>>>>>> >   >>   >
>>> >>>>>>>> >   >>   > Hi Chris,
>>> >>>>>>>> >   >>   >
>>> >>>>>>>> >   >>   > A puppet run added another passdb backend, that was
>>> >>> causing
>>> >>>>>> my
>>> >>>>>>>> >   issue.
>>> >>>>>>>> >   >>   >
>>> >>>>>>>> >   >>   > What I still experience is:
>>> >>>>>>>> >   >>   >
>>> >>>>>>>> >   >>   >
>>> >>>>>>>> >   >>   > [2015/08/04 15:29:45.477783,  3]
>>> >>>>>>>> >   >>   > ../source3/auth/check_samsec.c:399(check_sam_security)
>>> >>>>>>>> >   >>   >   check_sam_security: Couldn't find user 'username' in
>>> >>>>>> passdb.
>>> >>>>>>>> >   >>   > [2015/08/04 15:29:45.478026,  2]
>>> >>>>>>>> >   >>   > ../source3/auth/auth.c:288(auth_check_ntlm_password)
>>> >>>>>>>> >   >>   >   check_ntlm_password:  Authentication for user
>>> >> [username]
>>> >>>>> ->
>>> >>>>>>>> >   >>   > [username] FAILED with error NT_STATUS_NO_SUCH_USER
>>> >>>>>>>> >   >>   >
>>> >>>>>>>> >   >>   >
>>> >>>>>>>> >   >>   > I also wonder if I shall still sync the users local,
>>> >>>>>>>> > or
>>> >> is
>>> >>>>> it
>>> >>>>>>>> >   > needed ?
>>> >>>>>>>> >   >>   >
>>> >>>>>>>> >   >>   > Thanks again,
>>> >>>>>>>> >   >>   >
>>> >>>>>>>> >   >>   > Matt
>>> >>>>>>>> >   >>   >
>>> >>>>>>>> >   >>   > 2015-08-04 14:16 GMT+02:00 Christopher Lamb <
>>> >>>>>>>> >   >>   christopher.l...@ch.ibm.com>:
>>> >>>>>>>> >   >>   >> Hi Matt
>>> >>>>>>>> >   >>   >>
>>> >>>>>>>> >   >>   >> From our smb.conf file:
>>> >>>>>>>> >   >>   >>
>>> >>>>>>>> >   >>   >> [global]
>>> >>>>>>>> >   >>   >>    security = user
>>> >>>>>>>> >   >>   >>    passdb backend =
>>> >>>>>>>> > ldapsam:ldap://xxx-ldap2.my.silly.example.com
>>> >>>>>>>> >   >>   >>    ldap suffix = dc=my,dc=silly,dc=example,dc=com
>>> >>>>>>>> >   >>   >>    ldap admin dn = cn=Directory Manager
>>> >>>>>>>> >   >>   >>
>>> >>>>>>>> >   >>   >> So yes, we use Directory Manager, it works for us. I
>>> >> have
>>> >>>>>> not
>>> >>>>>>>> >   tried
>>> >>>>>>>> >   >>   with
>>> >>>>>>>> >   >>   > a
>>> >>>>>>>> >   >>   >> less powerful user, but it is conceivable that a
>>> >>>>>>>> > lesser
>>> >>>>> user
>>> >>>>>>>> > may
>>> >>>>>>>> >   not
>>> >>>>>>>> >   >>   see
>>> >>>>>>>> >   >>   >> all the required attributes, resulting in "no such
>>> >>>>>>>> > user"
>>> >>>>>>>> > errors.
>>> >>>>>>>> >   >>   >>
>>> >>>>>>>> >   >>   >> Chris
>>> >>>>>>>> >   >>   >>
>>> >>>>>>>> >   >>   >>
>>> >>>>>>>> >   >>   >>
>>> >>>>>>>> >   >>   >>
>>> >>>>>>>> >   >>   >> From:   "Matt ." <yamakasi....@gmail.com>
>>> >>>>>>>> >   >>   >> To:     Christopher Lamb/Switzerland/IBM@IBMCH
>>> >>>>>>>> >   >>   >> Cc:     "freeipa-users@redhat.com"
>>> >>>>>> <freeipa-users@redhat.com>
>>> >>>>>>>> >   >>   >> Date:   04.08.2015 13:32
>>> >>>>>>>> >   >>   >> Subject:        Re: [Freeipa-users] Ubuntu Samba
>>> >>>>>>>> > Server
>>> >>>>> Auth
>>> >>>>>>>> >   against
>>> >>>>>>>> >   >>   IPA
>>> >>>>>>>> >   >>   >>
>>> >>>>>>>> >   >>   >>
>>> >>>>>>>> >   >>   >>
>>> >>>>>>>> >   >>   >> Hi Chris,
>>> >>>>>>>> >   >>   >>
>>> >>>>>>>> >   >>   >> Thanks for the heads up, indeed local is 4 I see now
>>> >> when
>>> >>>> I
>>> >>>>>>>> > add a
>>> >>>>>>>> >   >>   >> group from the GUI, great thanks!
>>> >>>>>>>> >   >>   >>
>>> >>>>>>>> >   >>   >> But do you use Directory Manager as ldap admin user
>>> >>>>>>>> > or
>>> >>>> some
>>> >>>>>>>> > other
>>> >>>>>>>> >   >>   >> admin account ?
>>> >>>>>>>> >   >>   >>
>>> >>>>>>>> >   >>   >> I'm not sure id DM is needed and it should get that
>>> >>>>>>>> > deep
>>> >>>>>> into
>>> >>>>>>>> >   IPA.
>>> >>>>>>>> >   >>   >> Also when starting samba it cannot find "such user"
>>> >>>>>>>> > as
>>> >>>> that
>>> >>>>>>>> >   sounds
>>> >>>>>>>> >   >>   >> quite known as it has no UID.
>>> >>>>>>>> >   >>   >>
>>> >>>>>>>> >   >>   >> From your config I see you use DM, this should work ?
>>> >>>>>>>> >   >>   >>
>>> >>>>>>>> >   >>   >> Thanks!
>>> >>>>>>>> >   >>   >>
>>> >>>>>>>> >   >>   >>
>>> >>>>>>>> >   >>   >> Matt
>>> >>>>>>>> >   >>   >>
>>> >>>>>>>> >   >>   >>
>>> >>>>>>>> >   >>   >
>>> >>>>>>>> >   >>   >
>>> >>>>>>>> >   >>   >
>>> >>>>>>>> >   >>   >
>>> >>>>>>>> >   >>
>>> >>>>>>>> >   >>   --
>>> >>>>>>>> >   >>   Manage your subscription for the Freeipa-users mailing
>>> >> list:
>>> >>>>>>>> >   >>   https://www.redhat.com/mailman/listinfo/freeipa-users
>>> >>>>>>>> >   >>   Go to http://freeipa.org for more info on the project
>>> >>>>>>>> >   >>
>>> >>>>>>>> >   >>
>>> >>>>>>>> >   >>
>>> >>>>>>>> >   >
>>> >>>>>>>> >   >
>>> >>>>>>>> >   >
>>> >>>>>>>> >   >
>>> >>>>>>>> >   > --
>>> >>>>>>>> >   > Manage your subscription for the Freeipa-users mailing
>>> >>>>>>>> > list:
>>> >>>>>>>> >   > https://www.redhat.com/mailman/listinfo/freeipa-users
>>> >>>>>>>> >   > Go to http://freeipa.org for more info on the project
>>> >>>>>>>> >   >
>>> >>>>>>>> >   >
>>> >>>>>>>> >   >
>>> >>>>>>>> >   >
>>> >>>>>>>> >
>>> >>>>>>>> >   --
>>> >>>>>>>> >   Manage your subscription for the Freeipa-users mailing list:
>>> >>>>>>>> >   https://www.redhat.com/mailman/listinfo/freeipa-users
>>> >>>>>>>> >   Go to http://freeipa.org for more info on the project
>>> >>>>>>>> >
>>> >>>>>>>> >
>>> >>>>>>>> >
>>> >>>>>>>
>>> >>>>>>>
>>> >>>>>>
>>> >>>>>>
>>> >>>>>>
>>> >>>>>>
>>> >>>>>
>>> >>>>>
>>> >>>>>
>>> >>>>>
>>> >>>>
>>> >>>>
>>> >>>>
>>> >>>>
>>> >>>
>>> >>>
>>> >>>
>>> >>>
>>> >>
>>> >>
>>> >>
>>> >>
>>
>>

-- 
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go to http://freeipa.org for more info on the project

Reply via email to