Hi, OK, this sounds already quite logical, but I'm still refering to the old howto we found earlier, does that one still apply somewhere or not at all ?
Thanks, Matt 2015-08-06 12:23 GMT+02:00 Youenn PIOLET <piole...@gmail.com>: > Hey guys, > > I'll try to make a tutorial soon, sorry I'm quite in a rush these days :) > > General idea: > > On FreeIPA (4.1) > - `ipa-adtrust-install --add-sids` (creates ipaNTsecurityidentifier > attribude, also known as SID) > - regenerate each user password to build ipaNTHash attribute, not here by > default on users > - use your ldap browser to check ipaNTHash values are here on user objects > - create a CIFS service for your samba server > - Create user roles/permissions as described here: > http://freeipa-users.redhat.narkive.com/ez2uKpFS/authenticate-samba-3-or-4-with-freeipa > so that CIFS service will be able to read ipaNTsecurityidentifier and > ipaNTHash attributes in LDAP (ACI) > - SCP ipasam.so module to your cifs server (this is the magic trick) : scp > /usr/lib64/samba/pdb/ipasam.so > root@samba-server.domain:/usr/lib64/samba/pdb/ You can also try to recompile > it. > > On SAMBA Server side (CentOS 7...) > - Install server keytab file for CIFS > - check ipasam.so is here. > - check you can read password hash in LDAP with `ldapsearch -Y GSSAPI > uid=admin ipaNTHash` thanks to kerberos > - make your smb.conf following the linked thread and restart service > > I don't know if it works in Ubuntu. I know sssd has evolved quickly and > ipasam may use quite recent functionalities, the best is to just try. You > can read in previous thread : "If you insist on Ubuntu you need to get > ipasam somewhere, most likely to compile it yourself". > > Make sure your user has ipaNTHash attribute :) > > You may want to debug authentication on samba server, I usually do this: > `tail -f /var/log/samba/log* | grep <username> > > Cheers > -- > Youenn Piolet > piole...@gmail.com > > > 2015-08-05 17:40 GMT+02:00 Matt . <yamakasi....@gmail.com>: >> >> Hi, >> >> This sounds great to me too, but a howto would help to make it more >> clear about what you have done here. The thread confuses me a little >> bit. >> >> Can you paste your commands so we can test out too and report back ? >> >> Thanks! >> >> Matt >> >> 2015-08-05 15:18 GMT+02:00 Christopher Lamb <christopher.l...@ch.ibm.com>: >> > Hi Youenn >> > >> > Good news that you have got an integration working >> > >> > Now you have got it going, and the solution is fresh in your mind, how >> > about adding a How-to page on this solution to the FreeIPA wiki? >> > >> > Chris >> > >> > >> > >> > From: Youenn PIOLET <piole...@gmail.com> >> > To: "Matt ." <yamakasi....@gmail.com> >> > Cc: Christopher Lamb/Switzerland/IBM@IBMCH, >> > "freeipa-users@redhat.com" <freeipa-users@redhat.com> >> > Date: 05.08.2015 14:51 >> > Subject: Re: [Freeipa-users] Ubuntu Samba Server Auth against IPA >> > >> > >> > >> > Hi guys, >> > >> > Thank you so much your previous answers. >> > I realised my SID were stored in ipaNTsecurityidentifier, thanks to >> > ipa-adtrust-install --add-sids >> > >> > I found an other way to configure smb here: >> > >> > http://freeipa-users.redhat.narkive.com/ez2uKpFS/authenticate-samba-3-or-4-with-freeipa >> > It works perfectly. >> > >> > I'm using module ipasam.so I have manually scp to the samba server, >> > Samba is set to use kerberos + ldapsam via this ipasam module. >> > Following the instructions, I created a user role allowing service >> > principal to read ipaNTHash value from the LDAP. >> > ipaNTHash are generated each time a user changes his password. >> > Authentication works perfectly on Windows 7, 8 and 10. >> > >> > For more details, the previously linked thread is quite clear. >> > >> > Cheers >> > >> > -- >> > Youenn Piolet >> > piole...@gmail.com >> > >> > >> > 2015-08-05 11:10 GMT+02:00 Matt . <yamakasi....@gmail.com>: >> > Hi Chris. >> > >> > Yes, Apache Studio did that but I was not sure why it complained it >> > was "already" there. >> > >> > I'm still getting: >> > >> > IPA Error 4205: ObjectclassViolation >> > >> > missing attribute "sambaGroupType" required by object class >> > "sambaGroupMapping" >> > >> > When adding a user. >> > >> > I also see "class" as fielname under my "Last name", this is not OK >> > also. >> > >> > >> > >> > We sure need to make some howto, I think we can nail this down :) >> > >> > Thanks for the heads up! >> > >> > Matthijs >> > >> > 2015-08-05 7:51 GMT+02:00 Christopher Lamb >> > <christopher.l...@ch.ibm.com>: >> > > Hi Matt >> > > >> > > If I use Apache Directory Studio to add an attribute ipaCustomFields >> > to >> > > cn=ipaConfig,cn=etc, the operation it performs is a modify, as shown >> > below: >> > > >> > > #!RESULT OK >> > > #!CONNECTION ldap://xxx-ldap2.my.silly.example.com:yyy >> > > #!DATE 2015-08-05T05:45:04.608 >> > > dn: cn=ipaConfig,cn=etc,dc=my,dc=silly,dc=example,dc=com >> > > changetype: modify >> > > add: ipaCustomFields >> > > ipaCustomFields: Samba Group Type,sambagrouptype,true >> > > >> > > After that I then have a visible attribute ipaCustomFields as >> > expected. >> > > >> > > When adding the attribute, the wizard offered me "ipaCustomFields" >> > as >> > > attribute type in a drop down list. >> > > >> > > Once we get this cracked, we really must write a how-to on the >> > FreeIPA >> > > Wiki. >> > > >> > > Chris >> > > >> > > >> > > >> > > From: Christopher Lamb/Switzerland/IBM@IBMCH >> > > To: "Matt ." <yamakasi....@gmail.com> >> > > Cc: "freeipa-users@redhat.com" <freeipa-users@redhat.com> >> > > Date: 05.08.2015 07:31 >> > > Subject: Re: [Freeipa-users] Ubuntu Samba Server Auth against >> > IPA >> > > Sent by: freeipa-users-boun...@redhat.com >> > > >> > > >> > > >> > > Hi Matt >> > > >> > > I also got the same result at that step, but can see nothing in >> > Apache >> > > Directory Studio. >> > > >> > > As I am using existing Samba / FreeIPA groups migrated across, they >> > > probably were migrated with all the required attributes. >> > > >> > > Looking more closely at that LDIF: I wonder should it not be: >> > > >> > > ldapmodify -Y GSSAPI <<EOF >> > > dn: cn=ipaconfig,cn=etc,dc=domain,dc=tld >> > > changetype: modify >> > > add: ipaCustomFields >> > > ipaCustomFields: "Samba Group Type,sambagrouptype,true" >> > > EOF >> > > >> > > i.e. changetype: modify, instead of changetype add ? >> > > >> > > I don't want to play around with my prod directory - I will setup an >> > EL >> > 7.1 >> > > VM and install FreeIPA 4.x and Samba 4.x That will allow me to play >> > around >> > > more destructively. >> > > >> > > Chris >> > > >> > > >> > > >> > > >> > > >> > > From: "Matt ." <yamakasi....@gmail.com> >> > > To: Christopher Lamb/Switzerland/IBM@IBMCH >> > > Cc: Youenn PIOLET <piole...@gmail.com>, " >> > freeipa-users@redhat.com" >> > > <freeipa-users@redhat.com> >> > > Date: 05.08.2015 01:01 >> > > Subject: Re: [Freeipa-users] Ubuntu Samba Server >> > Auth >> > against IPA >> > > >> > > >> > > >> > > Hi Chris, >> > > >> > > I'm at the right path, but my issue is that: >> > > >> > > ldapmodify -Y GSSAPI <<EOF >> > > dn: cn=ipaconfig,cn=etc,dc=domain,dc=tld >> > > changetype: add >> > > add: ipaCustomFields >> > > ipaCustomFields: "Samba Group Type,sambagrouptype,true" >> > > EOF >> > > >> > > Does say it exists, my ldap explorer doesn't show it, and when I add >> > > it manually as an attribute it still fails when I add a user on this >> > > sambagrouptype as it's needed by the other attributes >> > > >> > > So that is my issue I think so far. >> > > >> > > Any clue about that ? >> > > >> > > No problem "you don't know something or are no guru" we are all >> > > learning! :) >> > > >> > > Cheers, >> > > >> > > Matt >> > > >> > > >> > > 2015-08-04 21:22 GMT+02:00 Christopher Lamb < >> > christopher.l...@ch.ibm.com>: >> > >> Hi Matt, Youeen >> > >> >> > >> Just to set the background properly, I did not invent this process. >> > I >> > > know >> > >> only a little about FreeIPA, and almost nothing about Samba, but I >> > guess >> > > I >> > >> was lucky enough to get the integration working on a Sunday >> > afternoon. >> > (I >> > >> did have an older FreeIPA 3.x / Samba 3.x installation as a >> > reference). >> > >> >> > >> It sounds like we need to step back, and look at the test user and >> > group >> > > in >> > >> the FreeIPA LDAP tree. I find using an LDAP browser makes this much >> > > easier. >> > >> >> > >> My FreeIPA / Samba Users have the following Samba extensions in >> > FreeIPA >> > >> (cn=accounts, cn=users): >> > >> >> > >> * objectClass: sambasamaccount >> > >> >> > >> * Attributes: sambaSID, sambaNTPassword, sambaPwdLastSet >> > >> >> > >> My FreeIPA / Samba Groups have the following Samba extensions in >> > FreeIPA >> > >> (cn=accounts, cn=groups): >> > >> >> > >> * objectClass: sambaGroupMapping >> > >> >> > >> * Attributes: sambaGroupType, sambaSID >> > >> >> > >> The Users must belong to one or more of the samba groups that you >> > have >> > >> setup. >> > >> >> > >> If you don't have something similar to the above (which sounds like >> > it >> > is >> > >> the case), then something went wrong applying the extensions. It >> > would >> > be >> > >> worth testing comparing a new user / group created post adding the >> > >> extensions to a previous existing user. >> > >> >> > >> i.e. >> > >> are the extensions missing on existing users / groups? >> > >> are the extensions missing on new users / groups? >> > >> >> > >> Cheers >> > >> >> > >> Chris >> > >> >> > >> >> > >> >> > >> >> > >> >> > >> From: Youenn PIOLET <piole...@gmail.com> >> > >> To: "Matt ." <yamakasi....@gmail.com> >> > >> Cc: Christopher Lamb/Switzerland/IBM@IBMCH, >> > >> "freeipa-users@redhat.com" <freeipa-users@redhat.com> >> > >> Date: 04.08.2015 18:56 >> > >> Subject: Re: [Freeipa-users] Ubuntu Samba Server Auth >> > against >> > IPA >> > >> >> > >> >> > >> >> > >> Hi there, >> > >> >> > >> I have difficulties to follow you at this point :) >> > >> Here is what I've done and what I've understood: >> > >> >> > >> ## SMB Side >> > >> - Testparm OK >> > >> - I've got the same NT_STATUS_NO_SUCH_USER when I try to connect. >> > >> - pdbedit -Lv output is all successfull but I can see there is a >> > filter : >> > >> (&(uid=*)(objectclass=sambaSamAccount). In LDAP, the users don't >> > have >> > >> sambaSamAccount. >> > >> >> > >> ## LDAP / FreeIPA side >> > >> - Since SMB server uses LDAP, I did ipa-adtrust-install on my >> > FreeIPA >> > >> server to get samba LDAP extensions. >> > >> - I can see samba classes exist in LDAP but are not used on my >> > group >> > >> objects nor my user objects >> > >> - I have add sambaSamAccount in FreeIPA default user classes, >> > >> and sambaGroupMapping to default group classes. In that state I >> > can't >> > >> create user nor groups anymore, as new samba attributes are needed >> > for >> > >> instantiation. >> > >> - I have add in etc ipaCustomFields: 'Samba Group >> > > Type,sambagrouptype,true' >> > >> but I don't get what it does. >> > >> - I tried to add the samba.js plugin. It works, and adds the >> > "local" >> > > option >> > >> when creating a group in FreeIPA, supposed to set sambagrouptype to >> > 4 >> > or >> > > 2 >> > >> (domain). It doesn't work and tells that sambagrouptype attribute >> > doesn't >> > >> exist (but it should now I put sambaGroupType class by default...) >> > >> >> > >> ## Questions >> > >> 0) Can I ask samba not to search sambaSamAccount and use unix / >> > posix >> > >> instead? I guess no. >> > >> 1) How to generate the user/group SIDs ? They are requested to add >> > >> sambaSamAccount classes. >> > >> This article doesn't seem relevant since we don't use domain >> > controller >> > >> >> > > >> > >> > http://docs.fedoraproject.org/en-US/Fedora/17/html/FreeIPA_Guide/cifs.html >> > >> > >> and netgetlocalsid returns an error. >> > >> 2) How to fix samba.js plugin? >> > >> 3) I guess an equivalent of samba.js is needed for user creation, >> > where >> > > can >> > >> I find it? >> > >> 4) Is your setup working with Windows 8 / Windows 10 and not only >> > Windows >> > >> 7? >> > >> >> > >> Thanks a lot for your previous and future answers >> > >> >> > >> -- >> > >> Youenn Piolet >> > >> piole...@gmail.com >> > >> >> > >> >> > >> 2015-08-04 17:55 GMT+02:00 Matt . <yamakasi....@gmail.com>: >> > >> Hi, >> > >> >> > >> Yes, log is anonymised. >> > >> >> > >> It's strange, my user doesn't have a SambaPwdLastSet, also when I >> > >> change it's password it doesn't get it in ldap. >> > >> >> > >> There must be something going wrong I guess. >> > >> >> > >> Matt >> > >> >> > >> 2015-08-04 17:45 GMT+02:00 Christopher Lamb >> > > <christopher.l...@ch.ibm.com >> > >> >: >> > >> > Hi Matt >> > >> > >> > >> > I assume [username] is a real username, identical to that in >> > the >> > >> FreeIPA >> > >> > cn=accounts, cn=users tree? (i.e. you anonymised the log >> > extract). >> > >> > >> > >> > You user should be a member of the appropriate samba groups >> > that >> > you >> > >> setup >> > >> > in FreeIPA. >> > >> > >> > >> > You should check that the user attribute SambaPwdLastSet is set >> > to >> > a >> > >> > positive value (e.g. 1). If not you get an error in the Samba >> > logs >> > - >> > > I >> > >> > would need to play around again with a test user to find out >> > the >> > > exact >> > >> > error. >> > >> > >> > >> > I don't understand what you mean about syncing the users local, >> > but >> > > we >> > >> did >> > >> > not need to do anything like that. >> > >> > >> > >> > Chris >> > >> > >> > >> > >> > >> > >> > >> > >> > >> > From: "Matt ." <yamakasi....@gmail.com> >> > >> > To: Christopher Lamb/Switzerland/IBM@IBMCH >> > >> > Cc: "freeipa-users@redhat.com" <freeipa-users@redhat.com> >> > >> > Date: 04.08.2015 15:33 >> > >> > Subject: Re: [Freeipa-users] Ubuntu Samba Server Auth >> > against >> > >> IPA >> > >> > >> > >> > >> > >> > >> > >> > Hi Chris, >> > >> > >> > >> > A puppet run added another passdb backend, that was causing my >> > issue. >> > >> > >> > >> > What I still experience is: >> > >> > >> > >> > >> > >> > [2015/08/04 15:29:45.477783, 3] >> > >> > ../source3/auth/check_samsec.c:399(check_sam_security) >> > >> > check_sam_security: Couldn't find user 'username' in passdb. >> > >> > [2015/08/04 15:29:45.478026, 2] >> > >> > ../source3/auth/auth.c:288(auth_check_ntlm_password) >> > >> > check_ntlm_password: Authentication for user [username] -> >> > >> > [username] FAILED with error NT_STATUS_NO_SUCH_USER >> > >> > >> > >> > >> > >> > I also wonder if I shall still sync the users local, or is it >> > > needed ? >> > >> > >> > >> > Thanks again, >> > >> > >> > >> > Matt >> > >> > >> > >> > 2015-08-04 14:16 GMT+02:00 Christopher Lamb < >> > >> christopher.l...@ch.ibm.com>: >> > >> >> Hi Matt >> > >> >> >> > >> >> From our smb.conf file: >> > >> >> >> > >> >> [global] >> > >> >> security = user >> > >> >> passdb backend = >> > ldapsam:ldap://xxx-ldap2.my.silly.example.com >> > >> >> ldap suffix = dc=my,dc=silly,dc=example,dc=com >> > >> >> ldap admin dn = cn=Directory Manager >> > >> >> >> > >> >> So yes, we use Directory Manager, it works for us. I have not >> > tried >> > >> with >> > >> > a >> > >> >> less powerful user, but it is conceivable that a lesser user >> > may >> > not >> > >> see >> > >> >> all the required attributes, resulting in "no such user" >> > errors. >> > >> >> >> > >> >> Chris >> > >> >> >> > >> >> >> > >> >> >> > >> >> >> > >> >> From: "Matt ." <yamakasi....@gmail.com> >> > >> >> To: Christopher Lamb/Switzerland/IBM@IBMCH >> > >> >> Cc: "freeipa-users@redhat.com" <freeipa-users@redhat.com> >> > >> >> Date: 04.08.2015 13:32 >> > >> >> Subject: Re: [Freeipa-users] Ubuntu Samba Server Auth >> > against >> > >> IPA >> > >> >> >> > >> >> >> > >> >> >> > >> >> Hi Chris, >> > >> >> >> > >> >> Thanks for the heads up, indeed local is 4 I see now when I >> > add a >> > >> >> group from the GUI, great thanks! >> > >> >> >> > >> >> But do you use Directory Manager as ldap admin user or some >> > other >> > >> >> admin account ? >> > >> >> >> > >> >> I'm not sure id DM is needed and it should get that deep into >> > IPA. >> > >> >> Also when starting samba it cannot find "such user" as that >> > sounds >> > >> >> quite known as it has no UID. >> > >> >> >> > >> >> From your config I see you use DM, this should work ? >> > >> >> >> > >> >> Thanks! >> > >> >> >> > >> >> >> > >> >> Matt >> > >> >> >> > >> >> >> > >> > >> > >> > >> > >> > >> > >> > >> > >> >> > >> -- >> > >> Manage your subscription for the Freeipa-users mailing list: >> > >> https://www.redhat.com/mailman/listinfo/freeipa-users >> > >> Go to http://freeipa.org for more info on the project >> > >> >> > >> >> > >> >> > > >> > > >> > > >> > > >> > > -- >> > > Manage your subscription for the Freeipa-users mailing list: >> > > https://www.redhat.com/mailman/listinfo/freeipa-users >> > > Go to http://freeipa.org for more info on the project >> > > >> > > >> > > >> > > >> > >> > -- >> > Manage your subscription for the Freeipa-users mailing list: >> > https://www.redhat.com/mailman/listinfo/freeipa-users >> > Go to http://freeipa.org for more info on the project >> > >> > >> > > > -- Manage your subscription for the Freeipa-users mailing list: https://www.redhat.com/mailman/listinfo/freeipa-users Go to http://freeipa.org for more info on the project