HI Guys, Anyone still a working clue/test here ?
I didn't came further as it seems there need to be some domain join / match following the freeipa devs. Thanks! Matt 2015-08-13 13:09 GMT+02:00 Matt . <yamakasi....@gmail.com>: > Hi, > > I might have found somthing which I already seen in the logs. > > I did a smbpasswd my username on the samba server, it connects to ldap > very well. I give my new password and get the following: > > smbldap_search_ext: base => [dc=my,dc=domain], filter => > [(&(objectClass=ipaNTGroupAttrs)(|(ipaNTSecurityIdentifier=S-1----my--sid---)))], > scope => [2] > Attribute [displayName] not found. > Could not retrieve 'displayName' attribute from cn=Default SMB > Group,cn=groups,cn=accounts,dc=my,dc=domain > Sid S-1----my--sid--- -> MYDOMAIN\Default SMB Group(2) > > So something is missing! > > Thanks so far guys! > > Cheers, > > Matt > > 2015-08-13 12:02 GMT+02:00 Matt . <yamakasi....@gmail.com>: >> Hi Youenn, >> >> OK thanks! this takes me a little but futher now and I see some good >> stuff in my logging. >> >> I'm testing on a Windows 10 Machine which is not member of an AD or >> so, so that might be my issue for now ? >> >> When testing on the samba box itself as my user I get: >> >> >> [myusername@smb-01 ~]$ smbclient //smb-01.domain.local/shares >> >> ... >> Checking NTLMSSP password for MSP\myusername failed: NT_STATUS_WRONG_PASSWORD >> ... >> SPNEGO login failed: NT_STATUS_WRONG_PASSWORD >> >> >> Maybe I have an issue with encrypted passwords ? >> >> >> When we have this all working, I think we have a howto :D >> >> Thanks! >> >> Matt >> >> 2015-08-13 10:53 GMT+02:00 Youenn PIOLET <piole...@gmail.com>: >>> Hi Matt >>> >>> - CentOS : Did you copy ipasam.so and change your smb.conf accordingly? >>> sambaSamAccount is not needed anymore that way. >>> - Default IPA Way : won't work if your Windows is not part of a domain >>> controller. DOMAIN\username may work for some users using Windows 7 - not 8 >>> nor 10 (it did for me but I was the only one at the office... quite useless) >>> >>> This config may work on your CentOS (for the ipasam way): >>> workgroup = TEST >>> realm = TEST.NET >>> kerberos method = dedicated keytab >>> dedicated keytab file = FILE:/<.....>/samba.keytab >>> create krb5 conf = no >>> security = user >>> encrypt passwords = true >>> passdb backend = ipasam:ldaps://youripa.test.net >>> ldapsam:trusted = yes >>> ldapsuffix = test.net >>> ldap user suffix = cn=users,cn=accounts >>> ldap group suffix = cn=groups,cn=accounts >>> >>> >>> -- >>> Youenn Piolet >>> piole...@gmail.com >>> >>> >>> 2015-08-12 22:15 GMT+02:00 Matt . <yamakasi....@gmail.com>: >>>> >>>> Hi, >>>> >>>> OK the default IPA way works great actually when testing it as described >>>> here: >>>> >>>> http://www.freeipa.org/page/Howto/Integrating_a_Samba_File_Server_With_IPA >>>> >>>> On the samba server I can auth and see my share where I want to connect >>>> to. >>>> >>>> The issue is, on Windows I cannot auth, even when I do DOMAIN\username >>>> as username >>>> >>>> So, the IPA way should work. >>>> >>>> Any comments here ? >>>> >>>> Cheers, >>>> >>>> Matt >>>> >>>> 2015-08-12 19:00 GMT+02:00 Matt . <yamakasi....@gmail.com>: >>>> > HI GUys, >>>> > >>>> > I'm testing this out and I think I almost setup, this on a CentOS samba >>>> > server. >>>> > >>>> > I'm using the ipa-adtrust way of Youeen but it seems we still need to >>>> > add (objectclass=sambaSamAccount)) ? >>>> > >>>> > Info is welcome! >>>> > >>>> > I will report back when I have it working. >>>> > >>>> > Thanks! >>>> > >>>> > Matt >>>> > >>>> > 2015-08-10 11:16 GMT+02:00 Christopher Lamb >>>> > <christopher.l...@ch.ibm.com>: >>>> >> The next route I will try - is the one Youeen took, using ipa-adtrust >>>> >> >>>> >> >>>> >> >>>> >> From: "Matt ." <yamakasi....@gmail.com> >>>> >> To: Christopher Lamb/Switzerland/IBM@IBMCH, >>>> >> "freeipa-users@redhat.com" <freeipa-users@redhat.com> >>>> >> Date: 10.08.2015 10:03 >>>> >> Subject: Re: [Freeipa-users] Ubuntu Samba Server Auth against >>>> >> IPA >>>> >> >>>> >> >>>> >> >>>> >> Hi Chris, >>>> >> >>>> >> Okay this is good to hear. >>>> >> >>>> >> But don't we want a IPA managed Scheme ? >>>> >> >>>> >> When I did a "ipa-adtrust-install --add-sids" it also wanted a local >>>> >> installed Samba and I wonder why. >>>> >> >>>> >> Good that we make some progres on making it all clear. >>>> >> >>>> >> Cheers, >>>> >> >>>> >> Matt >>>> >> >>>> >> 2015-08-10 6:12 GMT+02:00 Christopher Lamb >>>> >> <christopher.l...@ch.ibm.com>: >>>> >>> ldapsam + the samba extensions, pretty much as described in the >>>> >> Techslaves >>>> >>> article. Once I have a draft for the wiki page, I will mail you. >>>> >>> >>>> >>> >>>> >>> >>>> >>> From: "Matt ." <yamakasi....@gmail.com> >>>> >>> To: Christopher Lamb/Switzerland/IBM@IBMCH, >>>> >>> "freeipa-users@redhat.com" <freeipa-users@redhat.com> >>>> >>> Date: 09.08.2015 21:17 >>>> >>> Subject: Re: [Freeipa-users] Ubuntu Samba Server Auth against >>>> >>> IPA >>>> >>> >>>> >>> >>>> >>> >>>> >>> Hi, >>>> >>> >>>> >>> Yes I know about "anything" but which way did you use now ? >>>> >>> >>>> >>> >>>> >>> >>>> >>> 2015-08-09 20:56 GMT+02:00 Christopher Lamb >>>> >> <christopher.l...@ch.ibm.com>: >>>> >>>> Hi Matt >>>> >>>> >>>> >>>> I am on OEL 7.1. - so anything that works on that should be good for >>>> >> RHEL >>>> >>>> and Centos 7.x >>>> >>>> >>>> >>>> I intend to add a how-to to the FreeIPA Wiki over the next few days. >>>> >>>> As >>>> >>> we >>>> >>>> have suggested earlier, we will likely end up with several, one for >>>> >>>> each >>>> >>> of >>>> >>>> the possible integration paths. >>>> >>>> >>>> >>>> Chris >>>> >>>> >>>> >>>> >>>> >>>> >>>> >>>> >>>> >>>> >>>> >>>> From: "Matt ." <yamakasi....@gmail.com> >>>> >>>> To: Christopher Lamb/Switzerland/IBM@IBMCH, >>>> >>>> "freeipa-users@redhat.com" <freeipa-users@redhat.com> >>>> >>>> Date: 09.08.2015 16:45 >>>> >>>> Subject: Re: [Freeipa-users] Ubuntu Samba Server Auth against >>>> >>>> IPA >>>> >>>> >>>> >>>> >>>> >>>> >>>> >>>> Hi Chris, >>>> >>>> >>>> >>>> This sounds great! >>>> >>>> >>>> >>>> What are you using now, both CentOS ? So Samba and FreeIPA ? >>>> >>>> >>>> >>>> Maybe it's good to explain which way you used now in steps too, so we >>>> >>>> can combine or create multiple howto's ? >>>> >>>> >>>> >>>> At least we are going somewhere! >>>> >>>> >>>> >>>> Thanks, >>>> >>>> >>>> >>>> Matt >>>> >>>> >>>> >>>> 2015-08-09 14:54 GMT+02:00 Christopher Lamb >>>> >>> <christopher.l...@ch.ibm.com>: >>>> >>>>> Hi Matt >>>> >>>>> >>>> >>>>> My test integration of FreeIPA 4.x and Samba 4.x with the "good old >>>> >>> Samba >>>> >>>>> Schema extensions) is up and working, almost flawlessly. >>>> >>>>> >>>> >>>>> I can add users and groups via the FreeIPA CLI, and they get the >>>> >> correct >>>> >>>>> ObjectClasses / attributes required for Samba. >>>> >>>>> >>>> >>>>> So far I have not yet bothered to try the extensions to the WebUI, >>>> >>>> because >>>> >>>>> it is currently giving me the classic "Your session has expired. >>>> >>>>> Please >>>> >>>>> re-login." error which renders the WebUI useless. >>>> >>>>> >>>> >>>>> The only problem I have so far encountered managing Samba / FreeIPA >>>> >>> users >>>> >>>>> via FreeIPA CLI commands is with the handling of the attribute >>>> >>>>> sambaPwdLastSet. This is the subject of an existing thread, also >>>> >> updated >>>> >>>>> today. >>>> >>>>> >>>> >>>>> There is also an existing alternative to hacking group.py, using >>>> >>>>> "Class >>>> >>>> of >>>> >>>>> Service" (Cos) documented in this thread from February 2015 >>>> >>>>> >>>> >>> >>>> >>> https://www.redhat.com/archives/freeipa-users/2015-February/msg00172.html >>>> >>>> . >>>> >>>>> I have not yet tried it, but it sounds reasonable. >>>> >>>>> >>>> >>>>> Chris >>>> >>>>> >>>> >>>>> >>>> >>>>> >>>> >>>>> >>>> >>>>> >>>> >>>>> From: "Matt ." <yamakasi....@gmail.com> >>>> >>>>> To: Christopher Lamb/Switzerland/IBM@IBMCH >>>> >>>>> Cc: "freeipa-users@redhat.com" <freeipa-users@redhat.com>, >>>> >>>>> Youenn >>>> >>>>> PIOLET <piole...@gmail.com> >>>> >>>>> Date: 06.08.2015 16:19 >>>> >>>>> Subject: Re: [Freeipa-users] Ubuntu Samba Server Auth against >>>> >> IPA >>>> >>>>> >>>> >>>>> >>>> >>>>> >>>> >>>>> Hi Chris, >>>> >>>>> >>>> >>>>> OK, than we might create two different versions of the wiki, I think >>>> >>>>> this is nice. >>>> >>>>> >>>> >>>>> I'm still figuring out why I get that: >>>> >>>>> >>>> >>>>> IPA Error 4205: ObjectclassViolation >>>> >>>>> >>>> >>>>> missing attribute "sambaGroupType" required by object class >>>> >>>>> "sambaGroupMapping" >>>> >>>>> >>>> >>>>> Matt >>>> >>>>> >>>> >>>>> 2015-08-06 16:09 GMT+02:00 Christopher Lamb >>>> >>>> <christopher.l...@ch.ibm.com>: >>>> >>>>>> Hi Matt >>>> >>>>>> >>>> >>>>>> As far as I can make out, there are at least 2 viable Samba / >>>> >>>>>> FreeIPA >>>> >>>>>> integration paths. >>>> >>>>>> >>>> >>>>>> The route I took is suited where there is no Active Directory >>>> >> involved: >>>> >>>>> In >>>> >>>>>> my case all the Windows, OSX and Linux clients are islands that sit >>>> >>>>>> on >>>> >>>>> the >>>> >>>>>> same network. >>>> >>>>>> >>>> >>>>>> The route that Youenn has taken (unless I have got completely the >>>> >> wrong >>>> >>>>> end >>>> >>>>>> of the stick) requires Active Directory in the architecture. >>>> >>>>>> >>>> >>>>>> Chris >>>> >>>>>> >>>> >>>>>> >>>> >>>>>> >>>> >>>>>> From: "Matt ." <yamakasi....@gmail.com> >>>> >>>>>> To: Youenn PIOLET <piole...@gmail.com> >>>> >>>>>> Cc: Christopher Lamb/Switzerland/IBM@IBMCH, >>>> >>>>>> "freeipa-users@redhat.com" <freeipa-users@redhat.com> >>>> >>>>>> Date: 06.08.2015 14:42 >>>> >>>>>> Subject: Re: [Freeipa-users] Ubuntu Samba Server Auth >>>> >>>>>> against >>>> >>> IPA >>>> >>>>>> >>>> >>>>>> >>>> >>>>>> >>>> >>>>>> Hi, >>>> >>>>>> >>>> >>>>>> OK, this sounds already quite logical, but I'm still refering to >>>> >>>>>> the >>>> >>>>>> old howto we found earlier, does that one still apply somewhere or >>>> >>>>>> not >>>> >>>>>> at all ? >>>> >>>>>> >>>> >>>>>> Thanks, >>>> >>>>>> >>>> >>>>>> Matt >>>> >>>>>> >>>> >>>>>> >>>> >>>>>> >>>> >>>>>> 2015-08-06 12:23 GMT+02:00 Youenn PIOLET <piole...@gmail.com>: >>>> >>>>>>> Hey guys, >>>> >>>>>>> >>>> >>>>>>> I'll try to make a tutorial soon, sorry I'm quite in a rush these >>>> >>>>> days :) >>>> >>>>>>> >>>> >>>>>>> General idea: >>>> >>>>>>> >>>> >>>>>>> On FreeIPA (4.1) >>>> >>>>>>> - `ipa-adtrust-install --add-sids` (creates >>>> >>>>>>> ipaNTsecurityidentifier >>>> >>>>>>> attribude, also known as SID) >>>> >>>>>>> - regenerate each user password to build ipaNTHash attribute, not >>>> >> here >>>> >>>>> by >>>> >>>>>>> default on users >>>> >>>>>>> - use your ldap browser to check ipaNTHash values are here on user >>>> >>>>>> objects >>>> >>>>>>> - create a CIFS service for your samba server >>>> >>>>>>> - Create user roles/permissions as described here: >>>> >>>>>>> >>>> >>>>>> >>>> >>>>> >>>> >>>> >>>> >>> >>>> >> >>>> >> http://freeipa-users.redhat.narkive.com/ez2uKpFS/authenticate-samba-3-or-4-with-freeipa >>>> >> >>>> >>> >>>> >>>> >>>> >>>>> >>>> >>>>>> >>>> >>>>>>> so that CIFS service will be able to read ipaNTsecurityidentifier >>>> >>>>>>> and >>>> >>>>>>> ipaNTHash attributes in LDAP (ACI) >>>> >>>>>>> - SCP ipasam.so module to your cifs server (this is the magic >>>> >> trick) : >>>> >>>>>> scp >>>> >>>>>>> /usr/lib64/samba/pdb/ipasam.so >>>> >>>>>>> root@samba-server.domain:/usr/lib64/samba/pdb/ You can also try to >>>> >>>>>> recompile >>>> >>>>>>> it. >>>> >>>>>>> >>>> >>>>>>> On SAMBA Server side (CentOS 7...) >>>> >>>>>>> - Install server keytab file for CIFS >>>> >>>>>>> - check ipasam.so is here. >>>> >>>>>>> - check you can read password hash in LDAP with `ldapsearch -Y >>>> >>>>>>> GSSAPI >>>> >>>>>>> uid=admin ipaNTHash` thanks to kerberos >>>> >>>>>>> - make your smb.conf following the linked thread and restart >>>> >>>>>>> service >>>> >>>>>>> >>>> >>>>>>> I don't know if it works in Ubuntu. I know sssd has evolved >>>> >>>>>>> quickly >>>> >>> and >>>> >>>>>>> ipasam may use quite recent functionalities, the best is to just >>>> >>>>>>> try. >>>> >>>>> You >>>> >>>>>>> can read in previous thread : "If you insist on Ubuntu you need to >>>> >> get >>>> >>>>>>> ipasam somewhere, most likely to compile it yourself". >>>> >>>>>>> >>>> >>>>>>> Make sure your user has ipaNTHash attribute :) >>>> >>>>>>> >>>> >>>>>>> You may want to debug authentication on samba server, I usually do >>>> >>>> this: >>>> >>>>>>> `tail -f /var/log/samba/log* | grep <username> >>>> >>>>>>> >>>> >>>>>>> Cheers >>>> >>>>>>> -- >>>> >>>>>>> Youenn Piolet >>>> >>>>>>> piole...@gmail.com >>>> >>>>>>> >>>> >>>>>>> >>>> >>>>>>> 2015-08-05 17:40 GMT+02:00 Matt . <yamakasi....@gmail.com>: >>>> >>>>>>>> >>>> >>>>>>>> Hi, >>>> >>>>>>>> >>>> >>>>>>>> This sounds great to me too, but a howto would help to make it >>>> >>>>>>>> more >>>> >>>>>>>> clear about what you have done here. The thread confuses me a >>>> >>>>>>>> little >>>> >>>>>>>> bit. >>>> >>>>>>>> >>>> >>>>>>>> Can you paste your commands so we can test out too and report >>>> >>>>>>>> back ? >>>> >>>>>>>> >>>> >>>>>>>> Thanks! >>>> >>>>>>>> >>>> >>>>>>>> Matt >>>> >>>>>>>> >>>> >>>>>>>> 2015-08-05 15:18 GMT+02:00 Christopher Lamb >>>> >>>>>> <christopher.l...@ch.ibm.com>: >>>> >>>>>>>> > Hi Youenn >>>> >>>>>>>> > >>>> >>>>>>>> > Good news that you have got an integration working >>>> >>>>>>>> > >>>> >>>>>>>> > Now you have got it going, and the solution is fresh in your >>>> >>>>>>>> > mind, >>>> >>>>> how >>>> >>>>>>>> > about adding a How-to page on this solution to the FreeIPA >>>> >>>>>>>> > wiki? >>>> >>>>>>>> > >>>> >>>>>>>> > Chris >>>> >>>>>>>> > >>>> >>>>>>>> > >>>> >>>>>>>> > >>>> >>>>>>>> > From: Youenn PIOLET <piole...@gmail.com> >>>> >>>>>>>> > To: "Matt ." <yamakasi....@gmail.com> >>>> >>>>>>>> > Cc: Christopher Lamb/Switzerland/IBM@IBMCH, >>>> >>>>>>>> > "freeipa-users@redhat.com" >>>> >>>>>>>> > <freeipa-users@redhat.com> >>>> >>>>>>>> > Date: 05.08.2015 14:51 >>>> >>>>>>>> > Subject: Re: [Freeipa-users] Ubuntu Samba Server Auth >>>> >>> against >>>> >>>>>> IPA >>>> >>>>>>>> > >>>> >>>>>>>> > >>>> >>>>>>>> > >>>> >>>>>>>> > Hi guys, >>>> >>>>>>>> > >>>> >>>>>>>> > Thank you so much your previous answers. >>>> >>>>>>>> > I realised my SID were stored in ipaNTsecurityidentifier, >>>> >>>>>>>> > thanks >>>> >> to >>>> >>>>>>>> > ipa-adtrust-install --add-sids >>>> >>>>>>>> > >>>> >>>>>>>> > I found an other way to configure smb here: >>>> >>>>>>>> > >>>> >>>>>>>> > >>>> >>>>>> >>>> >>>>> >>>> >>>> >>>> >>> >>>> >> >>>> >> http://freeipa-users.redhat.narkive.com/ez2uKpFS/authenticate-samba-3-or-4-with-freeipa >>>> >> >>>> >>> >>>> >>>> >>>> >>>>> >>>> >>>>>> >>>> >>>>>>>> > It works perfectly. >>>> >>>>>>>> > >>>> >>>>>>>> > I'm using module ipasam.so I have manually scp to the samba >>>> >> server, >>>> >>>>>>>> > Samba is set to use kerberos + ldapsam via this ipasam module. >>>> >>>>>>>> > Following the instructions, I created a user role allowing >>>> >>>>>>>> > service >>>> >>>>>>>> > principal to read ipaNTHash value from the LDAP. >>>> >>>>>>>> > ipaNTHash are generated each time a user changes his password. >>>> >>>>>>>> > Authentication works perfectly on Windows 7, 8 and 10. >>>> >>>>>>>> > >>>> >>>>>>>> > For more details, the previously linked thread is quite clear. >>>> >>>>>>>> > >>>> >>>>>>>> > Cheers >>>> >>>>>>>> > >>>> >>>>>>>> > -- >>>> >>>>>>>> > Youenn Piolet >>>> >>>>>>>> > piole...@gmail.com >>>> >>>>>>>> > >>>> >>>>>>>> > >>>> >>>>>>>> > 2015-08-05 11:10 GMT+02:00 Matt . <yamakasi....@gmail.com>: >>>> >>>>>>>> > Hi Chris. >>>> >>>>>>>> > >>>> >>>>>>>> > Yes, Apache Studio did that but I was not sure why it >>>> >>>>>>>> > complained >>>> >>>> it >>>> >>>>>>>> > was "already" there. >>>> >>>>>>>> > >>>> >>>>>>>> > I'm still getting: >>>> >>>>>>>> > >>>> >>>>>>>> > IPA Error 4205: ObjectclassViolation >>>> >>>>>>>> > >>>> >>>>>>>> > missing attribute "sambaGroupType" required by object class >>>> >>>>>>>> > "sambaGroupMapping" >>>> >>>>>>>> > >>>> >>>>>>>> > When adding a user. >>>> >>>>>>>> > >>>> >>>>>>>> > I also see "class" as fielname under my "Last name", this is >>>> >>>>>>>> > not >>>> >>>> OK >>>> >>>>>>>> > also. >>>> >>>>>>>> > >>>> >>>>>>>> > >>>> >>>>>>>> > >>>> >>>>>>>> > We sure need to make some howto, I think we can nail this >>>> >> down :) >>>> >>>>>>>> > >>>> >>>>>>>> > Thanks for the heads up! >>>> >>>>>>>> > >>>> >>>>>>>> > Matthijs >>>> >>>>>>>> > >>>> >>>>>>>> > 2015-08-05 7:51 GMT+02:00 Christopher Lamb >>>> >>>>>>>> > <christopher.l...@ch.ibm.com>: >>>> >>>>>>>> > > Hi Matt >>>> >>>>>>>> > > >>>> >>>>>>>> > > If I use Apache Directory Studio to add an attribute >>>> >>>>>> ipaCustomFields >>>> >>>>>>>> > to >>>> >>>>>>>> > > cn=ipaConfig,cn=etc, the operation it performs is a modify, >>>> >>>>>>>> > as >>>> >>>>>> shown >>>> >>>>>>>> > below: >>>> >>>>>>>> > > >>>> >>>>>>>> > > #!RESULT OK >>>> >>>>>>>> > > #!CONNECTION ldap://xxx-ldap2.my.silly.example.com:yyy >>>> >>>>>>>> > > #!DATE 2015-08-05T05:45:04.608 >>>> >>>>>>>> > > dn: cn=ipaConfig,cn=etc,dc=my,dc=silly,dc=example,dc=com >>>> >>>>>>>> > > changetype: modify >>>> >>>>>>>> > > add: ipaCustomFields >>>> >>>>>>>> > > ipaCustomFields: Samba Group Type,sambagrouptype,true >>>> >>>>>>>> > > >>>> >>>>>>>> > > After that I then have a visible attribute ipaCustomFields >>>> >>>>>>>> > as >>>> >>>>>>>> > expected. >>>> >>>>>>>> > > >>>> >>>>>>>> > > When adding the attribute, the wizard offered me >>>> >>>>> "ipaCustomFields" >>>> >>>>>>>> > as >>>> >>>>>>>> > > attribute type in a drop down list. >>>> >>>>>>>> > > >>>> >>>>>>>> > > Once we get this cracked, we really must write a how-to on >>>> >>>>>>>> > the >>>> >>>>>>>> > FreeIPA >>>> >>>>>>>> > > Wiki. >>>> >>>>>>>> > > >>>> >>>>>>>> > > Chris >>>> >>>>>>>> > > >>>> >>>>>>>> > > >>>> >>>>>>>> > > >>>> >>>>>>>> > > From: Christopher Lamb/Switzerland/IBM@IBMCH >>>> >>>>>>>> > > To: "Matt ." <yamakasi....@gmail.com> >>>> >>>>>>>> > > Cc: "freeipa-users@redhat.com" >>>> >>>>>>>> > <freeipa-users@redhat.com> >>>> >>>>>>>> > > Date: 05.08.2015 07:31 >>>> >>>>>>>> > > Subject: Re: [Freeipa-users] Ubuntu Samba Server >>>> >>>>>>>> > Auth >>>> >>>>>> against >>>> >>>>>>>> > IPA >>>> >>>>>>>> > > Sent by: freeipa-users-boun...@redhat.com >>>> >>>>>>>> > > >>>> >>>>>>>> > > >>>> >>>>>>>> > > >>>> >>>>>>>> > > Hi Matt >>>> >>>>>>>> > > >>>> >>>>>>>> > > I also got the same result at that step, but can see >>>> >>>>>>>> > nothing >>>> >> in >>>> >>>>>>>> > Apache >>>> >>>>>>>> > > Directory Studio. >>>> >>>>>>>> > > >>>> >>>>>>>> > > As I am using existing Samba / FreeIPA groups migrated >>>> >>>>>>>> > across, >>>> >>>>>> they >>>> >>>>>>>> > > probably were migrated with all the required attributes. >>>> >>>>>>>> > > >>>> >>>>>>>> > > Looking more closely at that LDIF: I wonder should it not >>>> >>>>>>>> > be: >>>> >>>>>>>> > > >>>> >>>>>>>> > > ldapmodify -Y GSSAPI <<EOF >>>> >>>>>>>> > > dn: cn=ipaconfig,cn=etc,dc=domain,dc=tld >>>> >>>>>>>> > > changetype: modify >>>> >>>>>>>> > > add: ipaCustomFields >>>> >>>>>>>> > > ipaCustomFields: "Samba Group Type,sambagrouptype,true" >>>> >>>>>>>> > > EOF >>>> >>>>>>>> > > >>>> >>>>>>>> > > i.e. changetype: modify, instead of changetype add ? >>>> >>>>>>>> > > >>>> >>>>>>>> > > I don't want to play around with my prod directory - I will >>>> >>>> setup >>>> >>>>>> an >>>> >>>>>>>> > EL >>>> >>>>>>>> > 7.1 >>>> >>>>>>>> > > VM and install FreeIPA 4.x and Samba 4.x That will allow me >>>> >>>>>>>> > to >>>> >>>>>> play >>>> >>>>>>>> > around >>>> >>>>>>>> > > more destructively. >>>> >>>>>>>> > > >>>> >>>>>>>> > > Chris >>>> >>>>>>>> > > >>>> >>>>>>>> > > >>>> >>>>>>>> > > >>>> >>>>>>>> > > >>>> >>>>>>>> > > >>>> >>>>>>>> > > From: "Matt ." <yamakasi....@gmail.com> >>>> >>>>>>>> > > To: Christopher Lamb/Switzerland/IBM@IBMCH >>>> >>>>>>>> > > Cc: Youenn PIOLET <piole...@gmail.com>, " >>>> >>>>>>>> > freeipa-users@redhat.com" >>>> >>>>>>>> > > <freeipa-users@redhat.com> >>>> >>>>>>>> > > Date: 05.08.2015 01:01 >>>> >>>>>>>> > > Subject: Re: [Freeipa-users] Ubuntu Samba >>>> >>> Server >>>> >>>>>>>> > Auth >>>> >>>>>>>> > against IPA >>>> >>>>>>>> > > >>>> >>>>>>>> > > >>>> >>>>>>>> > > >>>> >>>>>>>> > > Hi Chris, >>>> >>>>>>>> > > >>>> >>>>>>>> > > I'm at the right path, but my issue is that: >>>> >>>>>>>> > > >>>> >>>>>>>> > > ldapmodify -Y GSSAPI <<EOF >>>> >>>>>>>> > > dn: cn=ipaconfig,cn=etc,dc=domain,dc=tld >>>> >>>>>>>> > > changetype: add >>>> >>>>>>>> > > add: ipaCustomFields >>>> >>>>>>>> > > ipaCustomFields: "Samba Group Type,sambagrouptype,true" >>>> >>>>>>>> > > EOF >>>> >>>>>>>> > > >>>> >>>>>>>> > > Does say it exists, my ldap explorer doesn't show it, and >>>> >>>>>>>> > when >>>> >>> I >>>> >>>>>> add >>>> >>>>>>>> > > it manually as an attribute it still fails when I add a >>>> >>>>>>>> > user >>>> >> on >>>> >>>>>> this >>>> >>>>>>>> > > sambagrouptype as it's needed by the other attributes >>>> >>>>>>>> > > >>>> >>>>>>>> > > So that is my issue I think so far. >>>> >>>>>>>> > > >>>> >>>>>>>> > > Any clue about that ? >>>> >>>>>>>> > > >>>> >>>>>>>> > > No problem "you don't know something or are no guru" we are >>>> >> all >>>> >>>>>>>> > > learning! :) >>>> >>>>>>>> > > >>>> >>>>>>>> > > Cheers, >>>> >>>>>>>> > > >>>> >>>>>>>> > > Matt >>>> >>>>>>>> > > >>>> >>>>>>>> > > >>>> >>>>>>>> > > 2015-08-04 21:22 GMT+02:00 Christopher Lamb < >>>> >>>>>>>> > christopher.l...@ch.ibm.com>: >>>> >>>>>>>> > >> Hi Matt, Youeen >>>> >>>>>>>> > >> >>>> >>>>>>>> > >> Just to set the background properly, I did not invent this >>>> >>>>>> process. >>>> >>>>>>>> > I >>>> >>>>>>>> > > know >>>> >>>>>>>> > >> only a little about FreeIPA, and almost nothing about >>>> >>>>>>>> > Samba, >>>> >>>> but >>>> >>>>>> I >>>> >>>>>>>> > guess >>>> >>>>>>>> > > I >>>> >>>>>>>> > >> was lucky enough to get the integration working on a >>>> >>>>>>>> > Sunday >>>> >>>>>>>> > afternoon. >>>> >>>>>>>> > (I >>>> >>>>>>>> > >> did have an older FreeIPA 3.x / Samba 3.x installation as >>>> >>>>>>>> > a >>>> >>>>>>>> > reference). >>>> >>>>>>>> > >> >>>> >>>>>>>> > >> It sounds like we need to step back, and look at the test >>>> >> user >>>> >>>>>> and >>>> >>>>>>>> > group >>>> >>>>>>>> > > in >>>> >>>>>>>> > >> the FreeIPA LDAP tree. I find using an LDAP browser makes >>>> >> this >>>> >>>>>> much >>>> >>>>>>>> > > easier. >>>> >>>>>>>> > >> >>>> >>>>>>>> > >> My FreeIPA / Samba Users have the following Samba >>>> >>>>>>>> > extensions >>>> >>> in >>>> >>>>>>>> > FreeIPA >>>> >>>>>>>> > >> (cn=accounts, cn=users): >>>> >>>>>>>> > >> >>>> >>>>>>>> > >> * objectClass: sambasamaccount >>>> >>>>>>>> > >> >>>> >>>>>>>> > >> * Attributes: sambaSID, sambaNTPassword, sambaPwdLastSet >>>> >>>>>>>> > >> >>>> >>>>>>>> > >> My FreeIPA / Samba Groups have the following Samba >>>> >>>>>>>> > extensions >>>> >>>> in >>>> >>>>>>>> > FreeIPA >>>> >>>>>>>> > >> (cn=accounts, cn=groups): >>>> >>>>>>>> > >> >>>> >>>>>>>> > >> * objectClass: sambaGroupMapping >>>> >>>>>>>> > >> >>>> >>>>>>>> > >> * Attributes: sambaGroupType, sambaSID >>>> >>>>>>>> > >> >>>> >>>>>>>> > >> The Users must belong to one or more of the samba groups >>>> >>>>>>>> > that >>>> >>>>> you >>>> >>>>>>>> > have >>>> >>>>>>>> > >> setup. >>>> >>>>>>>> > >> >>>> >>>>>>>> > >> If you don't have something similar to the above (which >>>> >> sounds >>>> >>>>>> like >>>> >>>>>>>> > it >>>> >>>>>>>> > is >>>> >>>>>>>> > >> the case), then something went wrong applying the >>>> >>>>>>>> > extensions. >>>> >>>> It >>>> >>>>>>>> > would >>>> >>>>>>>> > be >>>> >>>>>>>> > >> worth testing comparing a new user / group created post >>>> >> adding >>>> >>>>>> the >>>> >>>>>>>> > >> extensions to a previous existing user. >>>> >>>>>>>> > >> >>>> >>>>>>>> > >> i.e. >>>> >>>>>>>> > >> are the extensions missing on existing users / groups? >>>> >>>>>>>> > >> are the extensions missing on new users / groups? >>>> >>>>>>>> > >> >>>> >>>>>>>> > >> Cheers >>>> >>>>>>>> > >> >>>> >>>>>>>> > >> Chris >>>> >>>>>>>> > >> >>>> >>>>>>>> > >> >>>> >>>>>>>> > >> >>>> >>>>>>>> > >> >>>> >>>>>>>> > >> >>>> >>>>>>>> > >> From: Youenn PIOLET <piole...@gmail.com> >>>> >>>>>>>> > >> To: "Matt ." <yamakasi....@gmail.com> >>>> >>>>>>>> > >> Cc: Christopher Lamb/Switzerland/IBM@IBMCH, >>>> >>>>>>>> > >> "freeipa-users@redhat.com" >>>> >>>>> <freeipa-users@redhat.com> >>>> >>>>>>>> > >> Date: 04.08.2015 18:56 >>>> >>>>>>>> > >> Subject: Re: [Freeipa-users] Ubuntu Samba Server >>>> >>>>>>>> > Auth >>>> >>>>>>>> > against >>>> >>>>>>>> > IPA >>>> >>>>>>>> > >> >>>> >>>>>>>> > >> >>>> >>>>>>>> > >> >>>> >>>>>>>> > >> Hi there, >>>> >>>>>>>> > >> >>>> >>>>>>>> > >> I have difficulties to follow you at this point :) >>>> >>>>>>>> > >> Here is what I've done and what I've understood: >>>> >>>>>>>> > >> >>>> >>>>>>>> > >> ## SMB Side >>>> >>>>>>>> > >> - Testparm OK >>>> >>>>>>>> > >> - I've got the same NT_STATUS_NO_SUCH_USER when I try to >>>> >>>>> connect. >>>> >>>>>>>> > >> - pdbedit -Lv output is all successfull but I can see >>>> >>>>>>>> > there >>>> >> is >>>> >>>> a >>>> >>>>>>>> > filter : >>>> >>>>>>>> > >> (&(uid=*)(objectclass=sambaSamAccount). In LDAP, the users >>>> >>>> don't >>>> >>>>>>>> > have >>>> >>>>>>>> > >> sambaSamAccount. >>>> >>>>>>>> > >> >>>> >>>>>>>> > >> ## LDAP / FreeIPA side >>>> >>>>>>>> > >> - Since SMB server uses LDAP, I did ipa-adtrust-install on >>>> >>>>>>>> > my >>>> >>>>>>>> > FreeIPA >>>> >>>>>>>> > >> server to get samba LDAP extensions. >>>> >>>>>>>> > >> - I can see samba classes exist in LDAP but are not used >>>> >>>>>>>> > on >>>> >> my >>>> >>>>>>>> > group >>>> >>>>>>>> > >> objects nor my user objects >>>> >>>>>>>> > >> - I have add sambaSamAccount in FreeIPA default user >>>> >>>>>>>> > classes, >>>> >>>>>>>> > >> and sambaGroupMapping to default group classes. In that >>>> >>>>>>>> > state >>>> >>> I >>>> >>>>>>>> > can't >>>> >>>>>>>> > >> create user nor groups anymore, as new samba attributes >>>> >>>>>>>> > are >>>> >>>>>> needed >>>> >>>>>>>> > for >>>> >>>>>>>> > >> instantiation. >>>> >>>>>>>> > >> - I have add in etc ipaCustomFields: 'Samba Group >>>> >>>>>>>> > > Type,sambagrouptype,true' >>>> >>>>>>>> > >> but I don't get what it does. >>>> >>>>>>>> > >> - I tried to add the samba.js plugin. It works, and adds >>>> >>>>>>>> > the >>>> >>>>>>>> > "local" >>>> >>>>>>>> > > option >>>> >>>>>>>> > >> when creating a group in FreeIPA, supposed to set >>>> >>>> sambagrouptype >>>> >>>>>> to >>>> >>>>>>>> > 4 >>>> >>>>>>>> > or >>>> >>>>>>>> > > 2 >>>> >>>>>>>> > >> (domain). It doesn't work and tells that sambagrouptype >>>> >>>>> attribute >>>> >>>>>>>> > doesn't >>>> >>>>>>>> > >> exist (but it should now I put sambaGroupType class by >>>> >>>>>> default...) >>>> >>>>>>>> > >> >>>> >>>>>>>> > >> ## Questions >>>> >>>>>>>> > >> 0) Can I ask samba not to search sambaSamAccount and use >>>> >>> unix / >>>> >>>>>>>> > posix >>>> >>>>>>>> > >> instead? I guess no. >>>> >>>>>>>> > >> 1) How to generate the user/group SIDs ? They are >>>> >>>>>>>> > requested >>>> >> to >>>> >>>>>> add >>>> >>>>>>>> > >> sambaSamAccount classes. >>>> >>>>>>>> > >> This article doesn't seem relevant since we don't use >>>> >>>>>>>> > domain >>>> >>>>>>>> > controller >>>> >>>>>>>> > >> >>>> >>>>>>>> > > >>>> >>>>>>>> > >>>> >>>>>>>> > >>>> >>>>>> >>>> >>>>> >>>> >>>> >>>> >>> >>>> >> >>>> >> http://docs.fedoraproject.org/en-US/Fedora/17/html/FreeIPA_Guide/cifs.html >>>> >>>>>>>> > >>>> >>>>>>>> > >> and netgetlocalsid returns an error. >>>> >>>>>>>> > >> 2) How to fix samba.js plugin? >>>> >>>>>>>> > >> 3) I guess an equivalent of samba.js is needed for user >>>> >>>>> creation, >>>> >>>>>>>> > where >>>> >>>>>>>> > > can >>>> >>>>>>>> > >> I find it? >>>> >>>>>>>> > >> 4) Is your setup working with Windows 8 / Windows 10 and >>>> >>>>>>>> > not >>>> >>>>> only >>>> >>>>>>>> > Windows >>>> >>>>>>>> > >> 7? >>>> >>>>>>>> > >> >>>> >>>>>>>> > >> Thanks a lot for your previous and future answers >>>> >>>>>>>> > >> >>>> >>>>>>>> > >> -- >>>> >>>>>>>> > >> Youenn Piolet >>>> >>>>>>>> > >> piole...@gmail.com >>>> >>>>>>>> > >> >>>> >>>>>>>> > >> >>>> >>>>>>>> > >> 2015-08-04 17:55 GMT+02:00 Matt . >>>> >>>>>>>> > <yamakasi....@gmail.com>: >>>> >>>>>>>> > >> Hi, >>>> >>>>>>>> > >> >>>> >>>>>>>> > >> Yes, log is anonymised. >>>> >>>>>>>> > >> >>>> >>>>>>>> > >> It's strange, my user doesn't have a SambaPwdLastSet, >>>> >>>>>>>> > also >>>> >>>>> when >>>> >>>>>> I >>>> >>>>>>>> > >> change it's password it doesn't get it in ldap. >>>> >>>>>>>> > >> >>>> >>>>>>>> > >> There must be something going wrong I guess. >>>> >>>>>>>> > >> >>>> >>>>>>>> > >> Matt >>>> >>>>>>>> > >> >>>> >>>>>>>> > >> 2015-08-04 17:45 GMT+02:00 Christopher Lamb >>>> >>>>>>>> > > <christopher.l...@ch.ibm.com >>>> >>>>>>>> > >> >: >>>> >>>>>>>> > >> > Hi Matt >>>> >>>>>>>> > >> > >>>> >>>>>>>> > >> > I assume [username] is a real username, identical to >>>> >>>>>>>> > that >>>> >>>> in >>>> >>>>>>>> > the >>>> >>>>>>>> > >> FreeIPA >>>> >>>>>>>> > >> > cn=accounts, cn=users tree? (i.e. you anonymised the >>>> >>>>>>>> > log >>>> >>>>>>>> > extract). >>>> >>>>>>>> > >> > >>>> >>>>>>>> > >> > You user should be a member of the appropriate samba >>>> >>> groups >>>> >>>>>>>> > that >>>> >>>>>>>> > you >>>> >>>>>>>> > >> setup >>>> >>>>>>>> > >> > in FreeIPA. >>>> >>>>>>>> > >> > >>>> >>>>>>>> > >> > You should check that the user attribute >>>> >>>>>>>> > SambaPwdLastSet >>>> >>> is >>>> >>>>>> set >>>> >>>>>>>> > to >>>> >>>>>>>> > a >>>> >>>>>>>> > >> > positive value (e.g. 1). If not you get an error in >>>> >>>>>>>> > the >>>> >>>>> Samba >>>> >>>>>>>> > logs >>>> >>>>>>>> > - >>>> >>>>>>>> > > I >>>> >>>>>>>> > >> > would need to play around again with a test user to >>>> >>>>>>>> > find >>>> >>>> out >>>> >>>>>>>> > the >>>> >>>>>>>> > > exact >>>> >>>>>>>> > >> > error. >>>> >>>>>>>> > >> > >>>> >>>>>>>> > >> > I don't understand what you mean about syncing the >>>> >>>>>>>> > users >>>> >>>>>> local, >>>> >>>>>>>> > but >>>> >>>>>>>> > > we >>>> >>>>>>>> > >> did >>>> >>>>>>>> > >> > not need to do anything like that. >>>> >>>>>>>> > >> > >>>> >>>>>>>> > >> > Chris >>>> >>>>>>>> > >> > >>>> >>>>>>>> > >> > >>>> >>>>>>>> > >> > >>>> >>>>>>>> > >> > >>>> >>>>>>>> > >> > From: "Matt ." <yamakasi....@gmail.com> >>>> >>>>>>>> > >> > To: Christopher Lamb/Switzerland/IBM@IBMCH >>>> >>>>>>>> > >> > Cc: "freeipa-users@redhat.com" >>>> >>>>> <freeipa-users@redhat.com> >>>> >>>>>>>> > >> > Date: 04.08.2015 15:33 >>>> >>>>>>>> > >> > Subject: Re: [Freeipa-users] Ubuntu Samba >>>> >>>>>>>> > Server >>>> >>>> Auth >>>> >>>>>>>> > against >>>> >>>>>>>> > >> IPA >>>> >>>>>>>> > >> > >>>> >>>>>>>> > >> > >>>> >>>>>>>> > >> > >>>> >>>>>>>> > >> > Hi Chris, >>>> >>>>>>>> > >> > >>>> >>>>>>>> > >> > A puppet run added another passdb backend, that was >>>> >>> causing >>>> >>>>>> my >>>> >>>>>>>> > issue. >>>> >>>>>>>> > >> > >>>> >>>>>>>> > >> > What I still experience is: >>>> >>>>>>>> > >> > >>>> >>>>>>>> > >> > >>>> >>>>>>>> > >> > [2015/08/04 15:29:45.477783, 3] >>>> >>>>>>>> > >> > ../source3/auth/check_samsec.c:399(check_sam_security) >>>> >>>>>>>> > >> > check_sam_security: Couldn't find user 'username' in >>>> >>>>>> passdb. >>>> >>>>>>>> > >> > [2015/08/04 15:29:45.478026, 2] >>>> >>>>>>>> > >> > ../source3/auth/auth.c:288(auth_check_ntlm_password) >>>> >>>>>>>> > >> > check_ntlm_password: Authentication for user >>>> >> [username] >>>> >>>>> -> >>>> >>>>>>>> > >> > [username] FAILED with error NT_STATUS_NO_SUCH_USER >>>> >>>>>>>> > >> > >>>> >>>>>>>> > >> > >>>> >>>>>>>> > >> > I also wonder if I shall still sync the users local, >>>> >>>>>>>> > or >>>> >> is >>>> >>>>> it >>>> >>>>>>>> > > needed ? >>>> >>>>>>>> > >> > >>>> >>>>>>>> > >> > Thanks again, >>>> >>>>>>>> > >> > >>>> >>>>>>>> > >> > Matt >>>> >>>>>>>> > >> > >>>> >>>>>>>> > >> > 2015-08-04 14:16 GMT+02:00 Christopher Lamb < >>>> >>>>>>>> > >> christopher.l...@ch.ibm.com>: >>>> >>>>>>>> > >> >> Hi Matt >>>> >>>>>>>> > >> >> >>>> >>>>>>>> > >> >> From our smb.conf file: >>>> >>>>>>>> > >> >> >>>> >>>>>>>> > >> >> [global] >>>> >>>>>>>> > >> >> security = user >>>> >>>>>>>> > >> >> passdb backend = >>>> >>>>>>>> > ldapsam:ldap://xxx-ldap2.my.silly.example.com >>>> >>>>>>>> > >> >> ldap suffix = dc=my,dc=silly,dc=example,dc=com >>>> >>>>>>>> > >> >> ldap admin dn = cn=Directory Manager >>>> >>>>>>>> > >> >> >>>> >>>>>>>> > >> >> So yes, we use Directory Manager, it works for us. I >>>> >> have >>>> >>>>>> not >>>> >>>>>>>> > tried >>>> >>>>>>>> > >> with >>>> >>>>>>>> > >> > a >>>> >>>>>>>> > >> >> less powerful user, but it is conceivable that a >>>> >>>>>>>> > lesser >>>> >>>>> user >>>> >>>>>>>> > may >>>> >>>>>>>> > not >>>> >>>>>>>> > >> see >>>> >>>>>>>> > >> >> all the required attributes, resulting in "no such >>>> >>>>>>>> > user" >>>> >>>>>>>> > errors. >>>> >>>>>>>> > >> >> >>>> >>>>>>>> > >> >> Chris >>>> >>>>>>>> > >> >> >>>> >>>>>>>> > >> >> >>>> >>>>>>>> > >> >> >>>> >>>>>>>> > >> >> >>>> >>>>>>>> > >> >> From: "Matt ." <yamakasi....@gmail.com> >>>> >>>>>>>> > >> >> To: Christopher Lamb/Switzerland/IBM@IBMCH >>>> >>>>>>>> > >> >> Cc: "freeipa-users@redhat.com" >>>> >>>>>> <freeipa-users@redhat.com> >>>> >>>>>>>> > >> >> Date: 04.08.2015 13:32 >>>> >>>>>>>> > >> >> Subject: Re: [Freeipa-users] Ubuntu Samba >>>> >>>>>>>> > Server >>>> >>>>> Auth >>>> >>>>>>>> > against >>>> >>>>>>>> > >> IPA >>>> >>>>>>>> > >> >> >>>> >>>>>>>> > >> >> >>>> >>>>>>>> > >> >> >>>> >>>>>>>> > >> >> Hi Chris, >>>> >>>>>>>> > >> >> >>>> >>>>>>>> > >> >> Thanks for the heads up, indeed local is 4 I see now >>>> >> when >>>> >>>> I >>>> >>>>>>>> > add a >>>> >>>>>>>> > >> >> group from the GUI, great thanks! >>>> >>>>>>>> > >> >> >>>> >>>>>>>> > >> >> But do you use Directory Manager as ldap admin user >>>> >>>>>>>> > or >>>> >>>> some >>>> >>>>>>>> > other >>>> >>>>>>>> > >> >> admin account ? >>>> >>>>>>>> > >> >> >>>> >>>>>>>> > >> >> I'm not sure id DM is needed and it should get that >>>> >>>>>>>> > deep >>>> >>>>>> into >>>> >>>>>>>> > IPA. >>>> >>>>>>>> > >> >> Also when starting samba it cannot find "such user" >>>> >>>>>>>> > as >>>> >>>> that >>>> >>>>>>>> > sounds >>>> >>>>>>>> > >> >> quite known as it has no UID. >>>> >>>>>>>> > >> >> >>>> >>>>>>>> > >> >> From your config I see you use DM, this should work ? >>>> >>>>>>>> > >> >> >>>> >>>>>>>> > >> >> Thanks! >>>> >>>>>>>> > >> >> >>>> >>>>>>>> > >> >> >>>> >>>>>>>> > >> >> Matt >>>> >>>>>>>> > >> >> >>>> >>>>>>>> > >> >> >>>> >>>>>>>> > >> > >>>> >>>>>>>> > >> > >>>> >>>>>>>> > >> > >>>> >>>>>>>> > >> > >>>> >>>>>>>> > >> >>>> >>>>>>>> > >> -- >>>> >>>>>>>> > >> Manage your subscription for the Freeipa-users mailing >>>> >> list: >>>> >>>>>>>> > >> https://www.redhat.com/mailman/listinfo/freeipa-users >>>> >>>>>>>> > >> Go to http://freeipa.org for more info on the project >>>> >>>>>>>> > >> >>>> >>>>>>>> > >> >>>> >>>>>>>> > >> >>>> >>>>>>>> > > >>>> >>>>>>>> > > >>>> >>>>>>>> > > >>>> >>>>>>>> > > >>>> >>>>>>>> > > -- >>>> >>>>>>>> > > Manage your subscription for the Freeipa-users mailing >>>> >>>>>>>> > list: >>>> >>>>>>>> > > https://www.redhat.com/mailman/listinfo/freeipa-users >>>> >>>>>>>> > > Go to http://freeipa.org for more info on the project >>>> >>>>>>>> > > >>>> >>>>>>>> > > >>>> >>>>>>>> > > >>>> >>>>>>>> > > >>>> >>>>>>>> > >>>> >>>>>>>> > -- >>>> >>>>>>>> > Manage your subscription for the Freeipa-users mailing list: >>>> >>>>>>>> > https://www.redhat.com/mailman/listinfo/freeipa-users >>>> >>>>>>>> > Go to http://freeipa.org for more info on the project >>>> >>>>>>>> > >>>> >>>>>>>> > >>>> >>>>>>>> > >>>> >>>>>>> >>>> >>>>>>> >>>> >>>>>> >>>> >>>>>> >>>> >>>>>> >>>> >>>>>> >>>> >>>>> >>>> >>>>> >>>> >>>>> >>>> >>>>> >>>> >>>> >>>> >>>> >>>> >>>> >>>> >>>> >>>> >>> >>>> >>> >>>> >>> >>>> >>> >>>> >> >>>> >> >>>> >> >>>> >> >>> >>> -- Manage your subscription for the Freeipa-users mailing list: https://www.redhat.com/mailman/listinfo/freeipa-users Go to http://freeipa.org for more info on the project