Hi Guys, Please keep this topic updated as many people seem to have this question.
What's the status at your side ? Cheers, Matt 2015-09-04 15:27 GMT+02:00 Matt . <[email protected]>: > Hi, > > Does everyone have this working or gived up on it ? > > Chers, > > Matt > > 2015-08-26 20:07 GMT+02:00 Matt . <[email protected]>: >> Chris, >> >> How far are you on this ? I'm stuck atm :( >> >> I hope you have some reference notes to follow and check out. >> >> Thanks! >> >> Matt >> >> 2015-08-20 22:15 GMT+02:00 Matt . <[email protected]>: >>> Hi Chris, >>> >>> Would be great to see! >>> >>> If I have it working and we have 2-3 testcases I think we can add it >>> to the IPA docs! >>> >>> Keep me updated! >>> >>> Thanks >>> >>> Matt >>> >>> 2015-08-20 8:49 GMT+02:00 Christopher Lamb <[email protected]>: >>>> Matt >>>> >>>> Once I got Samba and FreeIPA integrated (by the "good old extensions" >>>> path), I always use FreeIPA to administer users. I have never tried the >>>> samba tools like smbpasswd. >>>> >>>> I still have a wiki how-to in the works, but I had to focus on some other >>>> issues for a while. >>>> >>>> Chris >>>> >>>> >>>> >>>> From: "Matt ." <[email protected]> >>>> To: Youenn PIOLET <[email protected]> >>>> Cc: Christopher Lamb/Switzerland/IBM@IBMCH, >>>> "[email protected]" <[email protected]> >>>> Date: 20.08.2015 08:12 >>>> Subject: Re: [Freeipa-users] Ubuntu Samba Server Auth against IPA >>>> >>>> >>>> >>>> HI Guys, >>>> >>>> Anyone still a working clue/test here ? >>>> >>>> I didn't came further as it seems there need to be some domain join / >>>> match following the freeipa devs. >>>> >>>> Thanks! >>>> >>>> Matt >>>> >>>> 2015-08-13 13:09 GMT+02:00 Matt . <[email protected]>: >>>>> Hi, >>>>> >>>>> I might have found somthing which I already seen in the logs. >>>>> >>>>> I did a smbpasswd my username on the samba server, it connects to ldap >>>>> very well. I give my new password and get the following: >>>>> >>>>> smbldap_search_ext: base => [dc=my,dc=domain], filter => >>>>> [(&(objectClass=ipaNTGroupAttrs)(| >>>> (ipaNTSecurityIdentifier=S-1----my--sid---)))], >>>>> scope => [2] >>>>> Attribute [displayName] not found. >>>>> Could not retrieve 'displayName' attribute from cn=Default SMB >>>>> Group,cn=groups,cn=accounts,dc=my,dc=domain >>>>> Sid S-1----my--sid--- -> MYDOMAIN\Default SMB Group(2) >>>>> >>>>> So something is missing! >>>>> >>>>> Thanks so far guys! >>>>> >>>>> Cheers, >>>>> >>>>> Matt >>>>> >>>>> 2015-08-13 12:02 GMT+02:00 Matt . <[email protected]>: >>>>>> Hi Youenn, >>>>>> >>>>>> OK thanks! this takes me a little but futher now and I see some good >>>>>> stuff in my logging. >>>>>> >>>>>> I'm testing on a Windows 10 Machine which is not member of an AD or >>>>>> so, so that might be my issue for now ? >>>>>> >>>>>> When testing on the samba box itself as my user I get: >>>>>> >>>>>> >>>>>> [myusername@smb-01 ~]$ smbclient //smb-01.domain.local/shares >>>>>> >>>>>> ... >>>>>> Checking NTLMSSP password for MSP\myusername failed: >>>> NT_STATUS_WRONG_PASSWORD >>>>>> ... >>>>>> SPNEGO login failed: NT_STATUS_WRONG_PASSWORD >>>>>> >>>>>> >>>>>> Maybe I have an issue with encrypted passwords ? >>>>>> >>>>>> >>>>>> When we have this all working, I think we have a howto :D >>>>>> >>>>>> Thanks! >>>>>> >>>>>> Matt >>>>>> >>>>>> 2015-08-13 10:53 GMT+02:00 Youenn PIOLET <[email protected]>: >>>>>>> Hi Matt >>>>>>> >>>>>>> - CentOS : Did you copy ipasam.so and change your smb.conf accordingly? >>>>>>> sambaSamAccount is not needed anymore that way. >>>>>>> - Default IPA Way : won't work if your Windows is not part of a domain >>>>>>> controller. DOMAIN\username may work for some users using Windows 7 - >>>> not 8 >>>>>>> nor 10 (it did for me but I was the only one at the office... quite >>>> useless) >>>>>>> >>>>>>> This config may work on your CentOS (for the ipasam way): >>>>>>> workgroup = TEST >>>>>>> realm = TEST.NET >>>>>>> kerberos method = dedicated keytab >>>>>>> dedicated keytab file = FILE:/<.....>/samba.keytab >>>>>>> create krb5 conf = no >>>>>>> security = user >>>>>>> encrypt passwords = true >>>>>>> passdb backend = ipasam:ldaps://youripa.test.net >>>>>>> ldapsam:trusted = yes >>>>>>> ldapsuffix = test.net >>>>>>> ldap user suffix = cn=users,cn=accounts >>>>>>> ldap group suffix = cn=groups,cn=accounts >>>>>>> >>>>>>> >>>>>>> -- >>>>>>> Youenn Piolet >>>>>>> [email protected] >>>>>>> >>>>>>> >>>>>>> 2015-08-12 22:15 GMT+02:00 Matt . <[email protected]>: >>>>>>>> >>>>>>>> Hi, >>>>>>>> >>>>>>>> OK the default IPA way works great actually when testing it as >>>> described >>>>>>>> here: >>>>>>>> >>>>>>>> >>>> http://www.freeipa.org/page/Howto/Integrating_a_Samba_File_Server_With_IPA >>>>>>>> >>>>>>>> On the samba server I can auth and see my share where I want to >>>> connect >>>>>>>> to. >>>>>>>> >>>>>>>> The issue is, on Windows I cannot auth, even when I do DOMAIN\username >>>>>>>> as username >>>>>>>> >>>>>>>> So, the IPA way should work. >>>>>>>> >>>>>>>> Any comments here ? >>>>>>>> >>>>>>>> Cheers, >>>>>>>> >>>>>>>> Matt >>>>>>>> >>>>>>>> 2015-08-12 19:00 GMT+02:00 Matt . <[email protected]>: >>>>>>>> > HI GUys, >>>>>>>> > >>>>>>>> > I'm testing this out and I think I almost setup, this on a CentOS >>>> samba >>>>>>>> > server. >>>>>>>> > >>>>>>>> > I'm using the ipa-adtrust way of Youeen but it seems we still need >>>> to >>>>>>>> > add (objectclass=sambaSamAccount)) ? >>>>>>>> > >>>>>>>> > Info is welcome! >>>>>>>> > >>>>>>>> > I will report back when I have it working. >>>>>>>> > >>>>>>>> > Thanks! >>>>>>>> > >>>>>>>> > Matt >>>>>>>> > >>>>>>>> > 2015-08-10 11:16 GMT+02:00 Christopher Lamb >>>>>>>> > <[email protected]>: >>>>>>>> >> The next route I will try - is the one Youeen took, using >>>> ipa-adtrust >>>>>>>> >> >>>>>>>> >> >>>>>>>> >> >>>>>>>> >> From: "Matt ." <[email protected]> >>>>>>>> >> To: Christopher Lamb/Switzerland/IBM@IBMCH, >>>>>>>> >> "[email protected]" <[email protected]> >>>>>>>> >> Date: 10.08.2015 10:03 >>>>>>>> >> Subject: Re: [Freeipa-users] Ubuntu Samba Server Auth >>>> against >>>>>>>> >> IPA >>>>>>>> >> >>>>>>>> >> >>>>>>>> >> >>>>>>>> >> Hi Chris, >>>>>>>> >> >>>>>>>> >> Okay this is good to hear. >>>>>>>> >> >>>>>>>> >> But don't we want a IPA managed Scheme ? >>>>>>>> >> >>>>>>>> >> When I did a "ipa-adtrust-install --add-sids" it also wanted a >>>> local >>>>>>>> >> installed Samba and I wonder why. >>>>>>>> >> >>>>>>>> >> Good that we make some progres on making it all clear. >>>>>>>> >> >>>>>>>> >> Cheers, >>>>>>>> >> >>>>>>>> >> Matt >>>>>>>> >> >>>>>>>> >> 2015-08-10 6:12 GMT+02:00 Christopher Lamb >>>>>>>> >> <[email protected]>: >>>>>>>> >>> ldapsam + the samba extensions, pretty much as described in the >>>>>>>> >> Techslaves >>>>>>>> >>> article. Once I have a draft for the wiki page, I will mail you. >>>>>>>> >>> >>>>>>>> >>> >>>>>>>> >>> >>>>>>>> >>> From: "Matt ." <[email protected]> >>>>>>>> >>> To: Christopher Lamb/Switzerland/IBM@IBMCH, >>>>>>>> >>> "[email protected]" <[email protected]> >>>>>>>> >>> Date: 09.08.2015 21:17 >>>>>>>> >>> Subject: Re: [Freeipa-users] Ubuntu Samba Server Auth >>>> against >>>>>>>> >>> IPA >>>>>>>> >>> >>>>>>>> >>> >>>>>>>> >>> >>>>>>>> >>> Hi, >>>>>>>> >>> >>>>>>>> >>> Yes I know about "anything" but which way did you use now ? >>>>>>>> >>> >>>>>>>> >>> >>>>>>>> >>> >>>>>>>> >>> 2015-08-09 20:56 GMT+02:00 Christopher Lamb >>>>>>>> >> <[email protected]>: >>>>>>>> >>>> Hi Matt >>>>>>>> >>>> >>>>>>>> >>>> I am on OEL 7.1. - so anything that works on that should be good >>>> for >>>>>>>> >> RHEL >>>>>>>> >>>> and Centos 7.x >>>>>>>> >>>> >>>>>>>> >>>> I intend to add a how-to to the FreeIPA Wiki over the next few >>>> days. >>>>>>>> >>>> As >>>>>>>> >>> we >>>>>>>> >>>> have suggested earlier, we will likely end up with several, one >>>> for >>>>>>>> >>>> each >>>>>>>> >>> of >>>>>>>> >>>> the possible integration paths. >>>>>>>> >>>> >>>>>>>> >>>> Chris >>>>>>>> >>>> >>>>>>>> >>>> >>>>>>>> >>>> >>>>>>>> >>>> >>>>>>>> >>>> >>>>>>>> >>>> From: "Matt ." <[email protected]> >>>>>>>> >>>> To: Christopher Lamb/Switzerland/IBM@IBMCH, >>>>>>>> >>>> "[email protected]" <[email protected]> >>>>>>>> >>>> Date: 09.08.2015 16:45 >>>>>>>> >>>> Subject: Re: [Freeipa-users] Ubuntu Samba Server Auth >>>> against >>>>>>>> >>>> IPA >>>>>>>> >>>> >>>>>>>> >>>> >>>>>>>> >>>> >>>>>>>> >>>> Hi Chris, >>>>>>>> >>>> >>>>>>>> >>>> This sounds great! >>>>>>>> >>>> >>>>>>>> >>>> What are you using now, both CentOS ? So Samba and FreeIPA ? >>>>>>>> >>>> >>>>>>>> >>>> Maybe it's good to explain which way you used now in steps too, >>>> so we >>>>>>>> >>>> can combine or create multiple howto's ? >>>>>>>> >>>> >>>>>>>> >>>> At least we are going somewhere! >>>>>>>> >>>> >>>>>>>> >>>> Thanks, >>>>>>>> >>>> >>>>>>>> >>>> Matt >>>>>>>> >>>> >>>>>>>> >>>> 2015-08-09 14:54 GMT+02:00 Christopher Lamb >>>>>>>> >>> <[email protected]>: >>>>>>>> >>>>> Hi Matt >>>>>>>> >>>>> >>>>>>>> >>>>> My test integration of FreeIPA 4.x and Samba 4.x with the "good >>>> old >>>>>>>> >>> Samba >>>>>>>> >>>>> Schema extensions) is up and working, almost flawlessly. >>>>>>>> >>>>> >>>>>>>> >>>>> I can add users and groups via the FreeIPA CLI, and they get the >>>>>>>> >> correct >>>>>>>> >>>>> ObjectClasses / attributes required for Samba. >>>>>>>> >>>>> >>>>>>>> >>>>> So far I have not yet bothered to try the extensions to the >>>> WebUI, >>>>>>>> >>>> because >>>>>>>> >>>>> it is currently giving me the classic "Your session has expired. >>>>>>>> >>>>> Please >>>>>>>> >>>>> re-login." error which renders the WebUI useless. >>>>>>>> >>>>> >>>>>>>> >>>>> The only problem I have so far encountered managing Samba / >>>> FreeIPA >>>>>>>> >>> users >>>>>>>> >>>>> via FreeIPA CLI commands is with the handling of the attribute >>>>>>>> >>>>> sambaPwdLastSet. This is the subject of an existing thread, also >>>>>>>> >> updated >>>>>>>> >>>>> today. >>>>>>>> >>>>> >>>>>>>> >>>>> There is also an existing alternative to hacking group.py, using >>>>>>>> >>>>> "Class >>>>>>>> >>>> of >>>>>>>> >>>>> Service" (Cos) documented in this thread from February 2015 >>>>>>>> >>>>> >>>>>>>> >>> >>>>>>>> >>> >>>> https://www.redhat.com/archives/freeipa-users/2015-February/msg00172.html >>>>>>>> >>>> . >>>>>>>> >>>>> I have not yet tried it, but it sounds reasonable. >>>>>>>> >>>>> >>>>>>>> >>>>> Chris >>>>>>>> >>>>> >>>>>>>> >>>>> >>>>>>>> >>>>> >>>>>>>> >>>>> >>>>>>>> >>>>> >>>>>>>> >>>>> From: "Matt ." <[email protected]> >>>>>>>> >>>>> To: Christopher Lamb/Switzerland/IBM@IBMCH >>>>>>>> >>>>> Cc: "[email protected]" <[email protected]>, >>>>>>>> >>>>> Youenn >>>>>>>> >>>>> PIOLET <[email protected]> >>>>>>>> >>>>> Date: 06.08.2015 16:19 >>>>>>>> >>>>> Subject: Re: [Freeipa-users] Ubuntu Samba Server Auth >>>> against >>>>>>>> >> IPA >>>>>>>> >>>>> >>>>>>>> >>>>> >>>>>>>> >>>>> >>>>>>>> >>>>> Hi Chris, >>>>>>>> >>>>> >>>>>>>> >>>>> OK, than we might create two different versions of the wiki, I >>>> think >>>>>>>> >>>>> this is nice. >>>>>>>> >>>>> >>>>>>>> >>>>> I'm still figuring out why I get that: >>>>>>>> >>>>> >>>>>>>> >>>>> IPA Error 4205: ObjectclassViolation >>>>>>>> >>>>> >>>>>>>> >>>>> missing attribute "sambaGroupType" required by object class >>>>>>>> >>>>> "sambaGroupMapping" >>>>>>>> >>>>> >>>>>>>> >>>>> Matt >>>>>>>> >>>>> >>>>>>>> >>>>> 2015-08-06 16:09 GMT+02:00 Christopher Lamb >>>>>>>> >>>> <[email protected]>: >>>>>>>> >>>>>> Hi Matt >>>>>>>> >>>>>> >>>>>>>> >>>>>> As far as I can make out, there are at least 2 viable Samba / >>>>>>>> >>>>>> FreeIPA >>>>>>>> >>>>>> integration paths. >>>>>>>> >>>>>> >>>>>>>> >>>>>> The route I took is suited where there is no Active Directory >>>>>>>> >> involved: >>>>>>>> >>>>> In >>>>>>>> >>>>>> my case all the Windows, OSX and Linux clients are islands that >>>> sit >>>>>>>> >>>>>> on >>>>>>>> >>>>> the >>>>>>>> >>>>>> same network. >>>>>>>> >>>>>> >>>>>>>> >>>>>> The route that Youenn has taken (unless I have got completely >>>> the >>>>>>>> >> wrong >>>>>>>> >>>>> end >>>>>>>> >>>>>> of the stick) requires Active Directory in the architecture. >>>>>>>> >>>>>> >>>>>>>> >>>>>> Chris >>>>>>>> >>>>>> >>>>>>>> >>>>>> >>>>>>>> >>>>>> >>>>>>>> >>>>>> From: "Matt ." <[email protected]> >>>>>>>> >>>>>> To: Youenn PIOLET <[email protected]> >>>>>>>> >>>>>> Cc: Christopher Lamb/Switzerland/IBM@IBMCH, >>>>>>>> >>>>>> "[email protected]" >>>> <[email protected]> >>>>>>>> >>>>>> Date: 06.08.2015 14:42 >>>>>>>> >>>>>> Subject: Re: [Freeipa-users] Ubuntu Samba Server Auth >>>>>>>> >>>>>> against >>>>>>>> >>> IPA >>>>>>>> >>>>>> >>>>>>>> >>>>>> >>>>>>>> >>>>>> >>>>>>>> >>>>>> Hi, >>>>>>>> >>>>>> >>>>>>>> >>>>>> OK, this sounds already quite logical, but I'm still refering >>>> to >>>>>>>> >>>>>> the >>>>>>>> >>>>>> old howto we found earlier, does that one still apply somewhere >>>> or >>>>>>>> >>>>>> not >>>>>>>> >>>>>> at all ? >>>>>>>> >>>>>> >>>>>>>> >>>>>> Thanks, >>>>>>>> >>>>>> >>>>>>>> >>>>>> Matt >>>>>>>> >>>>>> >>>>>>>> >>>>>> >>>>>>>> >>>>>> >>>>>>>> >>>>>> 2015-08-06 12:23 GMT+02:00 Youenn PIOLET <[email protected]>: >>>>>>>> >>>>>>> Hey guys, >>>>>>>> >>>>>>> >>>>>>>> >>>>>>> I'll try to make a tutorial soon, sorry I'm quite in a rush >>>> these >>>>>>>> >>>>> days :) >>>>>>>> >>>>>>> >>>>>>>> >>>>>>> General idea: >>>>>>>> >>>>>>> >>>>>>>> >>>>>>> On FreeIPA (4.1) >>>>>>>> >>>>>>> - `ipa-adtrust-install --add-sids` (creates >>>>>>>> >>>>>>> ipaNTsecurityidentifier >>>>>>>> >>>>>>> attribude, also known as SID) >>>>>>>> >>>>>>> - regenerate each user password to build ipaNTHash attribute, >>>> not >>>>>>>> >> here >>>>>>>> >>>>> by >>>>>>>> >>>>>>> default on users >>>>>>>> >>>>>>> - use your ldap browser to check ipaNTHash values are here on >>>> user >>>>>>>> >>>>>> objects >>>>>>>> >>>>>>> - create a CIFS service for your samba server >>>>>>>> >>>>>>> - Create user roles/permissions as described here: >>>>>>>> >>>>>>> >>>>>>>> >>>>>> >>>>>>>> >>>>> >>>>>>>> >>>> >>>>>>>> >>> >>>>>>>> >> >>>>>>>> >> >>>> http://freeipa-users.redhat.narkive.com/ez2uKpFS/authenticate-samba-3-or-4-with-freeipa >>>> >>>>>>>> >> >>>>>>>> >>> >>>>>>>> >>>> >>>>>>>> >>>>> >>>>>>>> >>>>>> >>>>>>>> >>>>>>> so that CIFS service will be able to read >>>> ipaNTsecurityidentifier >>>>>>>> >>>>>>> and >>>>>>>> >>>>>>> ipaNTHash attributes in LDAP (ACI) >>>>>>>> >>>>>>> - SCP ipasam.so module to your cifs server (this is the magic >>>>>>>> >> trick) : >>>>>>>> >>>>>> scp >>>>>>>> >>>>>>> /usr/lib64/samba/pdb/ipasam.so >>>>>>>> >>>>>>> [email protected]:/usr/lib64/samba/pdb/ You can also >>>> try to >>>>>>>> >>>>>> recompile >>>>>>>> >>>>>>> it. >>>>>>>> >>>>>>> >>>>>>>> >>>>>>> On SAMBA Server side (CentOS 7...) >>>>>>>> >>>>>>> - Install server keytab file for CIFS >>>>>>>> >>>>>>> - check ipasam.so is here. >>>>>>>> >>>>>>> - check you can read password hash in LDAP with `ldapsearch -Y >>>>>>>> >>>>>>> GSSAPI >>>>>>>> >>>>>>> uid=admin ipaNTHash` thanks to kerberos >>>>>>>> >>>>>>> - make your smb.conf following the linked thread and restart >>>>>>>> >>>>>>> service >>>>>>>> >>>>>>> >>>>>>>> >>>>>>> I don't know if it works in Ubuntu. I know sssd has evolved >>>>>>>> >>>>>>> quickly >>>>>>>> >>> and >>>>>>>> >>>>>>> ipasam may use quite recent functionalities, the best is to >>>> just >>>>>>>> >>>>>>> try. >>>>>>>> >>>>> You >>>>>>>> >>>>>>> can read in previous thread : "If you insist on Ubuntu you >>>> need to >>>>>>>> >> get >>>>>>>> >>>>>>> ipasam somewhere, most likely to compile it yourself". >>>>>>>> >>>>>>> >>>>>>>> >>>>>>> Make sure your user has ipaNTHash attribute :) >>>>>>>> >>>>>>> >>>>>>>> >>>>>>> You may want to debug authentication on samba server, I >>>> usually do >>>>>>>> >>>> this: >>>>>>>> >>>>>>> `tail -f /var/log/samba/log* | grep <username> >>>>>>>> >>>>>>> >>>>>>>> >>>>>>> Cheers >>>>>>>> >>>>>>> -- >>>>>>>> >>>>>>> Youenn Piolet >>>>>>>> >>>>>>> [email protected] >>>>>>>> >>>>>>> >>>>>>>> >>>>>>> >>>>>>>> >>>>>>> 2015-08-05 17:40 GMT+02:00 Matt . <[email protected]>: >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> Hi, >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> This sounds great to me too, but a howto would help to make >>>> it >>>>>>>> >>>>>>>> more >>>>>>>> >>>>>>>> clear about what you have done here. The thread confuses me a >>>>>>>> >>>>>>>> little >>>>>>>> >>>>>>>> bit. >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> Can you paste your commands so we can test out too and report >>>>>>>> >>>>>>>> back ? >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> Thanks! >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> Matt >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>>> 2015-08-05 15:18 GMT+02:00 Christopher Lamb >>>>>>>> >>>>>> <[email protected]>: >>>>>>>> >>>>>>>> > Hi Youenn >>>>>>>> >>>>>>>> > >>>>>>>> >>>>>>>> > Good news that you have got an integration working >>>>>>>> >>>>>>>> > >>>>>>>> >>>>>>>> > Now you have got it going, and the solution is fresh in >>>> your >>>>>>>> >>>>>>>> > mind, >>>>>>>> >>>>> how >>>>>>>> >>>>>>>> > about adding a How-to page on this solution to the FreeIPA >>>>>>>> >>>>>>>> > wiki? >>>>>>>> >>>>>>>> > >>>>>>>> >>>>>>>> > Chris >>>>>>>> >>>>>>>> > >>>>>>>> >>>>>>>> > >>>>>>>> >>>>>>>> > >>>>>>>> >>>>>>>> > From: Youenn PIOLET <[email protected]> >>>>>>>> >>>>>>>> > To: "Matt ." <[email protected]> >>>>>>>> >>>>>>>> > Cc: Christopher Lamb/Switzerland/IBM@IBMCH, >>>>>>>> >>>>>>>> > "[email protected]" >>>>>>>> >>>>>>>> > <[email protected]> >>>>>>>> >>>>>>>> > Date: 05.08.2015 14:51 >>>>>>>> >>>>>>>> > Subject: Re: [Freeipa-users] Ubuntu Samba Server >>>> Auth >>>>>>>> >>> against >>>>>>>> >>>>>> IPA >>>>>>>> >>>>>>>> > >>>>>>>> >>>>>>>> > >>>>>>>> >>>>>>>> > >>>>>>>> >>>>>>>> > Hi guys, >>>>>>>> >>>>>>>> > >>>>>>>> >>>>>>>> > Thank you so much your previous answers. >>>>>>>> >>>>>>>> > I realised my SID were stored in ipaNTsecurityidentifier, >>>>>>>> >>>>>>>> > thanks >>>>>>>> >> to >>>>>>>> >>>>>>>> > ipa-adtrust-install --add-sids >>>>>>>> >>>>>>>> > >>>>>>>> >>>>>>>> > I found an other way to configure smb here: >>>>>>>> >>>>>>>> > >>>>>>>> >>>>>>>> > >>>>>>>> >>>>>> >>>>>>>> >>>>> >>>>>>>> >>>> >>>>>>>> >>> >>>>>>>> >> >>>>>>>> >> >>>> http://freeipa-users.redhat.narkive.com/ez2uKpFS/authenticate-samba-3-or-4-with-freeipa >>>> >>>>>>>> >> >>>>>>>> >>> >>>>>>>> >>>> >>>>>>>> >>>>> >>>>>>>> >>>>>> >>>>>>>> >>>>>>>> > It works perfectly. >>>>>>>> >>>>>>>> > >>>>>>>> >>>>>>>> > I'm using module ipasam.so I have manually scp to the samba >>>>>>>> >> server, >>>>>>>> >>>>>>>> > Samba is set to use kerberos + ldapsam via this ipasam >>>> module. >>>>>>>> >>>>>>>> > Following the instructions, I created a user role allowing >>>>>>>> >>>>>>>> > service >>>>>>>> >>>>>>>> > principal to read ipaNTHash value from the LDAP. >>>>>>>> >>>>>>>> > ipaNTHash are generated each time a user changes his >>>> password. >>>>>>>> >>>>>>>> > Authentication works perfectly on Windows 7, 8 and 10. >>>>>>>> >>>>>>>> > >>>>>>>> >>>>>>>> > For more details, the previously linked thread is quite >>>> clear. >>>>>>>> >>>>>>>> > >>>>>>>> >>>>>>>> > Cheers >>>>>>>> >>>>>>>> > >>>>>>>> >>>>>>>> > -- >>>>>>>> >>>>>>>> > Youenn Piolet >>>>>>>> >>>>>>>> > [email protected] >>>>>>>> >>>>>>>> > >>>>>>>> >>>>>>>> > >>>>>>>> >>>>>>>> > 2015-08-05 11:10 GMT+02:00 Matt . <[email protected]>: >>>>>>>> >>>>>>>> > Hi Chris. >>>>>>>> >>>>>>>> > >>>>>>>> >>>>>>>> > Yes, Apache Studio did that but I was not sure why it >>>>>>>> >>>>>>>> > complained >>>>>>>> >>>> it >>>>>>>> >>>>>>>> > was "already" there. >>>>>>>> >>>>>>>> > >>>>>>>> >>>>>>>> > I'm still getting: >>>>>>>> >>>>>>>> > >>>>>>>> >>>>>>>> > IPA Error 4205: ObjectclassViolation >>>>>>>> >>>>>>>> > >>>>>>>> >>>>>>>> > missing attribute "sambaGroupType" required by object >>>> class >>>>>>>> >>>>>>>> > "sambaGroupMapping" >>>>>>>> >>>>>>>> > >>>>>>>> >>>>>>>> > When adding a user. >>>>>>>> >>>>>>>> > >>>>>>>> >>>>>>>> > I also see "class" as fielname under my "Last name", this >>>> is >>>>>>>> >>>>>>>> > not >>>>>>>> >>>> OK >>>>>>>> >>>>>>>> > also. >>>>>>>> >>>>>>>> > >>>>>>>> >>>>>>>> > >>>>>>>> >>>>>>>> > >>>>>>>> >>>>>>>> > We sure need to make some howto, I think we can nail this >>>>>>>> >> down :) >>>>>>>> >>>>>>>> > >>>>>>>> >>>>>>>> > Thanks for the heads up! >>>>>>>> >>>>>>>> > >>>>>>>> >>>>>>>> > Matthijs >>>>>>>> >>>>>>>> > >>>>>>>> >>>>>>>> > 2015-08-05 7:51 GMT+02:00 Christopher Lamb >>>>>>>> >>>>>>>> > <[email protected]>: >>>>>>>> >>>>>>>> > > Hi Matt >>>>>>>> >>>>>>>> > > >>>>>>>> >>>>>>>> > > If I use Apache Directory Studio to add an attribute >>>>>>>> >>>>>> ipaCustomFields >>>>>>>> >>>>>>>> > to >>>>>>>> >>>>>>>> > > cn=ipaConfig,cn=etc, the operation it performs is a >>>> modify, >>>>>>>> >>>>>>>> > as >>>>>>>> >>>>>> shown >>>>>>>> >>>>>>>> > below: >>>>>>>> >>>>>>>> > > >>>>>>>> >>>>>>>> > > #!RESULT OK >>>>>>>> >>>>>>>> > > #!CONNECTION ldap://xxx-ldap2.my.silly.example.com:yyy >>>>>>>> >>>>>>>> > > #!DATE 2015-08-05T05:45:04.608 >>>>>>>> >>>>>>>> > > dn: >>>> cn=ipaConfig,cn=etc,dc=my,dc=silly,dc=example,dc=com >>>>>>>> >>>>>>>> > > changetype: modify >>>>>>>> >>>>>>>> > > add: ipaCustomFields >>>>>>>> >>>>>>>> > > ipaCustomFields: Samba Group Type,sambagrouptype,true >>>>>>>> >>>>>>>> > > >>>>>>>> >>>>>>>> > > After that I then have a visible attribute >>>> ipaCustomFields >>>>>>>> >>>>>>>> > as >>>>>>>> >>>>>>>> > expected. >>>>>>>> >>>>>>>> > > >>>>>>>> >>>>>>>> > > When adding the attribute, the wizard offered me >>>>>>>> >>>>> "ipaCustomFields" >>>>>>>> >>>>>>>> > as >>>>>>>> >>>>>>>> > > attribute type in a drop down list. >>>>>>>> >>>>>>>> > > >>>>>>>> >>>>>>>> > > Once we get this cracked, we really must write a how-to >>>> on >>>>>>>> >>>>>>>> > the >>>>>>>> >>>>>>>> > FreeIPA >>>>>>>> >>>>>>>> > > Wiki. >>>>>>>> >>>>>>>> > > >>>>>>>> >>>>>>>> > > Chris >>>>>>>> >>>>>>>> > > >>>>>>>> >>>>>>>> > > >>>>>>>> >>>>>>>> > > >>>>>>>> >>>>>>>> > > From: Christopher Lamb/Switzerland/IBM@IBMCH >>>>>>>> >>>>>>>> > > To: "Matt ." <[email protected]> >>>>>>>> >>>>>>>> > > Cc: "[email protected]" >>>>>>>> >>>>>>>> > <[email protected]> >>>>>>>> >>>>>>>> > > Date: 05.08.2015 07:31 >>>>>>>> >>>>>>>> > > Subject: Re: [Freeipa-users] Ubuntu Samba Server >>>>>>>> >>>>>>>> > Auth >>>>>>>> >>>>>> against >>>>>>>> >>>>>>>> > IPA >>>>>>>> >>>>>>>> > > Sent by: [email protected] >>>>>>>> >>>>>>>> > > >>>>>>>> >>>>>>>> > > >>>>>>>> >>>>>>>> > > >>>>>>>> >>>>>>>> > > Hi Matt >>>>>>>> >>>>>>>> > > >>>>>>>> >>>>>>>> > > I also got the same result at that step, but can see >>>>>>>> >>>>>>>> > nothing >>>>>>>> >> in >>>>>>>> >>>>>>>> > Apache >>>>>>>> >>>>>>>> > > Directory Studio. >>>>>>>> >>>>>>>> > > >>>>>>>> >>>>>>>> > > As I am using existing Samba / FreeIPA groups migrated >>>>>>>> >>>>>>>> > across, >>>>>>>> >>>>>> they >>>>>>>> >>>>>>>> > > probably were migrated with all the required >>>> attributes. >>>>>>>> >>>>>>>> > > >>>>>>>> >>>>>>>> > > Looking more closely at that LDIF: I wonder should it >>>> not >>>>>>>> >>>>>>>> > be: >>>>>>>> >>>>>>>> > > >>>>>>>> >>>>>>>> > > ldapmodify -Y GSSAPI <<EOF >>>>>>>> >>>>>>>> > > dn: cn=ipaconfig,cn=etc,dc=domain,dc=tld >>>>>>>> >>>>>>>> > > changetype: modify >>>>>>>> >>>>>>>> > > add: ipaCustomFields >>>>>>>> >>>>>>>> > > ipaCustomFields: "Samba Group Type,sambagrouptype,true" >>>>>>>> >>>>>>>> > > EOF >>>>>>>> >>>>>>>> > > >>>>>>>> >>>>>>>> > > i.e. changetype: modify, instead of changetype add ? >>>>>>>> >>>>>>>> > > >>>>>>>> >>>>>>>> > > I don't want to play around with my prod directory - I >>>> will >>>>>>>> >>>> setup >>>>>>>> >>>>>> an >>>>>>>> >>>>>>>> > EL >>>>>>>> >>>>>>>> > 7.1 >>>>>>>> >>>>>>>> > > VM and install FreeIPA 4.x and Samba 4.x That will >>>> allow me >>>>>>>> >>>>>>>> > to >>>>>>>> >>>>>> play >>>>>>>> >>>>>>>> > around >>>>>>>> >>>>>>>> > > more destructively. >>>>>>>> >>>>>>>> > > >>>>>>>> >>>>>>>> > > Chris >>>>>>>> >>>>>>>> > > >>>>>>>> >>>>>>>> > > >>>>>>>> >>>>>>>> > > >>>>>>>> >>>>>>>> > > >>>>>>>> >>>>>>>> > > >>>>>>>> >>>>>>>> > > From: "Matt ." <[email protected]> >>>>>>>> >>>>>>>> > > To: Christopher Lamb/Switzerland/IBM@IBMCH >>>>>>>> >>>>>>>> > > Cc: Youenn PIOLET <[email protected]>, " >>>>>>>> >>>>>>>> > [email protected]" >>>>>>>> >>>>>>>> > > <[email protected]> >>>>>>>> >>>>>>>> > > Date: 05.08.2015 01:01 >>>>>>>> >>>>>>>> > > Subject: Re: [Freeipa-users] Ubuntu >>>> Samba >>>>>>>> >>> Server >>>>>>>> >>>>>>>> > Auth >>>>>>>> >>>>>>>> > against IPA >>>>>>>> >>>>>>>> > > >>>>>>>> >>>>>>>> > > >>>>>>>> >>>>>>>> > > >>>>>>>> >>>>>>>> > > Hi Chris, >>>>>>>> >>>>>>>> > > >>>>>>>> >>>>>>>> > > I'm at the right path, but my issue is that: >>>>>>>> >>>>>>>> > > >>>>>>>> >>>>>>>> > > ldapmodify -Y GSSAPI <<EOF >>>>>>>> >>>>>>>> > > dn: cn=ipaconfig,cn=etc,dc=domain,dc=tld >>>>>>>> >>>>>>>> > > changetype: add >>>>>>>> >>>>>>>> > > add: ipaCustomFields >>>>>>>> >>>>>>>> > > ipaCustomFields: "Samba Group Type,sambagrouptype,true" >>>>>>>> >>>>>>>> > > EOF >>>>>>>> >>>>>>>> > > >>>>>>>> >>>>>>>> > > Does say it exists, my ldap explorer doesn't show it, >>>> and >>>>>>>> >>>>>>>> > when >>>>>>>> >>> I >>>>>>>> >>>>>> add >>>>>>>> >>>>>>>> > > it manually as an attribute it still fails when I add a >>>>>>>> >>>>>>>> > user >>>>>>>> >> on >>>>>>>> >>>>>> this >>>>>>>> >>>>>>>> > > sambagrouptype as it's needed by the other attributes >>>>>>>> >>>>>>>> > > >>>>>>>> >>>>>>>> > > So that is my issue I think so far. >>>>>>>> >>>>>>>> > > >>>>>>>> >>>>>>>> > > Any clue about that ? >>>>>>>> >>>>>>>> > > >>>>>>>> >>>>>>>> > > No problem "you don't know something or are no guru" we >>>> are >>>>>>>> >> all >>>>>>>> >>>>>>>> > > learning! :) >>>>>>>> >>>>>>>> > > >>>>>>>> >>>>>>>> > > Cheers, >>>>>>>> >>>>>>>> > > >>>>>>>> >>>>>>>> > > Matt >>>>>>>> >>>>>>>> > > >>>>>>>> >>>>>>>> > > >>>>>>>> >>>>>>>> > > 2015-08-04 21:22 GMT+02:00 Christopher Lamb < >>>>>>>> >>>>>>>> > [email protected]>: >>>>>>>> >>>>>>>> > >> Hi Matt, Youeen >>>>>>>> >>>>>>>> > >> >>>>>>>> >>>>>>>> > >> Just to set the background properly, I did not invent >>>> this >>>>>>>> >>>>>> process. >>>>>>>> >>>>>>>> > I >>>>>>>> >>>>>>>> > > know >>>>>>>> >>>>>>>> > >> only a little about FreeIPA, and almost nothing about >>>>>>>> >>>>>>>> > Samba, >>>>>>>> >>>> but >>>>>>>> >>>>>> I >>>>>>>> >>>>>>>> > guess >>>>>>>> >>>>>>>> > > I >>>>>>>> >>>>>>>> > >> was lucky enough to get the integration working on a >>>>>>>> >>>>>>>> > Sunday >>>>>>>> >>>>>>>> > afternoon. >>>>>>>> >>>>>>>> > (I >>>>>>>> >>>>>>>> > >> did have an older FreeIPA 3.x / Samba 3.x installation >>>> as >>>>>>>> >>>>>>>> > a >>>>>>>> >>>>>>>> > reference). >>>>>>>> >>>>>>>> > >> >>>>>>>> >>>>>>>> > >> It sounds like we need to step back, and look at the >>>> test >>>>>>>> >> user >>>>>>>> >>>>>> and >>>>>>>> >>>>>>>> > group >>>>>>>> >>>>>>>> > > in >>>>>>>> >>>>>>>> > >> the FreeIPA LDAP tree. I find using an LDAP browser >>>> makes >>>>>>>> >> this >>>>>>>> >>>>>> much >>>>>>>> >>>>>>>> > > easier. >>>>>>>> >>>>>>>> > >> >>>>>>>> >>>>>>>> > >> My FreeIPA / Samba Users have the following Samba >>>>>>>> >>>>>>>> > extensions >>>>>>>> >>> in >>>>>>>> >>>>>>>> > FreeIPA >>>>>>>> >>>>>>>> > >> (cn=accounts, cn=users): >>>>>>>> >>>>>>>> > >> >>>>>>>> >>>>>>>> > >> * objectClass: sambasamaccount >>>>>>>> >>>>>>>> > >> >>>>>>>> >>>>>>>> > >> * Attributes: sambaSID, sambaNTPassword, >>>> sambaPwdLastSet >>>>>>>> >>>>>>>> > >> >>>>>>>> >>>>>>>> > >> My FreeIPA / Samba Groups have the following Samba >>>>>>>> >>>>>>>> > extensions >>>>>>>> >>>> in >>>>>>>> >>>>>>>> > FreeIPA >>>>>>>> >>>>>>>> > >> (cn=accounts, cn=groups): >>>>>>>> >>>>>>>> > >> >>>>>>>> >>>>>>>> > >> * objectClass: sambaGroupMapping >>>>>>>> >>>>>>>> > >> >>>>>>>> >>>>>>>> > >> * Attributes: sambaGroupType, sambaSID >>>>>>>> >>>>>>>> > >> >>>>>>>> >>>>>>>> > >> The Users must belong to one or more of the samba >>>> groups >>>>>>>> >>>>>>>> > that >>>>>>>> >>>>> you >>>>>>>> >>>>>>>> > have >>>>>>>> >>>>>>>> > >> setup. >>>>>>>> >>>>>>>> > >> >>>>>>>> >>>>>>>> > >> If you don't have something similar to the above >>>> (which >>>>>>>> >> sounds >>>>>>>> >>>>>> like >>>>>>>> >>>>>>>> > it >>>>>>>> >>>>>>>> > is >>>>>>>> >>>>>>>> > >> the case), then something went wrong applying the >>>>>>>> >>>>>>>> > extensions. >>>>>>>> >>>> It >>>>>>>> >>>>>>>> > would >>>>>>>> >>>>>>>> > be >>>>>>>> >>>>>>>> > >> worth testing comparing a new user / group created >>>> post >>>>>>>> >> adding >>>>>>>> >>>>>> the >>>>>>>> >>>>>>>> > >> extensions to a previous existing user. >>>>>>>> >>>>>>>> > >> >>>>>>>> >>>>>>>> > >> i.e. >>>>>>>> >>>>>>>> > >> are the extensions missing on existing users / groups? >>>>>>>> >>>>>>>> > >> are the extensions missing on new users / groups? >>>>>>>> >>>>>>>> > >> >>>>>>>> >>>>>>>> > >> Cheers >>>>>>>> >>>>>>>> > >> >>>>>>>> >>>>>>>> > >> Chris >>>>>>>> >>>>>>>> > >> >>>>>>>> >>>>>>>> > >> >>>>>>>> >>>>>>>> > >> >>>>>>>> >>>>>>>> > >> >>>>>>>> >>>>>>>> > >> >>>>>>>> >>>>>>>> > >> From: Youenn PIOLET <[email protected]> >>>>>>>> >>>>>>>> > >> To: "Matt ." <[email protected]> >>>>>>>> >>>>>>>> > >> Cc: Christopher Lamb/Switzerland/IBM@IBMCH, >>>>>>>> >>>>>>>> > >> "[email protected]" >>>>>>>> >>>>> <[email protected]> >>>>>>>> >>>>>>>> > >> Date: 04.08.2015 18:56 >>>>>>>> >>>>>>>> > >> Subject: Re: [Freeipa-users] Ubuntu Samba >>>> Server >>>>>>>> >>>>>>>> > Auth >>>>>>>> >>>>>>>> > against >>>>>>>> >>>>>>>> > IPA >>>>>>>> >>>>>>>> > >> >>>>>>>> >>>>>>>> > >> >>>>>>>> >>>>>>>> > >> >>>>>>>> >>>>>>>> > >> Hi there, >>>>>>>> >>>>>>>> > >> >>>>>>>> >>>>>>>> > >> I have difficulties to follow you at this point :) >>>>>>>> >>>>>>>> > >> Here is what I've done and what I've understood: >>>>>>>> >>>>>>>> > >> >>>>>>>> >>>>>>>> > >> ## SMB Side >>>>>>>> >>>>>>>> > >> - Testparm OK >>>>>>>> >>>>>>>> > >> - I've got the same NT_STATUS_NO_SUCH_USER when I try >>>> to >>>>>>>> >>>>> connect. >>>>>>>> >>>>>>>> > >> - pdbedit -Lv output is all successfull but I can see >>>>>>>> >>>>>>>> > there >>>>>>>> >> is >>>>>>>> >>>> a >>>>>>>> >>>>>>>> > filter : >>>>>>>> >>>>>>>> > >> (&(uid=*)(objectclass=sambaSamAccount). In LDAP, the >>>> users >>>>>>>> >>>> don't >>>>>>>> >>>>>>>> > have >>>>>>>> >>>>>>>> > >> sambaSamAccount. >>>>>>>> >>>>>>>> > >> >>>>>>>> >>>>>>>> > >> ## LDAP / FreeIPA side >>>>>>>> >>>>>>>> > >> - Since SMB server uses LDAP, I did >>>> ipa-adtrust-install on >>>>>>>> >>>>>>>> > my >>>>>>>> >>>>>>>> > FreeIPA >>>>>>>> >>>>>>>> > >> server to get samba LDAP extensions. >>>>>>>> >>>>>>>> > >> - I can see samba classes exist in LDAP but are not >>>> used >>>>>>>> >>>>>>>> > on >>>>>>>> >> my >>>>>>>> >>>>>>>> > group >>>>>>>> >>>>>>>> > >> objects nor my user objects >>>>>>>> >>>>>>>> > >> - I have add sambaSamAccount in FreeIPA default user >>>>>>>> >>>>>>>> > classes, >>>>>>>> >>>>>>>> > >> and sambaGroupMapping to default group classes. In >>>> that >>>>>>>> >>>>>>>> > state >>>>>>>> >>> I >>>>>>>> >>>>>>>> > can't >>>>>>>> >>>>>>>> > >> create user nor groups anymore, as new samba >>>> attributes >>>>>>>> >>>>>>>> > are >>>>>>>> >>>>>> needed >>>>>>>> >>>>>>>> > for >>>>>>>> >>>>>>>> > >> instantiation. >>>>>>>> >>>>>>>> > >> - I have add in etc ipaCustomFields: 'Samba Group >>>>>>>> >>>>>>>> > > Type,sambagrouptype,true' >>>>>>>> >>>>>>>> > >> but I don't get what it does. >>>>>>>> >>>>>>>> > >> - I tried to add the samba.js plugin. It works, and >>>> adds >>>>>>>> >>>>>>>> > the >>>>>>>> >>>>>>>> > "local" >>>>>>>> >>>>>>>> > > option >>>>>>>> >>>>>>>> > >> when creating a group in FreeIPA, supposed to set >>>>>>>> >>>> sambagrouptype >>>>>>>> >>>>>> to >>>>>>>> >>>>>>>> > 4 >>>>>>>> >>>>>>>> > or >>>>>>>> >>>>>>>> > > 2 >>>>>>>> >>>>>>>> > >> (domain). It doesn't work and tells that >>>> sambagrouptype >>>>>>>> >>>>> attribute >>>>>>>> >>>>>>>> > doesn't >>>>>>>> >>>>>>>> > >> exist (but it should now I put sambaGroupType class by >>>>>>>> >>>>>> default...) >>>>>>>> >>>>>>>> > >> >>>>>>>> >>>>>>>> > >> ## Questions >>>>>>>> >>>>>>>> > >> 0) Can I ask samba not to search sambaSamAccount and >>>> use >>>>>>>> >>> unix / >>>>>>>> >>>>>>>> > posix >>>>>>>> >>>>>>>> > >> instead? I guess no. >>>>>>>> >>>>>>>> > >> 1) How to generate the user/group SIDs ? They are >>>>>>>> >>>>>>>> > requested >>>>>>>> >> to >>>>>>>> >>>>>> add >>>>>>>> >>>>>>>> > >> sambaSamAccount classes. >>>>>>>> >>>>>>>> > >> This article doesn't seem relevant since we don't use >>>>>>>> >>>>>>>> > domain >>>>>>>> >>>>>>>> > controller >>>>>>>> >>>>>>>> > >> >>>>>>>> >>>>>>>> > > >>>>>>>> >>>>>>>> > >>>>>>>> >>>>>>>> > >>>>>>>> >>>>>> >>>>>>>> >>>>> >>>>>>>> >>>> >>>>>>>> >>> >>>>>>>> >> >>>>>>>> >> >>>> http://docs.fedoraproject.org/en-US/Fedora/17/html/FreeIPA_Guide/cifs.html >>>>>>>> >>>>>>>> > >>>>>>>> >>>>>>>> > >> and netgetlocalsid returns an error. >>>>>>>> >>>>>>>> > >> 2) How to fix samba.js plugin? >>>>>>>> >>>>>>>> > >> 3) I guess an equivalent of samba.js is needed for >>>> user >>>>>>>> >>>>> creation, >>>>>>>> >>>>>>>> > where >>>>>>>> >>>>>>>> > > can >>>>>>>> >>>>>>>> > >> I find it? >>>>>>>> >>>>>>>> > >> 4) Is your setup working with Windows 8 / Windows 10 >>>> and >>>>>>>> >>>>>>>> > not >>>>>>>> >>>>> only >>>>>>>> >>>>>>>> > Windows >>>>>>>> >>>>>>>> > >> 7? >>>>>>>> >>>>>>>> > >> >>>>>>>> >>>>>>>> > >> Thanks a lot for your previous and future answers >>>>>>>> >>>>>>>> > >> >>>>>>>> >>>>>>>> > >> -- >>>>>>>> >>>>>>>> > >> Youenn Piolet >>>>>>>> >>>>>>>> > >> [email protected] >>>>>>>> >>>>>>>> > >> >>>>>>>> >>>>>>>> > >> >>>>>>>> >>>>>>>> > >> 2015-08-04 17:55 GMT+02:00 Matt . >>>>>>>> >>>>>>>> > <[email protected]>: >>>>>>>> >>>>>>>> > >> Hi, >>>>>>>> >>>>>>>> > >> >>>>>>>> >>>>>>>> > >> Yes, log is anonymised. >>>>>>>> >>>>>>>> > >> >>>>>>>> >>>>>>>> > >> It's strange, my user doesn't have a >>>> SambaPwdLastSet, >>>>>>>> >>>>>>>> > also >>>>>>>> >>>>> when >>>>>>>> >>>>>> I >>>>>>>> >>>>>>>> > >> change it's password it doesn't get it in ldap. >>>>>>>> >>>>>>>> > >> >>>>>>>> >>>>>>>> > >> There must be something going wrong I guess. >>>>>>>> >>>>>>>> > >> >>>>>>>> >>>>>>>> > >> Matt >>>>>>>> >>>>>>>> > >> >>>>>>>> >>>>>>>> > >> 2015-08-04 17:45 GMT+02:00 Christopher Lamb >>>>>>>> >>>>>>>> > > <[email protected] >>>>>>>> >>>>>>>> > >> >: >>>>>>>> >>>>>>>> > >> > Hi Matt >>>>>>>> >>>>>>>> > >> > >>>>>>>> >>>>>>>> > >> > I assume [username] is a real username, identical >>>> to >>>>>>>> >>>>>>>> > that >>>>>>>> >>>> in >>>>>>>> >>>>>>>> > the >>>>>>>> >>>>>>>> > >> FreeIPA >>>>>>>> >>>>>>>> > >> > cn=accounts, cn=users tree? (i.e. you anonymised >>>> the >>>>>>>> >>>>>>>> > log >>>>>>>> >>>>>>>> > extract). >>>>>>>> >>>>>>>> > >> > >>>>>>>> >>>>>>>> > >> > You user should be a member of the appropriate >>>> samba >>>>>>>> >>> groups >>>>>>>> >>>>>>>> > that >>>>>>>> >>>>>>>> > you >>>>>>>> >>>>>>>> > >> setup >>>>>>>> >>>>>>>> > >> > in FreeIPA. >>>>>>>> >>>>>>>> > >> > >>>>>>>> >>>>>>>> > >> > You should check that the user attribute >>>>>>>> >>>>>>>> > SambaPwdLastSet >>>>>>>> >>> is >>>>>>>> >>>>>> set >>>>>>>> >>>>>>>> > to >>>>>>>> >>>>>>>> > a >>>>>>>> >>>>>>>> > >> > positive value (e.g. 1). If not you get an error >>>> in >>>>>>>> >>>>>>>> > the >>>>>>>> >>>>> Samba >>>>>>>> >>>>>>>> > logs >>>>>>>> >>>>>>>> > - >>>>>>>> >>>>>>>> > > I >>>>>>>> >>>>>>>> > >> > would need to play around again with a test user >>>> to >>>>>>>> >>>>>>>> > find >>>>>>>> >>>> out >>>>>>>> >>>>>>>> > the >>>>>>>> >>>>>>>> > > exact >>>>>>>> >>>>>>>> > >> > error. >>>>>>>> >>>>>>>> > >> > >>>>>>>> >>>>>>>> > >> > I don't understand what you mean about syncing the >>>>>>>> >>>>>>>> > users >>>>>>>> >>>>>> local, >>>>>>>> >>>>>>>> > but >>>>>>>> >>>>>>>> > > we >>>>>>>> >>>>>>>> > >> did >>>>>>>> >>>>>>>> > >> > not need to do anything like that. >>>>>>>> >>>>>>>> > >> > >>>>>>>> >>>>>>>> > >> > Chris >>>>>>>> >>>>>>>> > >> > >>>>>>>> >>>>>>>> > >> > >>>>>>>> >>>>>>>> > >> > >>>>>>>> >>>>>>>> > >> > >>>>>>>> >>>>>>>> > >> > From: "Matt ." <[email protected]> >>>>>>>> >>>>>>>> > >> > To: Christopher Lamb/Switzerland/IBM@IBMCH >>>>>>>> >>>>>>>> > >> > Cc: "[email protected]" >>>>>>>> >>>>> <[email protected]> >>>>>>>> >>>>>>>> > >> > Date: 04.08.2015 15:33 >>>>>>>> >>>>>>>> > >> > Subject: Re: [Freeipa-users] Ubuntu Samba >>>>>>>> >>>>>>>> > Server >>>>>>>> >>>> Auth >>>>>>>> >>>>>>>> > against >>>>>>>> >>>>>>>> > >> IPA >>>>>>>> >>>>>>>> > >> > >>>>>>>> >>>>>>>> > >> > >>>>>>>> >>>>>>>> > >> > >>>>>>>> >>>>>>>> > >> > Hi Chris, >>>>>>>> >>>>>>>> > >> > >>>>>>>> >>>>>>>> > >> > A puppet run added another passdb backend, that >>>> was >>>>>>>> >>> causing >>>>>>>> >>>>>> my >>>>>>>> >>>>>>>> > issue. >>>>>>>> >>>>>>>> > >> > >>>>>>>> >>>>>>>> > >> > What I still experience is: >>>>>>>> >>>>>>>> > >> > >>>>>>>> >>>>>>>> > >> > >>>>>>>> >>>>>>>> > >> > [2015/08/04 15:29:45.477783, 3] >>>>>>>> >>>>>>>> > >> > ../source3/auth/check_samsec.c:399 >>>> (check_sam_security) >>>>>>>> >>>>>>>> > >> > check_sam_security: Couldn't find user >>>> 'username' in >>>>>>>> >>>>>> passdb. >>>>>>>> >>>>>>>> > >> > [2015/08/04 15:29:45.478026, 2] >>>>>>>> >>>>>>>> > >> > ../source3/auth/auth.c:288 >>>> (auth_check_ntlm_password) >>>>>>>> >>>>>>>> > >> > check_ntlm_password: Authentication for user >>>>>>>> >> [username] >>>>>>>> >>>>> -> >>>>>>>> >>>>>>>> > >> > [username] FAILED with error >>>> NT_STATUS_NO_SUCH_USER >>>>>>>> >>>>>>>> > >> > >>>>>>>> >>>>>>>> > >> > >>>>>>>> >>>>>>>> > >> > I also wonder if I shall still sync the users >>>> local, >>>>>>>> >>>>>>>> > or >>>>>>>> >> is >>>>>>>> >>>>> it >>>>>>>> >>>>>>>> > > needed ? >>>>>>>> >>>>>>>> > >> > >>>>>>>> >>>>>>>> > >> > Thanks again, >>>>>>>> >>>>>>>> > >> > >>>>>>>> >>>>>>>> > >> > Matt >>>>>>>> >>>>>>>> > >> > >>>>>>>> >>>>>>>> > >> > 2015-08-04 14:16 GMT+02:00 Christopher Lamb < >>>>>>>> >>>>>>>> > >> [email protected]>: >>>>>>>> >>>>>>>> > >> >> Hi Matt >>>>>>>> >>>>>>>> > >> >> >>>>>>>> >>>>>>>> > >> >> From our smb.conf file: >>>>>>>> >>>>>>>> > >> >> >>>>>>>> >>>>>>>> > >> >> [global] >>>>>>>> >>>>>>>> > >> >> security = user >>>>>>>> >>>>>>>> > >> >> passdb backend = >>>>>>>> >>>>>>>> > ldapsam:ldap://xxx-ldap2.my.silly.example.com >>>>>>>> >>>>>>>> > >> >> ldap suffix = dc=my,dc=silly,dc=example,dc=com >>>>>>>> >>>>>>>> > >> >> ldap admin dn = cn=Directory Manager >>>>>>>> >>>>>>>> > >> >> >>>>>>>> >>>>>>>> > >> >> So yes, we use Directory Manager, it works for >>>> us. I >>>>>>>> >> have >>>>>>>> >>>>>> not >>>>>>>> >>>>>>>> > tried >>>>>>>> >>>>>>>> > >> with >>>>>>>> >>>>>>>> > >> > a >>>>>>>> >>>>>>>> > >> >> less powerful user, but it is conceivable that a >>>>>>>> >>>>>>>> > lesser >>>>>>>> >>>>> user >>>>>>>> >>>>>>>> > may >>>>>>>> >>>>>>>> > not >>>>>>>> >>>>>>>> > >> see >>>>>>>> >>>>>>>> > >> >> all the required attributes, resulting in "no >>>> such >>>>>>>> >>>>>>>> > user" >>>>>>>> >>>>>>>> > errors. >>>>>>>> >>>>>>>> > >> >> >>>>>>>> >>>>>>>> > >> >> Chris >>>>>>>> >>>>>>>> > >> >> >>>>>>>> >>>>>>>> > >> >> >>>>>>>> >>>>>>>> > >> >> >>>>>>>> >>>>>>>> > >> >> >>>>>>>> >>>>>>>> > >> >> From: "Matt ." <[email protected]> >>>>>>>> >>>>>>>> > >> >> To: Christopher Lamb/Switzerland/IBM@IBMCH >>>>>>>> >>>>>>>> > >> >> Cc: "[email protected]" >>>>>>>> >>>>>> <[email protected]> >>>>>>>> >>>>>>>> > >> >> Date: 04.08.2015 13:32 >>>>>>>> >>>>>>>> > >> >> Subject: Re: [Freeipa-users] Ubuntu Samba >>>>>>>> >>>>>>>> > Server >>>>>>>> >>>>> Auth >>>>>>>> >>>>>>>> > against >>>>>>>> >>>>>>>> > >> IPA >>>>>>>> >>>>>>>> > >> >> >>>>>>>> >>>>>>>> > >> >> >>>>>>>> >>>>>>>> > >> >> >>>>>>>> >>>>>>>> > >> >> Hi Chris, >>>>>>>> >>>>>>>> > >> >> >>>>>>>> >>>>>>>> > >> >> Thanks for the heads up, indeed local is 4 I see >>>> now >>>>>>>> >> when >>>>>>>> >>>> I >>>>>>>> >>>>>>>> > add a >>>>>>>> >>>>>>>> > >> >> group from the GUI, great thanks! >>>>>>>> >>>>>>>> > >> >> >>>>>>>> >>>>>>>> > >> >> But do you use Directory Manager as ldap admin >>>> user >>>>>>>> >>>>>>>> > or >>>>>>>> >>>> some >>>>>>>> >>>>>>>> > other >>>>>>>> >>>>>>>> > >> >> admin account ? >>>>>>>> >>>>>>>> > >> >> >>>>>>>> >>>>>>>> > >> >> I'm not sure id DM is needed and it should get >>>> that >>>>>>>> >>>>>>>> > deep >>>>>>>> >>>>>> into >>>>>>>> >>>>>>>> > IPA. >>>>>>>> >>>>>>>> > >> >> Also when starting samba it cannot find "such >>>> user" >>>>>>>> >>>>>>>> > as >>>>>>>> >>>> that >>>>>>>> >>>>>>>> > sounds >>>>>>>> >>>>>>>> > >> >> quite known as it has no UID. >>>>>>>> >>>>>>>> > >> >> >>>>>>>> >>>>>>>> > >> >> From your config I see you use DM, this should >>>> work ? >>>>>>>> >>>>>>>> > >> >> >>>>>>>> >>>>>>>> > >> >> Thanks! >>>>>>>> >>>>>>>> > >> >> >>>>>>>> >>>>>>>> > >> >> >>>>>>>> >>>>>>>> > >> >> Matt >>>>>>>> >>>>>>>> > >> >> >>>>>>>> >>>>>>>> > >> >> >>>>>>>> >>>>>>>> > >> > >>>>>>>> >>>>>>>> > >> > >>>>>>>> >>>>>>>> > >> > >>>>>>>> >>>>>>>> > >> > >>>>>>>> >>>>>>>> > >> >>>>>>>> >>>>>>>> > >> -- >>>>>>>> >>>>>>>> > >> Manage your subscription for the Freeipa-users >>>> mailing >>>>>>>> >> list: >>>>>>>> >>>>>>>> > >> >>>> https://www.redhat.com/mailman/listinfo/freeipa-users >>>>>>>> >>>>>>>> > >> Go to http://freeipa.org for more info on the >>>> project >>>>>>>> >>>>>>>> > >> >>>>>>>> >>>>>>>> > >> >>>>>>>> >>>>>>>> > >> >>>>>>>> >>>>>>>> > > >>>>>>>> >>>>>>>> > > >>>>>>>> >>>>>>>> > > >>>>>>>> >>>>>>>> > > >>>>>>>> >>>>>>>> > > -- >>>>>>>> >>>>>>>> > > Manage your subscription for the Freeipa-users mailing >>>>>>>> >>>>>>>> > list: >>>>>>>> >>>>>>>> > > https://www.redhat.com/mailman/listinfo/freeipa-users >>>>>>>> >>>>>>>> > > Go to http://freeipa.org for more info on the project >>>>>>>> >>>>>>>> > > >>>>>>>> >>>>>>>> > > >>>>>>>> >>>>>>>> > > >>>>>>>> >>>>>>>> > > >>>>>>>> >>>>>>>> > >>>>>>>> >>>>>>>> > -- >>>>>>>> >>>>>>>> > Manage your subscription for the Freeipa-users mailing >>>> list: >>>>>>>> >>>>>>>> > https://www.redhat.com/mailman/listinfo/freeipa-users >>>>>>>> >>>>>>>> > Go to http://freeipa.org for more info on the project >>>>>>>> >>>>>>>> > >>>>>>>> >>>>>>>> > >>>>>>>> >>>>>>>> > >>>>>>>> >>>>>>> >>>>>>>> >>>>>>> >>>>>>>> >>>>>> >>>>>>>> >>>>>> >>>>>>>> >>>>>> >>>>>>>> >>>>>> >>>>>>>> >>>>> >>>>>>>> >>>>> >>>>>>>> >>>>> >>>>>>>> >>>>> >>>>>>>> >>>> >>>>>>>> >>>> >>>>>>>> >>>> >>>>>>>> >>>> >>>>>>>> >>> >>>>>>>> >>> >>>>>>>> >>> >>>>>>>> >>> >>>>>>>> >> >>>>>>>> >> >>>>>>>> >> >>>>>>>> >> >>>>>>> >>>>>>> >>>> >>>> >>>> >>>> -- Manage your subscription for the Freeipa-users mailing list: https://www.redhat.com/mailman/listinfo/freeipa-users Go to http://freeipa.org for more info on the project
