Hi Chris, Would be great to see!
If I have it working and we have 2-3 testcases I think we can add it to the IPA docs! Keep me updated! Thanks Matt 2015-08-20 8:49 GMT+02:00 Christopher Lamb <christopher.l...@ch.ibm.com>: > Matt > > Once I got Samba and FreeIPA integrated (by the "good old extensions" > path), I always use FreeIPA to administer users. I have never tried the > samba tools like smbpasswd. > > I still have a wiki how-to in the works, but I had to focus on some other > issues for a while. > > Chris > > > > From: "Matt ." <yamakasi....@gmail.com> > To: Youenn PIOLET <piole...@gmail.com> > Cc: Christopher Lamb/Switzerland/IBM@IBMCH, > "freeipa-users@redhat.com" <freeipa-users@redhat.com> > Date: 20.08.2015 08:12 > Subject: Re: [Freeipa-users] Ubuntu Samba Server Auth against IPA > > > > HI Guys, > > Anyone still a working clue/test here ? > > I didn't came further as it seems there need to be some domain join / > match following the freeipa devs. > > Thanks! > > Matt > > 2015-08-13 13:09 GMT+02:00 Matt . <yamakasi....@gmail.com>: >> Hi, >> >> I might have found somthing which I already seen in the logs. >> >> I did a smbpasswd my username on the samba server, it connects to ldap >> very well. I give my new password and get the following: >> >> smbldap_search_ext: base => [dc=my,dc=domain], filter => >> [(&(objectClass=ipaNTGroupAttrs)(| > (ipaNTSecurityIdentifier=S-1----my--sid---)))], >> scope => [2] >> Attribute [displayName] not found. >> Could not retrieve 'displayName' attribute from cn=Default SMB >> Group,cn=groups,cn=accounts,dc=my,dc=domain >> Sid S-1----my--sid--- -> MYDOMAIN\Default SMB Group(2) >> >> So something is missing! >> >> Thanks so far guys! >> >> Cheers, >> >> Matt >> >> 2015-08-13 12:02 GMT+02:00 Matt . <yamakasi....@gmail.com>: >>> Hi Youenn, >>> >>> OK thanks! this takes me a little but futher now and I see some good >>> stuff in my logging. >>> >>> I'm testing on a Windows 10 Machine which is not member of an AD or >>> so, so that might be my issue for now ? >>> >>> When testing on the samba box itself as my user I get: >>> >>> >>> [myusername@smb-01 ~]$ smbclient //smb-01.domain.local/shares >>> >>> ... >>> Checking NTLMSSP password for MSP\myusername failed: > NT_STATUS_WRONG_PASSWORD >>> ... >>> SPNEGO login failed: NT_STATUS_WRONG_PASSWORD >>> >>> >>> Maybe I have an issue with encrypted passwords ? >>> >>> >>> When we have this all working, I think we have a howto :D >>> >>> Thanks! >>> >>> Matt >>> >>> 2015-08-13 10:53 GMT+02:00 Youenn PIOLET <piole...@gmail.com>: >>>> Hi Matt >>>> >>>> - CentOS : Did you copy ipasam.so and change your smb.conf accordingly? >>>> sambaSamAccount is not needed anymore that way. >>>> - Default IPA Way : won't work if your Windows is not part of a domain >>>> controller. DOMAIN\username may work for some users using Windows 7 - > not 8 >>>> nor 10 (it did for me but I was the only one at the office... quite > useless) >>>> >>>> This config may work on your CentOS (for the ipasam way): >>>> workgroup = TEST >>>> realm = TEST.NET >>>> kerberos method = dedicated keytab >>>> dedicated keytab file = FILE:/<.....>/samba.keytab >>>> create krb5 conf = no >>>> security = user >>>> encrypt passwords = true >>>> passdb backend = ipasam:ldaps://youripa.test.net >>>> ldapsam:trusted = yes >>>> ldapsuffix = test.net >>>> ldap user suffix = cn=users,cn=accounts >>>> ldap group suffix = cn=groups,cn=accounts >>>> >>>> >>>> -- >>>> Youenn Piolet >>>> piole...@gmail.com >>>> >>>> >>>> 2015-08-12 22:15 GMT+02:00 Matt . <yamakasi....@gmail.com>: >>>>> >>>>> Hi, >>>>> >>>>> OK the default IPA way works great actually when testing it as > described >>>>> here: >>>>> >>>>> > http://www.freeipa.org/page/Howto/Integrating_a_Samba_File_Server_With_IPA >>>>> >>>>> On the samba server I can auth and see my share where I want to > connect >>>>> to. >>>>> >>>>> The issue is, on Windows I cannot auth, even when I do DOMAIN\username >>>>> as username >>>>> >>>>> So, the IPA way should work. >>>>> >>>>> Any comments here ? >>>>> >>>>> Cheers, >>>>> >>>>> Matt >>>>> >>>>> 2015-08-12 19:00 GMT+02:00 Matt . <yamakasi....@gmail.com>: >>>>> > HI GUys, >>>>> > >>>>> > I'm testing this out and I think I almost setup, this on a CentOS > samba >>>>> > server. >>>>> > >>>>> > I'm using the ipa-adtrust way of Youeen but it seems we still need > to >>>>> > add (objectclass=sambaSamAccount)) ? >>>>> > >>>>> > Info is welcome! >>>>> > >>>>> > I will report back when I have it working. >>>>> > >>>>> > Thanks! >>>>> > >>>>> > Matt >>>>> > >>>>> > 2015-08-10 11:16 GMT+02:00 Christopher Lamb >>>>> > <christopher.l...@ch.ibm.com>: >>>>> >> The next route I will try - is the one Youeen took, using > ipa-adtrust >>>>> >> >>>>> >> >>>>> >> >>>>> >> From: "Matt ." <yamakasi....@gmail.com> >>>>> >> To: Christopher Lamb/Switzerland/IBM@IBMCH, >>>>> >> "freeipa-users@redhat.com" <freeipa-users@redhat.com> >>>>> >> Date: 10.08.2015 10:03 >>>>> >> Subject: Re: [Freeipa-users] Ubuntu Samba Server Auth > against >>>>> >> IPA >>>>> >> >>>>> >> >>>>> >> >>>>> >> Hi Chris, >>>>> >> >>>>> >> Okay this is good to hear. >>>>> >> >>>>> >> But don't we want a IPA managed Scheme ? >>>>> >> >>>>> >> When I did a "ipa-adtrust-install --add-sids" it also wanted a > local >>>>> >> installed Samba and I wonder why. >>>>> >> >>>>> >> Good that we make some progres on making it all clear. >>>>> >> >>>>> >> Cheers, >>>>> >> >>>>> >> Matt >>>>> >> >>>>> >> 2015-08-10 6:12 GMT+02:00 Christopher Lamb >>>>> >> <christopher.l...@ch.ibm.com>: >>>>> >>> ldapsam + the samba extensions, pretty much as described in the >>>>> >> Techslaves >>>>> >>> article. Once I have a draft for the wiki page, I will mail you. >>>>> >>> >>>>> >>> >>>>> >>> >>>>> >>> From: "Matt ." <yamakasi....@gmail.com> >>>>> >>> To: Christopher Lamb/Switzerland/IBM@IBMCH, >>>>> >>> "freeipa-users@redhat.com" <freeipa-users@redhat.com> >>>>> >>> Date: 09.08.2015 21:17 >>>>> >>> Subject: Re: [Freeipa-users] Ubuntu Samba Server Auth > against >>>>> >>> IPA >>>>> >>> >>>>> >>> >>>>> >>> >>>>> >>> Hi, >>>>> >>> >>>>> >>> Yes I know about "anything" but which way did you use now ? >>>>> >>> >>>>> >>> >>>>> >>> >>>>> >>> 2015-08-09 20:56 GMT+02:00 Christopher Lamb >>>>> >> <christopher.l...@ch.ibm.com>: >>>>> >>>> Hi Matt >>>>> >>>> >>>>> >>>> I am on OEL 7.1. - so anything that works on that should be good > for >>>>> >> RHEL >>>>> >>>> and Centos 7.x >>>>> >>>> >>>>> >>>> I intend to add a how-to to the FreeIPA Wiki over the next few > days. >>>>> >>>> As >>>>> >>> we >>>>> >>>> have suggested earlier, we will likely end up with several, one > for >>>>> >>>> each >>>>> >>> of >>>>> >>>> the possible integration paths. >>>>> >>>> >>>>> >>>> Chris >>>>> >>>> >>>>> >>>> >>>>> >>>> >>>>> >>>> >>>>> >>>> >>>>> >>>> From: "Matt ." <yamakasi....@gmail.com> >>>>> >>>> To: Christopher Lamb/Switzerland/IBM@IBMCH, >>>>> >>>> "freeipa-users@redhat.com" <freeipa-users@redhat.com> >>>>> >>>> Date: 09.08.2015 16:45 >>>>> >>>> Subject: Re: [Freeipa-users] Ubuntu Samba Server Auth > against >>>>> >>>> IPA >>>>> >>>> >>>>> >>>> >>>>> >>>> >>>>> >>>> Hi Chris, >>>>> >>>> >>>>> >>>> This sounds great! >>>>> >>>> >>>>> >>>> What are you using now, both CentOS ? So Samba and FreeIPA ? >>>>> >>>> >>>>> >>>> Maybe it's good to explain which way you used now in steps too, > so we >>>>> >>>> can combine or create multiple howto's ? >>>>> >>>> >>>>> >>>> At least we are going somewhere! >>>>> >>>> >>>>> >>>> Thanks, >>>>> >>>> >>>>> >>>> Matt >>>>> >>>> >>>>> >>>> 2015-08-09 14:54 GMT+02:00 Christopher Lamb >>>>> >>> <christopher.l...@ch.ibm.com>: >>>>> >>>>> Hi Matt >>>>> >>>>> >>>>> >>>>> My test integration of FreeIPA 4.x and Samba 4.x with the "good > old >>>>> >>> Samba >>>>> >>>>> Schema extensions) is up and working, almost flawlessly. >>>>> >>>>> >>>>> >>>>> I can add users and groups via the FreeIPA CLI, and they get the >>>>> >> correct >>>>> >>>>> ObjectClasses / attributes required for Samba. >>>>> >>>>> >>>>> >>>>> So far I have not yet bothered to try the extensions to the > WebUI, >>>>> >>>> because >>>>> >>>>> it is currently giving me the classic "Your session has expired. >>>>> >>>>> Please >>>>> >>>>> re-login." error which renders the WebUI useless. >>>>> >>>>> >>>>> >>>>> The only problem I have so far encountered managing Samba / > FreeIPA >>>>> >>> users >>>>> >>>>> via FreeIPA CLI commands is with the handling of the attribute >>>>> >>>>> sambaPwdLastSet. This is the subject of an existing thread, also >>>>> >> updated >>>>> >>>>> today. >>>>> >>>>> >>>>> >>>>> There is also an existing alternative to hacking group.py, using >>>>> >>>>> "Class >>>>> >>>> of >>>>> >>>>> Service" (Cos) documented in this thread from February 2015 >>>>> >>>>> >>>>> >>> >>>>> >>> > https://www.redhat.com/archives/freeipa-users/2015-February/msg00172.html >>>>> >>>> . >>>>> >>>>> I have not yet tried it, but it sounds reasonable. >>>>> >>>>> >>>>> >>>>> Chris >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> From: "Matt ." <yamakasi....@gmail.com> >>>>> >>>>> To: Christopher Lamb/Switzerland/IBM@IBMCH >>>>> >>>>> Cc: "freeipa-users@redhat.com" <freeipa-users@redhat.com>, >>>>> >>>>> Youenn >>>>> >>>>> PIOLET <piole...@gmail.com> >>>>> >>>>> Date: 06.08.2015 16:19 >>>>> >>>>> Subject: Re: [Freeipa-users] Ubuntu Samba Server Auth > against >>>>> >> IPA >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> Hi Chris, >>>>> >>>>> >>>>> >>>>> OK, than we might create two different versions of the wiki, I > think >>>>> >>>>> this is nice. >>>>> >>>>> >>>>> >>>>> I'm still figuring out why I get that: >>>>> >>>>> >>>>> >>>>> IPA Error 4205: ObjectclassViolation >>>>> >>>>> >>>>> >>>>> missing attribute "sambaGroupType" required by object class >>>>> >>>>> "sambaGroupMapping" >>>>> >>>>> >>>>> >>>>> Matt >>>>> >>>>> >>>>> >>>>> 2015-08-06 16:09 GMT+02:00 Christopher Lamb >>>>> >>>> <christopher.l...@ch.ibm.com>: >>>>> >>>>>> Hi Matt >>>>> >>>>>> >>>>> >>>>>> As far as I can make out, there are at least 2 viable Samba / >>>>> >>>>>> FreeIPA >>>>> >>>>>> integration paths. >>>>> >>>>>> >>>>> >>>>>> The route I took is suited where there is no Active Directory >>>>> >> involved: >>>>> >>>>> In >>>>> >>>>>> my case all the Windows, OSX and Linux clients are islands that > sit >>>>> >>>>>> on >>>>> >>>>> the >>>>> >>>>>> same network. >>>>> >>>>>> >>>>> >>>>>> The route that Youenn has taken (unless I have got completely > the >>>>> >> wrong >>>>> >>>>> end >>>>> >>>>>> of the stick) requires Active Directory in the architecture. >>>>> >>>>>> >>>>> >>>>>> Chris >>>>> >>>>>> >>>>> >>>>>> >>>>> >>>>>> >>>>> >>>>>> From: "Matt ." <yamakasi....@gmail.com> >>>>> >>>>>> To: Youenn PIOLET <piole...@gmail.com> >>>>> >>>>>> Cc: Christopher Lamb/Switzerland/IBM@IBMCH, >>>>> >>>>>> "freeipa-users@redhat.com" > <freeipa-users@redhat.com> >>>>> >>>>>> Date: 06.08.2015 14:42 >>>>> >>>>>> Subject: Re: [Freeipa-users] Ubuntu Samba Server Auth >>>>> >>>>>> against >>>>> >>> IPA >>>>> >>>>>> >>>>> >>>>>> >>>>> >>>>>> >>>>> >>>>>> Hi, >>>>> >>>>>> >>>>> >>>>>> OK, this sounds already quite logical, but I'm still refering > to >>>>> >>>>>> the >>>>> >>>>>> old howto we found earlier, does that one still apply somewhere > or >>>>> >>>>>> not >>>>> >>>>>> at all ? >>>>> >>>>>> >>>>> >>>>>> Thanks, >>>>> >>>>>> >>>>> >>>>>> Matt >>>>> >>>>>> >>>>> >>>>>> >>>>> >>>>>> >>>>> >>>>>> 2015-08-06 12:23 GMT+02:00 Youenn PIOLET <piole...@gmail.com>: >>>>> >>>>>>> Hey guys, >>>>> >>>>>>> >>>>> >>>>>>> I'll try to make a tutorial soon, sorry I'm quite in a rush > these >>>>> >>>>> days :) >>>>> >>>>>>> >>>>> >>>>>>> General idea: >>>>> >>>>>>> >>>>> >>>>>>> On FreeIPA (4.1) >>>>> >>>>>>> - `ipa-adtrust-install --add-sids` (creates >>>>> >>>>>>> ipaNTsecurityidentifier >>>>> >>>>>>> attribude, also known as SID) >>>>> >>>>>>> - regenerate each user password to build ipaNTHash attribute, > not >>>>> >> here >>>>> >>>>> by >>>>> >>>>>>> default on users >>>>> >>>>>>> - use your ldap browser to check ipaNTHash values are here on > user >>>>> >>>>>> objects >>>>> >>>>>>> - create a CIFS service for your samba server >>>>> >>>>>>> - Create user roles/permissions as described here: >>>>> >>>>>>> >>>>> >>>>>> >>>>> >>>>> >>>>> >>>> >>>>> >>> >>>>> >> >>>>> >> > http://freeipa-users.redhat.narkive.com/ez2uKpFS/authenticate-samba-3-or-4-with-freeipa > >>>>> >> >>>>> >>> >>>>> >>>> >>>>> >>>>> >>>>> >>>>>> >>>>> >>>>>>> so that CIFS service will be able to read > ipaNTsecurityidentifier >>>>> >>>>>>> and >>>>> >>>>>>> ipaNTHash attributes in LDAP (ACI) >>>>> >>>>>>> - SCP ipasam.so module to your cifs server (this is the magic >>>>> >> trick) : >>>>> >>>>>> scp >>>>> >>>>>>> /usr/lib64/samba/pdb/ipasam.so >>>>> >>>>>>> root@samba-server.domain:/usr/lib64/samba/pdb/ You can also > try to >>>>> >>>>>> recompile >>>>> >>>>>>> it. >>>>> >>>>>>> >>>>> >>>>>>> On SAMBA Server side (CentOS 7...) >>>>> >>>>>>> - Install server keytab file for CIFS >>>>> >>>>>>> - check ipasam.so is here. >>>>> >>>>>>> - check you can read password hash in LDAP with `ldapsearch -Y >>>>> >>>>>>> GSSAPI >>>>> >>>>>>> uid=admin ipaNTHash` thanks to kerberos >>>>> >>>>>>> - make your smb.conf following the linked thread and restart >>>>> >>>>>>> service >>>>> >>>>>>> >>>>> >>>>>>> I don't know if it works in Ubuntu. I know sssd has evolved >>>>> >>>>>>> quickly >>>>> >>> and >>>>> >>>>>>> ipasam may use quite recent functionalities, the best is to > just >>>>> >>>>>>> try. >>>>> >>>>> You >>>>> >>>>>>> can read in previous thread : "If you insist on Ubuntu you > need to >>>>> >> get >>>>> >>>>>>> ipasam somewhere, most likely to compile it yourself". >>>>> >>>>>>> >>>>> >>>>>>> Make sure your user has ipaNTHash attribute :) >>>>> >>>>>>> >>>>> >>>>>>> You may want to debug authentication on samba server, I > usually do >>>>> >>>> this: >>>>> >>>>>>> `tail -f /var/log/samba/log* | grep <username> >>>>> >>>>>>> >>>>> >>>>>>> Cheers >>>>> >>>>>>> -- >>>>> >>>>>>> Youenn Piolet >>>>> >>>>>>> piole...@gmail.com >>>>> >>>>>>> >>>>> >>>>>>> >>>>> >>>>>>> 2015-08-05 17:40 GMT+02:00 Matt . <yamakasi....@gmail.com>: >>>>> >>>>>>>> >>>>> >>>>>>>> Hi, >>>>> >>>>>>>> >>>>> >>>>>>>> This sounds great to me too, but a howto would help to make > it >>>>> >>>>>>>> more >>>>> >>>>>>>> clear about what you have done here. The thread confuses me a >>>>> >>>>>>>> little >>>>> >>>>>>>> bit. >>>>> >>>>>>>> >>>>> >>>>>>>> Can you paste your commands so we can test out too and report >>>>> >>>>>>>> back ? >>>>> >>>>>>>> >>>>> >>>>>>>> Thanks! >>>>> >>>>>>>> >>>>> >>>>>>>> Matt >>>>> >>>>>>>> >>>>> >>>>>>>> 2015-08-05 15:18 GMT+02:00 Christopher Lamb >>>>> >>>>>> <christopher.l...@ch.ibm.com>: >>>>> >>>>>>>> > Hi Youenn >>>>> >>>>>>>> > >>>>> >>>>>>>> > Good news that you have got an integration working >>>>> >>>>>>>> > >>>>> >>>>>>>> > Now you have got it going, and the solution is fresh in > your >>>>> >>>>>>>> > mind, >>>>> >>>>> how >>>>> >>>>>>>> > about adding a How-to page on this solution to the FreeIPA >>>>> >>>>>>>> > wiki? >>>>> >>>>>>>> > >>>>> >>>>>>>> > Chris >>>>> >>>>>>>> > >>>>> >>>>>>>> > >>>>> >>>>>>>> > >>>>> >>>>>>>> > From: Youenn PIOLET <piole...@gmail.com> >>>>> >>>>>>>> > To: "Matt ." <yamakasi....@gmail.com> >>>>> >>>>>>>> > Cc: Christopher Lamb/Switzerland/IBM@IBMCH, >>>>> >>>>>>>> > "freeipa-users@redhat.com" >>>>> >>>>>>>> > <freeipa-users@redhat.com> >>>>> >>>>>>>> > Date: 05.08.2015 14:51 >>>>> >>>>>>>> > Subject: Re: [Freeipa-users] Ubuntu Samba Server > Auth >>>>> >>> against >>>>> >>>>>> IPA >>>>> >>>>>>>> > >>>>> >>>>>>>> > >>>>> >>>>>>>> > >>>>> >>>>>>>> > Hi guys, >>>>> >>>>>>>> > >>>>> >>>>>>>> > Thank you so much your previous answers. >>>>> >>>>>>>> > I realised my SID were stored in ipaNTsecurityidentifier, >>>>> >>>>>>>> > thanks >>>>> >> to >>>>> >>>>>>>> > ipa-adtrust-install --add-sids >>>>> >>>>>>>> > >>>>> >>>>>>>> > I found an other way to configure smb here: >>>>> >>>>>>>> > >>>>> >>>>>>>> > >>>>> >>>>>> >>>>> >>>>> >>>>> >>>> >>>>> >>> >>>>> >> >>>>> >> > http://freeipa-users.redhat.narkive.com/ez2uKpFS/authenticate-samba-3-or-4-with-freeipa > >>>>> >> >>>>> >>> >>>>> >>>> >>>>> >>>>> >>>>> >>>>>> >>>>> >>>>>>>> > It works perfectly. >>>>> >>>>>>>> > >>>>> >>>>>>>> > I'm using module ipasam.so I have manually scp to the samba >>>>> >> server, >>>>> >>>>>>>> > Samba is set to use kerberos + ldapsam via this ipasam > module. >>>>> >>>>>>>> > Following the instructions, I created a user role allowing >>>>> >>>>>>>> > service >>>>> >>>>>>>> > principal to read ipaNTHash value from the LDAP. >>>>> >>>>>>>> > ipaNTHash are generated each time a user changes his > password. >>>>> >>>>>>>> > Authentication works perfectly on Windows 7, 8 and 10. >>>>> >>>>>>>> > >>>>> >>>>>>>> > For more details, the previously linked thread is quite > clear. >>>>> >>>>>>>> > >>>>> >>>>>>>> > Cheers >>>>> >>>>>>>> > >>>>> >>>>>>>> > -- >>>>> >>>>>>>> > Youenn Piolet >>>>> >>>>>>>> > piole...@gmail.com >>>>> >>>>>>>> > >>>>> >>>>>>>> > >>>>> >>>>>>>> > 2015-08-05 11:10 GMT+02:00 Matt . <yamakasi....@gmail.com>: >>>>> >>>>>>>> > Hi Chris. >>>>> >>>>>>>> > >>>>> >>>>>>>> > Yes, Apache Studio did that but I was not sure why it >>>>> >>>>>>>> > complained >>>>> >>>> it >>>>> >>>>>>>> > was "already" there. >>>>> >>>>>>>> > >>>>> >>>>>>>> > I'm still getting: >>>>> >>>>>>>> > >>>>> >>>>>>>> > IPA Error 4205: ObjectclassViolation >>>>> >>>>>>>> > >>>>> >>>>>>>> > missing attribute "sambaGroupType" required by object > class >>>>> >>>>>>>> > "sambaGroupMapping" >>>>> >>>>>>>> > >>>>> >>>>>>>> > When adding a user. >>>>> >>>>>>>> > >>>>> >>>>>>>> > I also see "class" as fielname under my "Last name", this > is >>>>> >>>>>>>> > not >>>>> >>>> OK >>>>> >>>>>>>> > also. >>>>> >>>>>>>> > >>>>> >>>>>>>> > >>>>> >>>>>>>> > >>>>> >>>>>>>> > We sure need to make some howto, I think we can nail this >>>>> >> down :) >>>>> >>>>>>>> > >>>>> >>>>>>>> > Thanks for the heads up! >>>>> >>>>>>>> > >>>>> >>>>>>>> > Matthijs >>>>> >>>>>>>> > >>>>> >>>>>>>> > 2015-08-05 7:51 GMT+02:00 Christopher Lamb >>>>> >>>>>>>> > <christopher.l...@ch.ibm.com>: >>>>> >>>>>>>> > > Hi Matt >>>>> >>>>>>>> > > >>>>> >>>>>>>> > > If I use Apache Directory Studio to add an attribute >>>>> >>>>>> ipaCustomFields >>>>> >>>>>>>> > to >>>>> >>>>>>>> > > cn=ipaConfig,cn=etc, the operation it performs is a > modify, >>>>> >>>>>>>> > as >>>>> >>>>>> shown >>>>> >>>>>>>> > below: >>>>> >>>>>>>> > > >>>>> >>>>>>>> > > #!RESULT OK >>>>> >>>>>>>> > > #!CONNECTION ldap://xxx-ldap2.my.silly.example.com:yyy >>>>> >>>>>>>> > > #!DATE 2015-08-05T05:45:04.608 >>>>> >>>>>>>> > > dn: > cn=ipaConfig,cn=etc,dc=my,dc=silly,dc=example,dc=com >>>>> >>>>>>>> > > changetype: modify >>>>> >>>>>>>> > > add: ipaCustomFields >>>>> >>>>>>>> > > ipaCustomFields: Samba Group Type,sambagrouptype,true >>>>> >>>>>>>> > > >>>>> >>>>>>>> > > After that I then have a visible attribute > ipaCustomFields >>>>> >>>>>>>> > as >>>>> >>>>>>>> > expected. >>>>> >>>>>>>> > > >>>>> >>>>>>>> > > When adding the attribute, the wizard offered me >>>>> >>>>> "ipaCustomFields" >>>>> >>>>>>>> > as >>>>> >>>>>>>> > > attribute type in a drop down list. >>>>> >>>>>>>> > > >>>>> >>>>>>>> > > Once we get this cracked, we really must write a how-to > on >>>>> >>>>>>>> > the >>>>> >>>>>>>> > FreeIPA >>>>> >>>>>>>> > > Wiki. >>>>> >>>>>>>> > > >>>>> >>>>>>>> > > Chris >>>>> >>>>>>>> > > >>>>> >>>>>>>> > > >>>>> >>>>>>>> > > >>>>> >>>>>>>> > > From: Christopher Lamb/Switzerland/IBM@IBMCH >>>>> >>>>>>>> > > To: "Matt ." <yamakasi....@gmail.com> >>>>> >>>>>>>> > > Cc: "freeipa-users@redhat.com" >>>>> >>>>>>>> > <freeipa-users@redhat.com> >>>>> >>>>>>>> > > Date: 05.08.2015 07:31 >>>>> >>>>>>>> > > Subject: Re: [Freeipa-users] Ubuntu Samba Server >>>>> >>>>>>>> > Auth >>>>> >>>>>> against >>>>> >>>>>>>> > IPA >>>>> >>>>>>>> > > Sent by: freeipa-users-boun...@redhat.com >>>>> >>>>>>>> > > >>>>> >>>>>>>> > > >>>>> >>>>>>>> > > >>>>> >>>>>>>> > > Hi Matt >>>>> >>>>>>>> > > >>>>> >>>>>>>> > > I also got the same result at that step, but can see >>>>> >>>>>>>> > nothing >>>>> >> in >>>>> >>>>>>>> > Apache >>>>> >>>>>>>> > > Directory Studio. >>>>> >>>>>>>> > > >>>>> >>>>>>>> > > As I am using existing Samba / FreeIPA groups migrated >>>>> >>>>>>>> > across, >>>>> >>>>>> they >>>>> >>>>>>>> > > probably were migrated with all the required > attributes. >>>>> >>>>>>>> > > >>>>> >>>>>>>> > > Looking more closely at that LDIF: I wonder should it > not >>>>> >>>>>>>> > be: >>>>> >>>>>>>> > > >>>>> >>>>>>>> > > ldapmodify -Y GSSAPI <<EOF >>>>> >>>>>>>> > > dn: cn=ipaconfig,cn=etc,dc=domain,dc=tld >>>>> >>>>>>>> > > changetype: modify >>>>> >>>>>>>> > > add: ipaCustomFields >>>>> >>>>>>>> > > ipaCustomFields: "Samba Group Type,sambagrouptype,true" >>>>> >>>>>>>> > > EOF >>>>> >>>>>>>> > > >>>>> >>>>>>>> > > i.e. changetype: modify, instead of changetype add ? >>>>> >>>>>>>> > > >>>>> >>>>>>>> > > I don't want to play around with my prod directory - I > will >>>>> >>>> setup >>>>> >>>>>> an >>>>> >>>>>>>> > EL >>>>> >>>>>>>> > 7.1 >>>>> >>>>>>>> > > VM and install FreeIPA 4.x and Samba 4.x That will > allow me >>>>> >>>>>>>> > to >>>>> >>>>>> play >>>>> >>>>>>>> > around >>>>> >>>>>>>> > > more destructively. >>>>> >>>>>>>> > > >>>>> >>>>>>>> > > Chris >>>>> >>>>>>>> > > >>>>> >>>>>>>> > > >>>>> >>>>>>>> > > >>>>> >>>>>>>> > > >>>>> >>>>>>>> > > >>>>> >>>>>>>> > > From: "Matt ." <yamakasi....@gmail.com> >>>>> >>>>>>>> > > To: Christopher Lamb/Switzerland/IBM@IBMCH >>>>> >>>>>>>> > > Cc: Youenn PIOLET <piole...@gmail.com>, " >>>>> >>>>>>>> > freeipa-users@redhat.com" >>>>> >>>>>>>> > > <freeipa-users@redhat.com> >>>>> >>>>>>>> > > Date: 05.08.2015 01:01 >>>>> >>>>>>>> > > Subject: Re: [Freeipa-users] Ubuntu > Samba >>>>> >>> Server >>>>> >>>>>>>> > Auth >>>>> >>>>>>>> > against IPA >>>>> >>>>>>>> > > >>>>> >>>>>>>> > > >>>>> >>>>>>>> > > >>>>> >>>>>>>> > > Hi Chris, >>>>> >>>>>>>> > > >>>>> >>>>>>>> > > I'm at the right path, but my issue is that: >>>>> >>>>>>>> > > >>>>> >>>>>>>> > > ldapmodify -Y GSSAPI <<EOF >>>>> >>>>>>>> > > dn: cn=ipaconfig,cn=etc,dc=domain,dc=tld >>>>> >>>>>>>> > > changetype: add >>>>> >>>>>>>> > > add: ipaCustomFields >>>>> >>>>>>>> > > ipaCustomFields: "Samba Group Type,sambagrouptype,true" >>>>> >>>>>>>> > > EOF >>>>> >>>>>>>> > > >>>>> >>>>>>>> > > Does say it exists, my ldap explorer doesn't show it, > and >>>>> >>>>>>>> > when >>>>> >>> I >>>>> >>>>>> add >>>>> >>>>>>>> > > it manually as an attribute it still fails when I add a >>>>> >>>>>>>> > user >>>>> >> on >>>>> >>>>>> this >>>>> >>>>>>>> > > sambagrouptype as it's needed by the other attributes >>>>> >>>>>>>> > > >>>>> >>>>>>>> > > So that is my issue I think so far. >>>>> >>>>>>>> > > >>>>> >>>>>>>> > > Any clue about that ? >>>>> >>>>>>>> > > >>>>> >>>>>>>> > > No problem "you don't know something or are no guru" we > are >>>>> >> all >>>>> >>>>>>>> > > learning! :) >>>>> >>>>>>>> > > >>>>> >>>>>>>> > > Cheers, >>>>> >>>>>>>> > > >>>>> >>>>>>>> > > Matt >>>>> >>>>>>>> > > >>>>> >>>>>>>> > > >>>>> >>>>>>>> > > 2015-08-04 21:22 GMT+02:00 Christopher Lamb < >>>>> >>>>>>>> > christopher.l...@ch.ibm.com>: >>>>> >>>>>>>> > >> Hi Matt, Youeen >>>>> >>>>>>>> > >> >>>>> >>>>>>>> > >> Just to set the background properly, I did not invent > this >>>>> >>>>>> process. >>>>> >>>>>>>> > I >>>>> >>>>>>>> > > know >>>>> >>>>>>>> > >> only a little about FreeIPA, and almost nothing about >>>>> >>>>>>>> > Samba, >>>>> >>>> but >>>>> >>>>>> I >>>>> >>>>>>>> > guess >>>>> >>>>>>>> > > I >>>>> >>>>>>>> > >> was lucky enough to get the integration working on a >>>>> >>>>>>>> > Sunday >>>>> >>>>>>>> > afternoon. >>>>> >>>>>>>> > (I >>>>> >>>>>>>> > >> did have an older FreeIPA 3.x / Samba 3.x installation > as >>>>> >>>>>>>> > a >>>>> >>>>>>>> > reference). >>>>> >>>>>>>> > >> >>>>> >>>>>>>> > >> It sounds like we need to step back, and look at the > test >>>>> >> user >>>>> >>>>>> and >>>>> >>>>>>>> > group >>>>> >>>>>>>> > > in >>>>> >>>>>>>> > >> the FreeIPA LDAP tree. I find using an LDAP browser > makes >>>>> >> this >>>>> >>>>>> much >>>>> >>>>>>>> > > easier. >>>>> >>>>>>>> > >> >>>>> >>>>>>>> > >> My FreeIPA / Samba Users have the following Samba >>>>> >>>>>>>> > extensions >>>>> >>> in >>>>> >>>>>>>> > FreeIPA >>>>> >>>>>>>> > >> (cn=accounts, cn=users): >>>>> >>>>>>>> > >> >>>>> >>>>>>>> > >> * objectClass: sambasamaccount >>>>> >>>>>>>> > >> >>>>> >>>>>>>> > >> * Attributes: sambaSID, sambaNTPassword, > sambaPwdLastSet >>>>> >>>>>>>> > >> >>>>> >>>>>>>> > >> My FreeIPA / Samba Groups have the following Samba >>>>> >>>>>>>> > extensions >>>>> >>>> in >>>>> >>>>>>>> > FreeIPA >>>>> >>>>>>>> > >> (cn=accounts, cn=groups): >>>>> >>>>>>>> > >> >>>>> >>>>>>>> > >> * objectClass: sambaGroupMapping >>>>> >>>>>>>> > >> >>>>> >>>>>>>> > >> * Attributes: sambaGroupType, sambaSID >>>>> >>>>>>>> > >> >>>>> >>>>>>>> > >> The Users must belong to one or more of the samba > groups >>>>> >>>>>>>> > that >>>>> >>>>> you >>>>> >>>>>>>> > have >>>>> >>>>>>>> > >> setup. >>>>> >>>>>>>> > >> >>>>> >>>>>>>> > >> If you don't have something similar to the above > (which >>>>> >> sounds >>>>> >>>>>> like >>>>> >>>>>>>> > it >>>>> >>>>>>>> > is >>>>> >>>>>>>> > >> the case), then something went wrong applying the >>>>> >>>>>>>> > extensions. >>>>> >>>> It >>>>> >>>>>>>> > would >>>>> >>>>>>>> > be >>>>> >>>>>>>> > >> worth testing comparing a new user / group created > post >>>>> >> adding >>>>> >>>>>> the >>>>> >>>>>>>> > >> extensions to a previous existing user. >>>>> >>>>>>>> > >> >>>>> >>>>>>>> > >> i.e. >>>>> >>>>>>>> > >> are the extensions missing on existing users / groups? >>>>> >>>>>>>> > >> are the extensions missing on new users / groups? >>>>> >>>>>>>> > >> >>>>> >>>>>>>> > >> Cheers >>>>> >>>>>>>> > >> >>>>> >>>>>>>> > >> Chris >>>>> >>>>>>>> > >> >>>>> >>>>>>>> > >> >>>>> >>>>>>>> > >> >>>>> >>>>>>>> > >> >>>>> >>>>>>>> > >> >>>>> >>>>>>>> > >> From: Youenn PIOLET <piole...@gmail.com> >>>>> >>>>>>>> > >> To: "Matt ." <yamakasi....@gmail.com> >>>>> >>>>>>>> > >> Cc: Christopher Lamb/Switzerland/IBM@IBMCH, >>>>> >>>>>>>> > >> "freeipa-users@redhat.com" >>>>> >>>>> <freeipa-users@redhat.com> >>>>> >>>>>>>> > >> Date: 04.08.2015 18:56 >>>>> >>>>>>>> > >> Subject: Re: [Freeipa-users] Ubuntu Samba > Server >>>>> >>>>>>>> > Auth >>>>> >>>>>>>> > against >>>>> >>>>>>>> > IPA >>>>> >>>>>>>> > >> >>>>> >>>>>>>> > >> >>>>> >>>>>>>> > >> >>>>> >>>>>>>> > >> Hi there, >>>>> >>>>>>>> > >> >>>>> >>>>>>>> > >> I have difficulties to follow you at this point :) >>>>> >>>>>>>> > >> Here is what I've done and what I've understood: >>>>> >>>>>>>> > >> >>>>> >>>>>>>> > >> ## SMB Side >>>>> >>>>>>>> > >> - Testparm OK >>>>> >>>>>>>> > >> - I've got the same NT_STATUS_NO_SUCH_USER when I try > to >>>>> >>>>> connect. >>>>> >>>>>>>> > >> - pdbedit -Lv output is all successfull but I can see >>>>> >>>>>>>> > there >>>>> >> is >>>>> >>>> a >>>>> >>>>>>>> > filter : >>>>> >>>>>>>> > >> (&(uid=*)(objectclass=sambaSamAccount). In LDAP, the > users >>>>> >>>> don't >>>>> >>>>>>>> > have >>>>> >>>>>>>> > >> sambaSamAccount. >>>>> >>>>>>>> > >> >>>>> >>>>>>>> > >> ## LDAP / FreeIPA side >>>>> >>>>>>>> > >> - Since SMB server uses LDAP, I did > ipa-adtrust-install on >>>>> >>>>>>>> > my >>>>> >>>>>>>> > FreeIPA >>>>> >>>>>>>> > >> server to get samba LDAP extensions. >>>>> >>>>>>>> > >> - I can see samba classes exist in LDAP but are not > used >>>>> >>>>>>>> > on >>>>> >> my >>>>> >>>>>>>> > group >>>>> >>>>>>>> > >> objects nor my user objects >>>>> >>>>>>>> > >> - I have add sambaSamAccount in FreeIPA default user >>>>> >>>>>>>> > classes, >>>>> >>>>>>>> > >> and sambaGroupMapping to default group classes. In > that >>>>> >>>>>>>> > state >>>>> >>> I >>>>> >>>>>>>> > can't >>>>> >>>>>>>> > >> create user nor groups anymore, as new samba > attributes >>>>> >>>>>>>> > are >>>>> >>>>>> needed >>>>> >>>>>>>> > for >>>>> >>>>>>>> > >> instantiation. >>>>> >>>>>>>> > >> - I have add in etc ipaCustomFields: 'Samba Group >>>>> >>>>>>>> > > Type,sambagrouptype,true' >>>>> >>>>>>>> > >> but I don't get what it does. >>>>> >>>>>>>> > >> - I tried to add the samba.js plugin. It works, and > adds >>>>> >>>>>>>> > the >>>>> >>>>>>>> > "local" >>>>> >>>>>>>> > > option >>>>> >>>>>>>> > >> when creating a group in FreeIPA, supposed to set >>>>> >>>> sambagrouptype >>>>> >>>>>> to >>>>> >>>>>>>> > 4 >>>>> >>>>>>>> > or >>>>> >>>>>>>> > > 2 >>>>> >>>>>>>> > >> (domain). It doesn't work and tells that > sambagrouptype >>>>> >>>>> attribute >>>>> >>>>>>>> > doesn't >>>>> >>>>>>>> > >> exist (but it should now I put sambaGroupType class by >>>>> >>>>>> default...) >>>>> >>>>>>>> > >> >>>>> >>>>>>>> > >> ## Questions >>>>> >>>>>>>> > >> 0) Can I ask samba not to search sambaSamAccount and > use >>>>> >>> unix / >>>>> >>>>>>>> > posix >>>>> >>>>>>>> > >> instead? I guess no. >>>>> >>>>>>>> > >> 1) How to generate the user/group SIDs ? They are >>>>> >>>>>>>> > requested >>>>> >> to >>>>> >>>>>> add >>>>> >>>>>>>> > >> sambaSamAccount classes. >>>>> >>>>>>>> > >> This article doesn't seem relevant since we don't use >>>>> >>>>>>>> > domain >>>>> >>>>>>>> > controller >>>>> >>>>>>>> > >> >>>>> >>>>>>>> > > >>>>> >>>>>>>> > >>>>> >>>>>>>> > >>>>> >>>>>> >>>>> >>>>> >>>>> >>>> >>>>> >>> >>>>> >> >>>>> >> > http://docs.fedoraproject.org/en-US/Fedora/17/html/FreeIPA_Guide/cifs.html >>>>> >>>>>>>> > >>>>> >>>>>>>> > >> and netgetlocalsid returns an error. >>>>> >>>>>>>> > >> 2) How to fix samba.js plugin? >>>>> >>>>>>>> > >> 3) I guess an equivalent of samba.js is needed for > user >>>>> >>>>> creation, >>>>> >>>>>>>> > where >>>>> >>>>>>>> > > can >>>>> >>>>>>>> > >> I find it? >>>>> >>>>>>>> > >> 4) Is your setup working with Windows 8 / Windows 10 > and >>>>> >>>>>>>> > not >>>>> >>>>> only >>>>> >>>>>>>> > Windows >>>>> >>>>>>>> > >> 7? >>>>> >>>>>>>> > >> >>>>> >>>>>>>> > >> Thanks a lot for your previous and future answers >>>>> >>>>>>>> > >> >>>>> >>>>>>>> > >> -- >>>>> >>>>>>>> > >> Youenn Piolet >>>>> >>>>>>>> > >> piole...@gmail.com >>>>> >>>>>>>> > >> >>>>> >>>>>>>> > >> >>>>> >>>>>>>> > >> 2015-08-04 17:55 GMT+02:00 Matt . >>>>> >>>>>>>> > <yamakasi....@gmail.com>: >>>>> >>>>>>>> > >> Hi, >>>>> >>>>>>>> > >> >>>>> >>>>>>>> > >> Yes, log is anonymised. >>>>> >>>>>>>> > >> >>>>> >>>>>>>> > >> It's strange, my user doesn't have a > SambaPwdLastSet, >>>>> >>>>>>>> > also >>>>> >>>>> when >>>>> >>>>>> I >>>>> >>>>>>>> > >> change it's password it doesn't get it in ldap. >>>>> >>>>>>>> > >> >>>>> >>>>>>>> > >> There must be something going wrong I guess. >>>>> >>>>>>>> > >> >>>>> >>>>>>>> > >> Matt >>>>> >>>>>>>> > >> >>>>> >>>>>>>> > >> 2015-08-04 17:45 GMT+02:00 Christopher Lamb >>>>> >>>>>>>> > > <christopher.l...@ch.ibm.com >>>>> >>>>>>>> > >> >: >>>>> >>>>>>>> > >> > Hi Matt >>>>> >>>>>>>> > >> > >>>>> >>>>>>>> > >> > I assume [username] is a real username, identical > to >>>>> >>>>>>>> > that >>>>> >>>> in >>>>> >>>>>>>> > the >>>>> >>>>>>>> > >> FreeIPA >>>>> >>>>>>>> > >> > cn=accounts, cn=users tree? (i.e. you anonymised > the >>>>> >>>>>>>> > log >>>>> >>>>>>>> > extract). >>>>> >>>>>>>> > >> > >>>>> >>>>>>>> > >> > You user should be a member of the appropriate > samba >>>>> >>> groups >>>>> >>>>>>>> > that >>>>> >>>>>>>> > you >>>>> >>>>>>>> > >> setup >>>>> >>>>>>>> > >> > in FreeIPA. >>>>> >>>>>>>> > >> > >>>>> >>>>>>>> > >> > You should check that the user attribute >>>>> >>>>>>>> > SambaPwdLastSet >>>>> >>> is >>>>> >>>>>> set >>>>> >>>>>>>> > to >>>>> >>>>>>>> > a >>>>> >>>>>>>> > >> > positive value (e.g. 1). If not you get an error > in >>>>> >>>>>>>> > the >>>>> >>>>> Samba >>>>> >>>>>>>> > logs >>>>> >>>>>>>> > - >>>>> >>>>>>>> > > I >>>>> >>>>>>>> > >> > would need to play around again with a test user > to >>>>> >>>>>>>> > find >>>>> >>>> out >>>>> >>>>>>>> > the >>>>> >>>>>>>> > > exact >>>>> >>>>>>>> > >> > error. >>>>> >>>>>>>> > >> > >>>>> >>>>>>>> > >> > I don't understand what you mean about syncing the >>>>> >>>>>>>> > users >>>>> >>>>>> local, >>>>> >>>>>>>> > but >>>>> >>>>>>>> > > we >>>>> >>>>>>>> > >> did >>>>> >>>>>>>> > >> > not need to do anything like that. >>>>> >>>>>>>> > >> > >>>>> >>>>>>>> > >> > Chris >>>>> >>>>>>>> > >> > >>>>> >>>>>>>> > >> > >>>>> >>>>>>>> > >> > >>>>> >>>>>>>> > >> > >>>>> >>>>>>>> > >> > From: "Matt ." <yamakasi....@gmail.com> >>>>> >>>>>>>> > >> > To: Christopher Lamb/Switzerland/IBM@IBMCH >>>>> >>>>>>>> > >> > Cc: "freeipa-users@redhat.com" >>>>> >>>>> <freeipa-users@redhat.com> >>>>> >>>>>>>> > >> > Date: 04.08.2015 15:33 >>>>> >>>>>>>> > >> > Subject: Re: [Freeipa-users] Ubuntu Samba >>>>> >>>>>>>> > Server >>>>> >>>> Auth >>>>> >>>>>>>> > against >>>>> >>>>>>>> > >> IPA >>>>> >>>>>>>> > >> > >>>>> >>>>>>>> > >> > >>>>> >>>>>>>> > >> > >>>>> >>>>>>>> > >> > Hi Chris, >>>>> >>>>>>>> > >> > >>>>> >>>>>>>> > >> > A puppet run added another passdb backend, that > was >>>>> >>> causing >>>>> >>>>>> my >>>>> >>>>>>>> > issue. >>>>> >>>>>>>> > >> > >>>>> >>>>>>>> > >> > What I still experience is: >>>>> >>>>>>>> > >> > >>>>> >>>>>>>> > >> > >>>>> >>>>>>>> > >> > [2015/08/04 15:29:45.477783, 3] >>>>> >>>>>>>> > >> > ../source3/auth/check_samsec.c:399 > (check_sam_security) >>>>> >>>>>>>> > >> > check_sam_security: Couldn't find user > 'username' in >>>>> >>>>>> passdb. >>>>> >>>>>>>> > >> > [2015/08/04 15:29:45.478026, 2] >>>>> >>>>>>>> > >> > ../source3/auth/auth.c:288 > (auth_check_ntlm_password) >>>>> >>>>>>>> > >> > check_ntlm_password: Authentication for user >>>>> >> [username] >>>>> >>>>> -> >>>>> >>>>>>>> > >> > [username] FAILED with error > NT_STATUS_NO_SUCH_USER >>>>> >>>>>>>> > >> > >>>>> >>>>>>>> > >> > >>>>> >>>>>>>> > >> > I also wonder if I shall still sync the users > local, >>>>> >>>>>>>> > or >>>>> >> is >>>>> >>>>> it >>>>> >>>>>>>> > > needed ? >>>>> >>>>>>>> > >> > >>>>> >>>>>>>> > >> > Thanks again, >>>>> >>>>>>>> > >> > >>>>> >>>>>>>> > >> > Matt >>>>> >>>>>>>> > >> > >>>>> >>>>>>>> > >> > 2015-08-04 14:16 GMT+02:00 Christopher Lamb < >>>>> >>>>>>>> > >> christopher.l...@ch.ibm.com>: >>>>> >>>>>>>> > >> >> Hi Matt >>>>> >>>>>>>> > >> >> >>>>> >>>>>>>> > >> >> From our smb.conf file: >>>>> >>>>>>>> > >> >> >>>>> >>>>>>>> > >> >> [global] >>>>> >>>>>>>> > >> >> security = user >>>>> >>>>>>>> > >> >> passdb backend = >>>>> >>>>>>>> > ldapsam:ldap://xxx-ldap2.my.silly.example.com >>>>> >>>>>>>> > >> >> ldap suffix = dc=my,dc=silly,dc=example,dc=com >>>>> >>>>>>>> > >> >> ldap admin dn = cn=Directory Manager >>>>> >>>>>>>> > >> >> >>>>> >>>>>>>> > >> >> So yes, we use Directory Manager, it works for > us. I >>>>> >> have >>>>> >>>>>> not >>>>> >>>>>>>> > tried >>>>> >>>>>>>> > >> with >>>>> >>>>>>>> > >> > a >>>>> >>>>>>>> > >> >> less powerful user, but it is conceivable that a >>>>> >>>>>>>> > lesser >>>>> >>>>> user >>>>> >>>>>>>> > may >>>>> >>>>>>>> > not >>>>> >>>>>>>> > >> see >>>>> >>>>>>>> > >> >> all the required attributes, resulting in "no > such >>>>> >>>>>>>> > user" >>>>> >>>>>>>> > errors. >>>>> >>>>>>>> > >> >> >>>>> >>>>>>>> > >> >> Chris >>>>> >>>>>>>> > >> >> >>>>> >>>>>>>> > >> >> >>>>> >>>>>>>> > >> >> >>>>> >>>>>>>> > >> >> >>>>> >>>>>>>> > >> >> From: "Matt ." <yamakasi....@gmail.com> >>>>> >>>>>>>> > >> >> To: Christopher Lamb/Switzerland/IBM@IBMCH >>>>> >>>>>>>> > >> >> Cc: "freeipa-users@redhat.com" >>>>> >>>>>> <freeipa-users@redhat.com> >>>>> >>>>>>>> > >> >> Date: 04.08.2015 13:32 >>>>> >>>>>>>> > >> >> Subject: Re: [Freeipa-users] Ubuntu Samba >>>>> >>>>>>>> > Server >>>>> >>>>> Auth >>>>> >>>>>>>> > against >>>>> >>>>>>>> > >> IPA >>>>> >>>>>>>> > >> >> >>>>> >>>>>>>> > >> >> >>>>> >>>>>>>> > >> >> >>>>> >>>>>>>> > >> >> Hi Chris, >>>>> >>>>>>>> > >> >> >>>>> >>>>>>>> > >> >> Thanks for the heads up, indeed local is 4 I see > now >>>>> >> when >>>>> >>>> I >>>>> >>>>>>>> > add a >>>>> >>>>>>>> > >> >> group from the GUI, great thanks! >>>>> >>>>>>>> > >> >> >>>>> >>>>>>>> > >> >> But do you use Directory Manager as ldap admin > user >>>>> >>>>>>>> > or >>>>> >>>> some >>>>> >>>>>>>> > other >>>>> >>>>>>>> > >> >> admin account ? >>>>> >>>>>>>> > >> >> >>>>> >>>>>>>> > >> >> I'm not sure id DM is needed and it should get > that >>>>> >>>>>>>> > deep >>>>> >>>>>> into >>>>> >>>>>>>> > IPA. >>>>> >>>>>>>> > >> >> Also when starting samba it cannot find "such > user" >>>>> >>>>>>>> > as >>>>> >>>> that >>>>> >>>>>>>> > sounds >>>>> >>>>>>>> > >> >> quite known as it has no UID. >>>>> >>>>>>>> > >> >> >>>>> >>>>>>>> > >> >> From your config I see you use DM, this should > work ? >>>>> >>>>>>>> > >> >> >>>>> >>>>>>>> > >> >> Thanks! >>>>> >>>>>>>> > >> >> >>>>> >>>>>>>> > >> >> >>>>> >>>>>>>> > >> >> Matt >>>>> >>>>>>>> > >> >> >>>>> >>>>>>>> > >> >> >>>>> >>>>>>>> > >> > >>>>> >>>>>>>> > >> > >>>>> >>>>>>>> > >> > >>>>> >>>>>>>> > >> > >>>>> >>>>>>>> > >> >>>>> >>>>>>>> > >> -- >>>>> >>>>>>>> > >> Manage your subscription for the Freeipa-users > mailing >>>>> >> list: >>>>> >>>>>>>> > >> > https://www.redhat.com/mailman/listinfo/freeipa-users >>>>> >>>>>>>> > >> Go to http://freeipa.org for more info on the > project >>>>> >>>>>>>> > >> >>>>> >>>>>>>> > >> >>>>> >>>>>>>> > >> >>>>> >>>>>>>> > > >>>>> >>>>>>>> > > >>>>> >>>>>>>> > > >>>>> >>>>>>>> > > >>>>> >>>>>>>> > > -- >>>>> >>>>>>>> > > Manage your subscription for the Freeipa-users mailing >>>>> >>>>>>>> > list: >>>>> >>>>>>>> > > https://www.redhat.com/mailman/listinfo/freeipa-users >>>>> >>>>>>>> > > Go to http://freeipa.org for more info on the project >>>>> >>>>>>>> > > >>>>> >>>>>>>> > > >>>>> >>>>>>>> > > >>>>> >>>>>>>> > > >>>>> >>>>>>>> > >>>>> >>>>>>>> > -- >>>>> >>>>>>>> > Manage your subscription for the Freeipa-users mailing > list: >>>>> >>>>>>>> > https://www.redhat.com/mailman/listinfo/freeipa-users >>>>> >>>>>>>> > Go to http://freeipa.org for more info on the project >>>>> >>>>>>>> > >>>>> >>>>>>>> > >>>>> >>>>>>>> > >>>>> >>>>>>> >>>>> >>>>>>> >>>>> >>>>>> >>>>> >>>>>> >>>>> >>>>>> >>>>> >>>>>> >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> >>>> >>>>> >>>> >>>>> >>>> >>>>> >>>> >>>>> >>> >>>>> >>> >>>>> >>> >>>>> >>> >>>>> >> >>>>> >> >>>>> >> >>>>> >> >>>> >>>> > > > > -- Manage your subscription for the Freeipa-users mailing list: https://www.redhat.com/mailman/listinfo/freeipa-users Go to http://freeipa.org for more info on the project
