Chris, How far are you on this ? I'm stuck atm :(
I hope you have some reference notes to follow and check out. Thanks! Matt 2015-08-20 22:15 GMT+02:00 Matt . <yamakasi....@gmail.com>: > Hi Chris, > > Would be great to see! > > If I have it working and we have 2-3 testcases I think we can add it > to the IPA docs! > > Keep me updated! > > Thanks > > Matt > > 2015-08-20 8:49 GMT+02:00 Christopher Lamb <christopher.l...@ch.ibm.com>: >> Matt >> >> Once I got Samba and FreeIPA integrated (by the "good old extensions" >> path), I always use FreeIPA to administer users. I have never tried the >> samba tools like smbpasswd. >> >> I still have a wiki how-to in the works, but I had to focus on some other >> issues for a while. >> >> Chris >> >> >> >> From: "Matt ." <yamakasi....@gmail.com> >> To: Youenn PIOLET <piole...@gmail.com> >> Cc: Christopher Lamb/Switzerland/IBM@IBMCH, >> "freeipa-users@redhat.com" <freeipa-users@redhat.com> >> Date: 20.08.2015 08:12 >> Subject: Re: [Freeipa-users] Ubuntu Samba Server Auth against IPA >> >> >> >> HI Guys, >> >> Anyone still a working clue/test here ? >> >> I didn't came further as it seems there need to be some domain join / >> match following the freeipa devs. >> >> Thanks! >> >> Matt >> >> 2015-08-13 13:09 GMT+02:00 Matt . <yamakasi....@gmail.com>: >>> Hi, >>> >>> I might have found somthing which I already seen in the logs. >>> >>> I did a smbpasswd my username on the samba server, it connects to ldap >>> very well. I give my new password and get the following: >>> >>> smbldap_search_ext: base => [dc=my,dc=domain], filter => >>> [(&(objectClass=ipaNTGroupAttrs)(| >> (ipaNTSecurityIdentifier=S-1----my--sid---)))], >>> scope => [2] >>> Attribute [displayName] not found. >>> Could not retrieve 'displayName' attribute from cn=Default SMB >>> Group,cn=groups,cn=accounts,dc=my,dc=domain >>> Sid S-1----my--sid--- -> MYDOMAIN\Default SMB Group(2) >>> >>> So something is missing! >>> >>> Thanks so far guys! >>> >>> Cheers, >>> >>> Matt >>> >>> 2015-08-13 12:02 GMT+02:00 Matt . <yamakasi....@gmail.com>: >>>> Hi Youenn, >>>> >>>> OK thanks! this takes me a little but futher now and I see some good >>>> stuff in my logging. >>>> >>>> I'm testing on a Windows 10 Machine which is not member of an AD or >>>> so, so that might be my issue for now ? >>>> >>>> When testing on the samba box itself as my user I get: >>>> >>>> >>>> [myusername@smb-01 ~]$ smbclient //smb-01.domain.local/shares >>>> >>>> ... >>>> Checking NTLMSSP password for MSP\myusername failed: >> NT_STATUS_WRONG_PASSWORD >>>> ... >>>> SPNEGO login failed: NT_STATUS_WRONG_PASSWORD >>>> >>>> >>>> Maybe I have an issue with encrypted passwords ? >>>> >>>> >>>> When we have this all working, I think we have a howto :D >>>> >>>> Thanks! >>>> >>>> Matt >>>> >>>> 2015-08-13 10:53 GMT+02:00 Youenn PIOLET <piole...@gmail.com>: >>>>> Hi Matt >>>>> >>>>> - CentOS : Did you copy ipasam.so and change your smb.conf accordingly? >>>>> sambaSamAccount is not needed anymore that way. >>>>> - Default IPA Way : won't work if your Windows is not part of a domain >>>>> controller. DOMAIN\username may work for some users using Windows 7 - >> not 8 >>>>> nor 10 (it did for me but I was the only one at the office... quite >> useless) >>>>> >>>>> This config may work on your CentOS (for the ipasam way): >>>>> workgroup = TEST >>>>> realm = TEST.NET >>>>> kerberos method = dedicated keytab >>>>> dedicated keytab file = FILE:/<.....>/samba.keytab >>>>> create krb5 conf = no >>>>> security = user >>>>> encrypt passwords = true >>>>> passdb backend = ipasam:ldaps://youripa.test.net >>>>> ldapsam:trusted = yes >>>>> ldapsuffix = test.net >>>>> ldap user suffix = cn=users,cn=accounts >>>>> ldap group suffix = cn=groups,cn=accounts >>>>> >>>>> >>>>> -- >>>>> Youenn Piolet >>>>> piole...@gmail.com >>>>> >>>>> >>>>> 2015-08-12 22:15 GMT+02:00 Matt . <yamakasi....@gmail.com>: >>>>>> >>>>>> Hi, >>>>>> >>>>>> OK the default IPA way works great actually when testing it as >> described >>>>>> here: >>>>>> >>>>>> >> http://www.freeipa.org/page/Howto/Integrating_a_Samba_File_Server_With_IPA >>>>>> >>>>>> On the samba server I can auth and see my share where I want to >> connect >>>>>> to. >>>>>> >>>>>> The issue is, on Windows I cannot auth, even when I do DOMAIN\username >>>>>> as username >>>>>> >>>>>> So, the IPA way should work. >>>>>> >>>>>> Any comments here ? >>>>>> >>>>>> Cheers, >>>>>> >>>>>> Matt >>>>>> >>>>>> 2015-08-12 19:00 GMT+02:00 Matt . <yamakasi....@gmail.com>: >>>>>> > HI GUys, >>>>>> > >>>>>> > I'm testing this out and I think I almost setup, this on a CentOS >> samba >>>>>> > server. >>>>>> > >>>>>> > I'm using the ipa-adtrust way of Youeen but it seems we still need >> to >>>>>> > add (objectclass=sambaSamAccount)) ? >>>>>> > >>>>>> > Info is welcome! >>>>>> > >>>>>> > I will report back when I have it working. >>>>>> > >>>>>> > Thanks! >>>>>> > >>>>>> > Matt >>>>>> > >>>>>> > 2015-08-10 11:16 GMT+02:00 Christopher Lamb >>>>>> > <christopher.l...@ch.ibm.com>: >>>>>> >> The next route I will try - is the one Youeen took, using >> ipa-adtrust >>>>>> >> >>>>>> >> >>>>>> >> >>>>>> >> From: "Matt ." <yamakasi....@gmail.com> >>>>>> >> To: Christopher Lamb/Switzerland/IBM@IBMCH, >>>>>> >> "freeipa-users@redhat.com" <freeipa-users@redhat.com> >>>>>> >> Date: 10.08.2015 10:03 >>>>>> >> Subject: Re: [Freeipa-users] Ubuntu Samba Server Auth >> against >>>>>> >> IPA >>>>>> >> >>>>>> >> >>>>>> >> >>>>>> >> Hi Chris, >>>>>> >> >>>>>> >> Okay this is good to hear. >>>>>> >> >>>>>> >> But don't we want a IPA managed Scheme ? >>>>>> >> >>>>>> >> When I did a "ipa-adtrust-install --add-sids" it also wanted a >> local >>>>>> >> installed Samba and I wonder why. >>>>>> >> >>>>>> >> Good that we make some progres on making it all clear. >>>>>> >> >>>>>> >> Cheers, >>>>>> >> >>>>>> >> Matt >>>>>> >> >>>>>> >> 2015-08-10 6:12 GMT+02:00 Christopher Lamb >>>>>> >> <christopher.l...@ch.ibm.com>: >>>>>> >>> ldapsam + the samba extensions, pretty much as described in the >>>>>> >> Techslaves >>>>>> >>> article. Once I have a draft for the wiki page, I will mail you. >>>>>> >>> >>>>>> >>> >>>>>> >>> >>>>>> >>> From: "Matt ." <yamakasi....@gmail.com> >>>>>> >>> To: Christopher Lamb/Switzerland/IBM@IBMCH, >>>>>> >>> "freeipa-users@redhat.com" <freeipa-users@redhat.com> >>>>>> >>> Date: 09.08.2015 21:17 >>>>>> >>> Subject: Re: [Freeipa-users] Ubuntu Samba Server Auth >> against >>>>>> >>> IPA >>>>>> >>> >>>>>> >>> >>>>>> >>> >>>>>> >>> Hi, >>>>>> >>> >>>>>> >>> Yes I know about "anything" but which way did you use now ? >>>>>> >>> >>>>>> >>> >>>>>> >>> >>>>>> >>> 2015-08-09 20:56 GMT+02:00 Christopher Lamb >>>>>> >> <christopher.l...@ch.ibm.com>: >>>>>> >>>> Hi Matt >>>>>> >>>> >>>>>> >>>> I am on OEL 7.1. - so anything that works on that should be good >> for >>>>>> >> RHEL >>>>>> >>>> and Centos 7.x >>>>>> >>>> >>>>>> >>>> I intend to add a how-to to the FreeIPA Wiki over the next few >> days. >>>>>> >>>> As >>>>>> >>> we >>>>>> >>>> have suggested earlier, we will likely end up with several, one >> for >>>>>> >>>> each >>>>>> >>> of >>>>>> >>>> the possible integration paths. >>>>>> >>>> >>>>>> >>>> Chris >>>>>> >>>> >>>>>> >>>> >>>>>> >>>> >>>>>> >>>> >>>>>> >>>> >>>>>> >>>> From: "Matt ." <yamakasi....@gmail.com> >>>>>> >>>> To: Christopher Lamb/Switzerland/IBM@IBMCH, >>>>>> >>>> "freeipa-users@redhat.com" <freeipa-users@redhat.com> >>>>>> >>>> Date: 09.08.2015 16:45 >>>>>> >>>> Subject: Re: [Freeipa-users] Ubuntu Samba Server Auth >> against >>>>>> >>>> IPA >>>>>> >>>> >>>>>> >>>> >>>>>> >>>> >>>>>> >>>> Hi Chris, >>>>>> >>>> >>>>>> >>>> This sounds great! >>>>>> >>>> >>>>>> >>>> What are you using now, both CentOS ? So Samba and FreeIPA ? >>>>>> >>>> >>>>>> >>>> Maybe it's good to explain which way you used now in steps too, >> so we >>>>>> >>>> can combine or create multiple howto's ? >>>>>> >>>> >>>>>> >>>> At least we are going somewhere! >>>>>> >>>> >>>>>> >>>> Thanks, >>>>>> >>>> >>>>>> >>>> Matt >>>>>> >>>> >>>>>> >>>> 2015-08-09 14:54 GMT+02:00 Christopher Lamb >>>>>> >>> <christopher.l...@ch.ibm.com>: >>>>>> >>>>> Hi Matt >>>>>> >>>>> >>>>>> >>>>> My test integration of FreeIPA 4.x and Samba 4.x with the "good >> old >>>>>> >>> Samba >>>>>> >>>>> Schema extensions) is up and working, almost flawlessly. >>>>>> >>>>> >>>>>> >>>>> I can add users and groups via the FreeIPA CLI, and they get the >>>>>> >> correct >>>>>> >>>>> ObjectClasses / attributes required for Samba. >>>>>> >>>>> >>>>>> >>>>> So far I have not yet bothered to try the extensions to the >> WebUI, >>>>>> >>>> because >>>>>> >>>>> it is currently giving me the classic "Your session has expired. >>>>>> >>>>> Please >>>>>> >>>>> re-login." error which renders the WebUI useless. >>>>>> >>>>> >>>>>> >>>>> The only problem I have so far encountered managing Samba / >> FreeIPA >>>>>> >>> users >>>>>> >>>>> via FreeIPA CLI commands is with the handling of the attribute >>>>>> >>>>> sambaPwdLastSet. This is the subject of an existing thread, also >>>>>> >> updated >>>>>> >>>>> today. >>>>>> >>>>> >>>>>> >>>>> There is also an existing alternative to hacking group.py, using >>>>>> >>>>> "Class >>>>>> >>>> of >>>>>> >>>>> Service" (Cos) documented in this thread from February 2015 >>>>>> >>>>> >>>>>> >>> >>>>>> >>> >> https://www.redhat.com/archives/freeipa-users/2015-February/msg00172.html >>>>>> >>>> . >>>>>> >>>>> I have not yet tried it, but it sounds reasonable. >>>>>> >>>>> >>>>>> >>>>> Chris >>>>>> >>>>> >>>>>> >>>>> >>>>>> >>>>> >>>>>> >>>>> >>>>>> >>>>> >>>>>> >>>>> From: "Matt ." <yamakasi....@gmail.com> >>>>>> >>>>> To: Christopher Lamb/Switzerland/IBM@IBMCH >>>>>> >>>>> Cc: "freeipa-users@redhat.com" <freeipa-users@redhat.com>, >>>>>> >>>>> Youenn >>>>>> >>>>> PIOLET <piole...@gmail.com> >>>>>> >>>>> Date: 06.08.2015 16:19 >>>>>> >>>>> Subject: Re: [Freeipa-users] Ubuntu Samba Server Auth >> against >>>>>> >> IPA >>>>>> >>>>> >>>>>> >>>>> >>>>>> >>>>> >>>>>> >>>>> Hi Chris, >>>>>> >>>>> >>>>>> >>>>> OK, than we might create two different versions of the wiki, I >> think >>>>>> >>>>> this is nice. >>>>>> >>>>> >>>>>> >>>>> I'm still figuring out why I get that: >>>>>> >>>>> >>>>>> >>>>> IPA Error 4205: ObjectclassViolation >>>>>> >>>>> >>>>>> >>>>> missing attribute "sambaGroupType" required by object class >>>>>> >>>>> "sambaGroupMapping" >>>>>> >>>>> >>>>>> >>>>> Matt >>>>>> >>>>> >>>>>> >>>>> 2015-08-06 16:09 GMT+02:00 Christopher Lamb >>>>>> >>>> <christopher.l...@ch.ibm.com>: >>>>>> >>>>>> Hi Matt >>>>>> >>>>>> >>>>>> >>>>>> As far as I can make out, there are at least 2 viable Samba / >>>>>> >>>>>> FreeIPA >>>>>> >>>>>> integration paths. >>>>>> >>>>>> >>>>>> >>>>>> The route I took is suited where there is no Active Directory >>>>>> >> involved: >>>>>> >>>>> In >>>>>> >>>>>> my case all the Windows, OSX and Linux clients are islands that >> sit >>>>>> >>>>>> on >>>>>> >>>>> the >>>>>> >>>>>> same network. >>>>>> >>>>>> >>>>>> >>>>>> The route that Youenn has taken (unless I have got completely >> the >>>>>> >> wrong >>>>>> >>>>> end >>>>>> >>>>>> of the stick) requires Active Directory in the architecture. >>>>>> >>>>>> >>>>>> >>>>>> Chris >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> From: "Matt ." <yamakasi....@gmail.com> >>>>>> >>>>>> To: Youenn PIOLET <piole...@gmail.com> >>>>>> >>>>>> Cc: Christopher Lamb/Switzerland/IBM@IBMCH, >>>>>> >>>>>> "freeipa-users@redhat.com" >> <freeipa-users@redhat.com> >>>>>> >>>>>> Date: 06.08.2015 14:42 >>>>>> >>>>>> Subject: Re: [Freeipa-users] Ubuntu Samba Server Auth >>>>>> >>>>>> against >>>>>> >>> IPA >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> Hi, >>>>>> >>>>>> >>>>>> >>>>>> OK, this sounds already quite logical, but I'm still refering >> to >>>>>> >>>>>> the >>>>>> >>>>>> old howto we found earlier, does that one still apply somewhere >> or >>>>>> >>>>>> not >>>>>> >>>>>> at all ? >>>>>> >>>>>> >>>>>> >>>>>> Thanks, >>>>>> >>>>>> >>>>>> >>>>>> Matt >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> 2015-08-06 12:23 GMT+02:00 Youenn PIOLET <piole...@gmail.com>: >>>>>> >>>>>>> Hey guys, >>>>>> >>>>>>> >>>>>> >>>>>>> I'll try to make a tutorial soon, sorry I'm quite in a rush >> these >>>>>> >>>>> days :) >>>>>> >>>>>>> >>>>>> >>>>>>> General idea: >>>>>> >>>>>>> >>>>>> >>>>>>> On FreeIPA (4.1) >>>>>> >>>>>>> - `ipa-adtrust-install --add-sids` (creates >>>>>> >>>>>>> ipaNTsecurityidentifier >>>>>> >>>>>>> attribude, also known as SID) >>>>>> >>>>>>> - regenerate each user password to build ipaNTHash attribute, >> not >>>>>> >> here >>>>>> >>>>> by >>>>>> >>>>>>> default on users >>>>>> >>>>>>> - use your ldap browser to check ipaNTHash values are here on >> user >>>>>> >>>>>> objects >>>>>> >>>>>>> - create a CIFS service for your samba server >>>>>> >>>>>>> - Create user roles/permissions as described here: >>>>>> >>>>>>> >>>>>> >>>>>> >>>>>> >>>>> >>>>>> >>>> >>>>>> >>> >>>>>> >> >>>>>> >> >> http://freeipa-users.redhat.narkive.com/ez2uKpFS/authenticate-samba-3-or-4-with-freeipa >> >>>>>> >> >>>>>> >>> >>>>>> >>>> >>>>>> >>>>> >>>>>> >>>>>> >>>>>> >>>>>>> so that CIFS service will be able to read >> ipaNTsecurityidentifier >>>>>> >>>>>>> and >>>>>> >>>>>>> ipaNTHash attributes in LDAP (ACI) >>>>>> >>>>>>> - SCP ipasam.so module to your cifs server (this is the magic >>>>>> >> trick) : >>>>>> >>>>>> scp >>>>>> >>>>>>> /usr/lib64/samba/pdb/ipasam.so >>>>>> >>>>>>> root@samba-server.domain:/usr/lib64/samba/pdb/ You can also >> try to >>>>>> >>>>>> recompile >>>>>> >>>>>>> it. >>>>>> >>>>>>> >>>>>> >>>>>>> On SAMBA Server side (CentOS 7...) >>>>>> >>>>>>> - Install server keytab file for CIFS >>>>>> >>>>>>> - check ipasam.so is here. >>>>>> >>>>>>> - check you can read password hash in LDAP with `ldapsearch -Y >>>>>> >>>>>>> GSSAPI >>>>>> >>>>>>> uid=admin ipaNTHash` thanks to kerberos >>>>>> >>>>>>> - make your smb.conf following the linked thread and restart >>>>>> >>>>>>> service >>>>>> >>>>>>> >>>>>> >>>>>>> I don't know if it works in Ubuntu. I know sssd has evolved >>>>>> >>>>>>> quickly >>>>>> >>> and >>>>>> >>>>>>> ipasam may use quite recent functionalities, the best is to >> just >>>>>> >>>>>>> try. >>>>>> >>>>> You >>>>>> >>>>>>> can read in previous thread : "If you insist on Ubuntu you >> need to >>>>>> >> get >>>>>> >>>>>>> ipasam somewhere, most likely to compile it yourself". >>>>>> >>>>>>> >>>>>> >>>>>>> Make sure your user has ipaNTHash attribute :) >>>>>> >>>>>>> >>>>>> >>>>>>> You may want to debug authentication on samba server, I >> usually do >>>>>> >>>> this: >>>>>> >>>>>>> `tail -f /var/log/samba/log* | grep <username> >>>>>> >>>>>>> >>>>>> >>>>>>> Cheers >>>>>> >>>>>>> -- >>>>>> >>>>>>> Youenn Piolet >>>>>> >>>>>>> piole...@gmail.com >>>>>> >>>>>>> >>>>>> >>>>>>> >>>>>> >>>>>>> 2015-08-05 17:40 GMT+02:00 Matt . <yamakasi....@gmail.com>: >>>>>> >>>>>>>> >>>>>> >>>>>>>> Hi, >>>>>> >>>>>>>> >>>>>> >>>>>>>> This sounds great to me too, but a howto would help to make >> it >>>>>> >>>>>>>> more >>>>>> >>>>>>>> clear about what you have done here. The thread confuses me a >>>>>> >>>>>>>> little >>>>>> >>>>>>>> bit. >>>>>> >>>>>>>> >>>>>> >>>>>>>> Can you paste your commands so we can test out too and report >>>>>> >>>>>>>> back ? >>>>>> >>>>>>>> >>>>>> >>>>>>>> Thanks! >>>>>> >>>>>>>> >>>>>> >>>>>>>> Matt >>>>>> >>>>>>>> >>>>>> >>>>>>>> 2015-08-05 15:18 GMT+02:00 Christopher Lamb >>>>>> >>>>>> <christopher.l...@ch.ibm.com>: >>>>>> >>>>>>>> > Hi Youenn >>>>>> >>>>>>>> > >>>>>> >>>>>>>> > Good news that you have got an integration working >>>>>> >>>>>>>> > >>>>>> >>>>>>>> > Now you have got it going, and the solution is fresh in >> your >>>>>> >>>>>>>> > mind, >>>>>> >>>>> how >>>>>> >>>>>>>> > about adding a How-to page on this solution to the FreeIPA >>>>>> >>>>>>>> > wiki? >>>>>> >>>>>>>> > >>>>>> >>>>>>>> > Chris >>>>>> >>>>>>>> > >>>>>> >>>>>>>> > >>>>>> >>>>>>>> > >>>>>> >>>>>>>> > From: Youenn PIOLET <piole...@gmail.com> >>>>>> >>>>>>>> > To: "Matt ." <yamakasi....@gmail.com> >>>>>> >>>>>>>> > Cc: Christopher Lamb/Switzerland/IBM@IBMCH, >>>>>> >>>>>>>> > "freeipa-users@redhat.com" >>>>>> >>>>>>>> > <freeipa-users@redhat.com> >>>>>> >>>>>>>> > Date: 05.08.2015 14:51 >>>>>> >>>>>>>> > Subject: Re: [Freeipa-users] Ubuntu Samba Server >> Auth >>>>>> >>> against >>>>>> >>>>>> IPA >>>>>> >>>>>>>> > >>>>>> >>>>>>>> > >>>>>> >>>>>>>> > >>>>>> >>>>>>>> > Hi guys, >>>>>> >>>>>>>> > >>>>>> >>>>>>>> > Thank you so much your previous answers. >>>>>> >>>>>>>> > I realised my SID were stored in ipaNTsecurityidentifier, >>>>>> >>>>>>>> > thanks >>>>>> >> to >>>>>> >>>>>>>> > ipa-adtrust-install --add-sids >>>>>> >>>>>>>> > >>>>>> >>>>>>>> > I found an other way to configure smb here: >>>>>> >>>>>>>> > >>>>>> >>>>>>>> > >>>>>> >>>>>> >>>>>> >>>>> >>>>>> >>>> >>>>>> >>> >>>>>> >> >>>>>> >> >> http://freeipa-users.redhat.narkive.com/ez2uKpFS/authenticate-samba-3-or-4-with-freeipa >> >>>>>> >> >>>>>> >>> >>>>>> >>>> >>>>>> >>>>> >>>>>> >>>>>> >>>>>> >>>>>>>> > It works perfectly. >>>>>> >>>>>>>> > >>>>>> >>>>>>>> > I'm using module ipasam.so I have manually scp to the samba >>>>>> >> server, >>>>>> >>>>>>>> > Samba is set to use kerberos + ldapsam via this ipasam >> module. >>>>>> >>>>>>>> > Following the instructions, I created a user role allowing >>>>>> >>>>>>>> > service >>>>>> >>>>>>>> > principal to read ipaNTHash value from the LDAP. >>>>>> >>>>>>>> > ipaNTHash are generated each time a user changes his >> password. >>>>>> >>>>>>>> > Authentication works perfectly on Windows 7, 8 and 10. >>>>>> >>>>>>>> > >>>>>> >>>>>>>> > For more details, the previously linked thread is quite >> clear. >>>>>> >>>>>>>> > >>>>>> >>>>>>>> > Cheers >>>>>> >>>>>>>> > >>>>>> >>>>>>>> > -- >>>>>> >>>>>>>> > Youenn Piolet >>>>>> >>>>>>>> > piole...@gmail.com >>>>>> >>>>>>>> > >>>>>> >>>>>>>> > >>>>>> >>>>>>>> > 2015-08-05 11:10 GMT+02:00 Matt . <yamakasi....@gmail.com>: >>>>>> >>>>>>>> > Hi Chris. >>>>>> >>>>>>>> > >>>>>> >>>>>>>> > Yes, Apache Studio did that but I was not sure why it >>>>>> >>>>>>>> > complained >>>>>> >>>> it >>>>>> >>>>>>>> > was "already" there. >>>>>> >>>>>>>> > >>>>>> >>>>>>>> > I'm still getting: >>>>>> >>>>>>>> > >>>>>> >>>>>>>> > IPA Error 4205: ObjectclassViolation >>>>>> >>>>>>>> > >>>>>> >>>>>>>> > missing attribute "sambaGroupType" required by object >> class >>>>>> >>>>>>>> > "sambaGroupMapping" >>>>>> >>>>>>>> > >>>>>> >>>>>>>> > When adding a user. >>>>>> >>>>>>>> > >>>>>> >>>>>>>> > I also see "class" as fielname under my "Last name", this >> is >>>>>> >>>>>>>> > not >>>>>> >>>> OK >>>>>> >>>>>>>> > also. >>>>>> >>>>>>>> > >>>>>> >>>>>>>> > >>>>>> >>>>>>>> > >>>>>> >>>>>>>> > We sure need to make some howto, I think we can nail this >>>>>> >> down :) >>>>>> >>>>>>>> > >>>>>> >>>>>>>> > Thanks for the heads up! >>>>>> >>>>>>>> > >>>>>> >>>>>>>> > Matthijs >>>>>> >>>>>>>> > >>>>>> >>>>>>>> > 2015-08-05 7:51 GMT+02:00 Christopher Lamb >>>>>> >>>>>>>> > <christopher.l...@ch.ibm.com>: >>>>>> >>>>>>>> > > Hi Matt >>>>>> >>>>>>>> > > >>>>>> >>>>>>>> > > If I use Apache Directory Studio to add an attribute >>>>>> >>>>>> ipaCustomFields >>>>>> >>>>>>>> > to >>>>>> >>>>>>>> > > cn=ipaConfig,cn=etc, the operation it performs is a >> modify, >>>>>> >>>>>>>> > as >>>>>> >>>>>> shown >>>>>> >>>>>>>> > below: >>>>>> >>>>>>>> > > >>>>>> >>>>>>>> > > #!RESULT OK >>>>>> >>>>>>>> > > #!CONNECTION ldap://xxx-ldap2.my.silly.example.com:yyy >>>>>> >>>>>>>> > > #!DATE 2015-08-05T05:45:04.608 >>>>>> >>>>>>>> > > dn: >> cn=ipaConfig,cn=etc,dc=my,dc=silly,dc=example,dc=com >>>>>> >>>>>>>> > > changetype: modify >>>>>> >>>>>>>> > > add: ipaCustomFields >>>>>> >>>>>>>> > > ipaCustomFields: Samba Group Type,sambagrouptype,true >>>>>> >>>>>>>> > > >>>>>> >>>>>>>> > > After that I then have a visible attribute >> ipaCustomFields >>>>>> >>>>>>>> > as >>>>>> >>>>>>>> > expected. >>>>>> >>>>>>>> > > >>>>>> >>>>>>>> > > When adding the attribute, the wizard offered me >>>>>> >>>>> "ipaCustomFields" >>>>>> >>>>>>>> > as >>>>>> >>>>>>>> > > attribute type in a drop down list. >>>>>> >>>>>>>> > > >>>>>> >>>>>>>> > > Once we get this cracked, we really must write a how-to >> on >>>>>> >>>>>>>> > the >>>>>> >>>>>>>> > FreeIPA >>>>>> >>>>>>>> > > Wiki. >>>>>> >>>>>>>> > > >>>>>> >>>>>>>> > > Chris >>>>>> >>>>>>>> > > >>>>>> >>>>>>>> > > >>>>>> >>>>>>>> > > >>>>>> >>>>>>>> > > From: Christopher Lamb/Switzerland/IBM@IBMCH >>>>>> >>>>>>>> > > To: "Matt ." <yamakasi....@gmail.com> >>>>>> >>>>>>>> > > Cc: "freeipa-users@redhat.com" >>>>>> >>>>>>>> > <freeipa-users@redhat.com> >>>>>> >>>>>>>> > > Date: 05.08.2015 07:31 >>>>>> >>>>>>>> > > Subject: Re: [Freeipa-users] Ubuntu Samba Server >>>>>> >>>>>>>> > Auth >>>>>> >>>>>> against >>>>>> >>>>>>>> > IPA >>>>>> >>>>>>>> > > Sent by: freeipa-users-boun...@redhat.com >>>>>> >>>>>>>> > > >>>>>> >>>>>>>> > > >>>>>> >>>>>>>> > > >>>>>> >>>>>>>> > > Hi Matt >>>>>> >>>>>>>> > > >>>>>> >>>>>>>> > > I also got the same result at that step, but can see >>>>>> >>>>>>>> > nothing >>>>>> >> in >>>>>> >>>>>>>> > Apache >>>>>> >>>>>>>> > > Directory Studio. >>>>>> >>>>>>>> > > >>>>>> >>>>>>>> > > As I am using existing Samba / FreeIPA groups migrated >>>>>> >>>>>>>> > across, >>>>>> >>>>>> they >>>>>> >>>>>>>> > > probably were migrated with all the required >> attributes. >>>>>> >>>>>>>> > > >>>>>> >>>>>>>> > > Looking more closely at that LDIF: I wonder should it >> not >>>>>> >>>>>>>> > be: >>>>>> >>>>>>>> > > >>>>>> >>>>>>>> > > ldapmodify -Y GSSAPI <<EOF >>>>>> >>>>>>>> > > dn: cn=ipaconfig,cn=etc,dc=domain,dc=tld >>>>>> >>>>>>>> > > changetype: modify >>>>>> >>>>>>>> > > add: ipaCustomFields >>>>>> >>>>>>>> > > ipaCustomFields: "Samba Group Type,sambagrouptype,true" >>>>>> >>>>>>>> > > EOF >>>>>> >>>>>>>> > > >>>>>> >>>>>>>> > > i.e. changetype: modify, instead of changetype add ? >>>>>> >>>>>>>> > > >>>>>> >>>>>>>> > > I don't want to play around with my prod directory - I >> will >>>>>> >>>> setup >>>>>> >>>>>> an >>>>>> >>>>>>>> > EL >>>>>> >>>>>>>> > 7.1 >>>>>> >>>>>>>> > > VM and install FreeIPA 4.x and Samba 4.x That will >> allow me >>>>>> >>>>>>>> > to >>>>>> >>>>>> play >>>>>> >>>>>>>> > around >>>>>> >>>>>>>> > > more destructively. >>>>>> >>>>>>>> > > >>>>>> >>>>>>>> > > Chris >>>>>> >>>>>>>> > > >>>>>> >>>>>>>> > > >>>>>> >>>>>>>> > > >>>>>> >>>>>>>> > > >>>>>> >>>>>>>> > > >>>>>> >>>>>>>> > > From: "Matt ." <yamakasi....@gmail.com> >>>>>> >>>>>>>> > > To: Christopher Lamb/Switzerland/IBM@IBMCH >>>>>> >>>>>>>> > > Cc: Youenn PIOLET <piole...@gmail.com>, " >>>>>> >>>>>>>> > freeipa-users@redhat.com" >>>>>> >>>>>>>> > > <freeipa-users@redhat.com> >>>>>> >>>>>>>> > > Date: 05.08.2015 01:01 >>>>>> >>>>>>>> > > Subject: Re: [Freeipa-users] Ubuntu >> Samba >>>>>> >>> Server >>>>>> >>>>>>>> > Auth >>>>>> >>>>>>>> > against IPA >>>>>> >>>>>>>> > > >>>>>> >>>>>>>> > > >>>>>> >>>>>>>> > > >>>>>> >>>>>>>> > > Hi Chris, >>>>>> >>>>>>>> > > >>>>>> >>>>>>>> > > I'm at the right path, but my issue is that: >>>>>> >>>>>>>> > > >>>>>> >>>>>>>> > > ldapmodify -Y GSSAPI <<EOF >>>>>> >>>>>>>> > > dn: cn=ipaconfig,cn=etc,dc=domain,dc=tld >>>>>> >>>>>>>> > > changetype: add >>>>>> >>>>>>>> > > add: ipaCustomFields >>>>>> >>>>>>>> > > ipaCustomFields: "Samba Group Type,sambagrouptype,true" >>>>>> >>>>>>>> > > EOF >>>>>> >>>>>>>> > > >>>>>> >>>>>>>> > > Does say it exists, my ldap explorer doesn't show it, >> and >>>>>> >>>>>>>> > when >>>>>> >>> I >>>>>> >>>>>> add >>>>>> >>>>>>>> > > it manually as an attribute it still fails when I add a >>>>>> >>>>>>>> > user >>>>>> >> on >>>>>> >>>>>> this >>>>>> >>>>>>>> > > sambagrouptype as it's needed by the other attributes >>>>>> >>>>>>>> > > >>>>>> >>>>>>>> > > So that is my issue I think so far. >>>>>> >>>>>>>> > > >>>>>> >>>>>>>> > > Any clue about that ? >>>>>> >>>>>>>> > > >>>>>> >>>>>>>> > > No problem "you don't know something or are no guru" we >> are >>>>>> >> all >>>>>> >>>>>>>> > > learning! :) >>>>>> >>>>>>>> > > >>>>>> >>>>>>>> > > Cheers, >>>>>> >>>>>>>> > > >>>>>> >>>>>>>> > > Matt >>>>>> >>>>>>>> > > >>>>>> >>>>>>>> > > >>>>>> >>>>>>>> > > 2015-08-04 21:22 GMT+02:00 Christopher Lamb < >>>>>> >>>>>>>> > christopher.l...@ch.ibm.com>: >>>>>> >>>>>>>> > >> Hi Matt, Youeen >>>>>> >>>>>>>> > >> >>>>>> >>>>>>>> > >> Just to set the background properly, I did not invent >> this >>>>>> >>>>>> process. >>>>>> >>>>>>>> > I >>>>>> >>>>>>>> > > know >>>>>> >>>>>>>> > >> only a little about FreeIPA, and almost nothing about >>>>>> >>>>>>>> > Samba, >>>>>> >>>> but >>>>>> >>>>>> I >>>>>> >>>>>>>> > guess >>>>>> >>>>>>>> > > I >>>>>> >>>>>>>> > >> was lucky enough to get the integration working on a >>>>>> >>>>>>>> > Sunday >>>>>> >>>>>>>> > afternoon. >>>>>> >>>>>>>> > (I >>>>>> >>>>>>>> > >> did have an older FreeIPA 3.x / Samba 3.x installation >> as >>>>>> >>>>>>>> > a >>>>>> >>>>>>>> > reference). >>>>>> >>>>>>>> > >> >>>>>> >>>>>>>> > >> It sounds like we need to step back, and look at the >> test >>>>>> >> user >>>>>> >>>>>> and >>>>>> >>>>>>>> > group >>>>>> >>>>>>>> > > in >>>>>> >>>>>>>> > >> the FreeIPA LDAP tree. I find using an LDAP browser >> makes >>>>>> >> this >>>>>> >>>>>> much >>>>>> >>>>>>>> > > easier. >>>>>> >>>>>>>> > >> >>>>>> >>>>>>>> > >> My FreeIPA / Samba Users have the following Samba >>>>>> >>>>>>>> > extensions >>>>>> >>> in >>>>>> >>>>>>>> > FreeIPA >>>>>> >>>>>>>> > >> (cn=accounts, cn=users): >>>>>> >>>>>>>> > >> >>>>>> >>>>>>>> > >> * objectClass: sambasamaccount >>>>>> >>>>>>>> > >> >>>>>> >>>>>>>> > >> * Attributes: sambaSID, sambaNTPassword, >> sambaPwdLastSet >>>>>> >>>>>>>> > >> >>>>>> >>>>>>>> > >> My FreeIPA / Samba Groups have the following Samba >>>>>> >>>>>>>> > extensions >>>>>> >>>> in >>>>>> >>>>>>>> > FreeIPA >>>>>> >>>>>>>> > >> (cn=accounts, cn=groups): >>>>>> >>>>>>>> > >> >>>>>> >>>>>>>> > >> * objectClass: sambaGroupMapping >>>>>> >>>>>>>> > >> >>>>>> >>>>>>>> > >> * Attributes: sambaGroupType, sambaSID >>>>>> >>>>>>>> > >> >>>>>> >>>>>>>> > >> The Users must belong to one or more of the samba >> groups >>>>>> >>>>>>>> > that >>>>>> >>>>> you >>>>>> >>>>>>>> > have >>>>>> >>>>>>>> > >> setup. >>>>>> >>>>>>>> > >> >>>>>> >>>>>>>> > >> If you don't have something similar to the above >> (which >>>>>> >> sounds >>>>>> >>>>>> like >>>>>> >>>>>>>> > it >>>>>> >>>>>>>> > is >>>>>> >>>>>>>> > >> the case), then something went wrong applying the >>>>>> >>>>>>>> > extensions. >>>>>> >>>> It >>>>>> >>>>>>>> > would >>>>>> >>>>>>>> > be >>>>>> >>>>>>>> > >> worth testing comparing a new user / group created >> post >>>>>> >> adding >>>>>> >>>>>> the >>>>>> >>>>>>>> > >> extensions to a previous existing user. >>>>>> >>>>>>>> > >> >>>>>> >>>>>>>> > >> i.e. >>>>>> >>>>>>>> > >> are the extensions missing on existing users / groups? >>>>>> >>>>>>>> > >> are the extensions missing on new users / groups? >>>>>> >>>>>>>> > >> >>>>>> >>>>>>>> > >> Cheers >>>>>> >>>>>>>> > >> >>>>>> >>>>>>>> > >> Chris >>>>>> >>>>>>>> > >> >>>>>> >>>>>>>> > >> >>>>>> >>>>>>>> > >> >>>>>> >>>>>>>> > >> >>>>>> >>>>>>>> > >> >>>>>> >>>>>>>> > >> From: Youenn PIOLET <piole...@gmail.com> >>>>>> >>>>>>>> > >> To: "Matt ." <yamakasi....@gmail.com> >>>>>> >>>>>>>> > >> Cc: Christopher Lamb/Switzerland/IBM@IBMCH, >>>>>> >>>>>>>> > >> "freeipa-users@redhat.com" >>>>>> >>>>> <freeipa-users@redhat.com> >>>>>> >>>>>>>> > >> Date: 04.08.2015 18:56 >>>>>> >>>>>>>> > >> Subject: Re: [Freeipa-users] Ubuntu Samba >> Server >>>>>> >>>>>>>> > Auth >>>>>> >>>>>>>> > against >>>>>> >>>>>>>> > IPA >>>>>> >>>>>>>> > >> >>>>>> >>>>>>>> > >> >>>>>> >>>>>>>> > >> >>>>>> >>>>>>>> > >> Hi there, >>>>>> >>>>>>>> > >> >>>>>> >>>>>>>> > >> I have difficulties to follow you at this point :) >>>>>> >>>>>>>> > >> Here is what I've done and what I've understood: >>>>>> >>>>>>>> > >> >>>>>> >>>>>>>> > >> ## SMB Side >>>>>> >>>>>>>> > >> - Testparm OK >>>>>> >>>>>>>> > >> - I've got the same NT_STATUS_NO_SUCH_USER when I try >> to >>>>>> >>>>> connect. >>>>>> >>>>>>>> > >> - pdbedit -Lv output is all successfull but I can see >>>>>> >>>>>>>> > there >>>>>> >> is >>>>>> >>>> a >>>>>> >>>>>>>> > filter : >>>>>> >>>>>>>> > >> (&(uid=*)(objectclass=sambaSamAccount). In LDAP, the >> users >>>>>> >>>> don't >>>>>> >>>>>>>> > have >>>>>> >>>>>>>> > >> sambaSamAccount. >>>>>> >>>>>>>> > >> >>>>>> >>>>>>>> > >> ## LDAP / FreeIPA side >>>>>> >>>>>>>> > >> - Since SMB server uses LDAP, I did >> ipa-adtrust-install on >>>>>> >>>>>>>> > my >>>>>> >>>>>>>> > FreeIPA >>>>>> >>>>>>>> > >> server to get samba LDAP extensions. >>>>>> >>>>>>>> > >> - I can see samba classes exist in LDAP but are not >> used >>>>>> >>>>>>>> > on >>>>>> >> my >>>>>> >>>>>>>> > group >>>>>> >>>>>>>> > >> objects nor my user objects >>>>>> >>>>>>>> > >> - I have add sambaSamAccount in FreeIPA default user >>>>>> >>>>>>>> > classes, >>>>>> >>>>>>>> > >> and sambaGroupMapping to default group classes. In >> that >>>>>> >>>>>>>> > state >>>>>> >>> I >>>>>> >>>>>>>> > can't >>>>>> >>>>>>>> > >> create user nor groups anymore, as new samba >> attributes >>>>>> >>>>>>>> > are >>>>>> >>>>>> needed >>>>>> >>>>>>>> > for >>>>>> >>>>>>>> > >> instantiation. >>>>>> >>>>>>>> > >> - I have add in etc ipaCustomFields: 'Samba Group >>>>>> >>>>>>>> > > Type,sambagrouptype,true' >>>>>> >>>>>>>> > >> but I don't get what it does. >>>>>> >>>>>>>> > >> - I tried to add the samba.js plugin. It works, and >> adds >>>>>> >>>>>>>> > the >>>>>> >>>>>>>> > "local" >>>>>> >>>>>>>> > > option >>>>>> >>>>>>>> > >> when creating a group in FreeIPA, supposed to set >>>>>> >>>> sambagrouptype >>>>>> >>>>>> to >>>>>> >>>>>>>> > 4 >>>>>> >>>>>>>> > or >>>>>> >>>>>>>> > > 2 >>>>>> >>>>>>>> > >> (domain). It doesn't work and tells that >> sambagrouptype >>>>>> >>>>> attribute >>>>>> >>>>>>>> > doesn't >>>>>> >>>>>>>> > >> exist (but it should now I put sambaGroupType class by >>>>>> >>>>>> default...) >>>>>> >>>>>>>> > >> >>>>>> >>>>>>>> > >> ## Questions >>>>>> >>>>>>>> > >> 0) Can I ask samba not to search sambaSamAccount and >> use >>>>>> >>> unix / >>>>>> >>>>>>>> > posix >>>>>> >>>>>>>> > >> instead? I guess no. >>>>>> >>>>>>>> > >> 1) How to generate the user/group SIDs ? They are >>>>>> >>>>>>>> > requested >>>>>> >> to >>>>>> >>>>>> add >>>>>> >>>>>>>> > >> sambaSamAccount classes. >>>>>> >>>>>>>> > >> This article doesn't seem relevant since we don't use >>>>>> >>>>>>>> > domain >>>>>> >>>>>>>> > controller >>>>>> >>>>>>>> > >> >>>>>> >>>>>>>> > > >>>>>> >>>>>>>> > >>>>>> >>>>>>>> > >>>>>> >>>>>> >>>>>> >>>>> >>>>>> >>>> >>>>>> >>> >>>>>> >> >>>>>> >> >> http://docs.fedoraproject.org/en-US/Fedora/17/html/FreeIPA_Guide/cifs.html >>>>>> >>>>>>>> > >>>>>> >>>>>>>> > >> and netgetlocalsid returns an error. >>>>>> >>>>>>>> > >> 2) How to fix samba.js plugin? >>>>>> >>>>>>>> > >> 3) I guess an equivalent of samba.js is needed for >> user >>>>>> >>>>> creation, >>>>>> >>>>>>>> > where >>>>>> >>>>>>>> > > can >>>>>> >>>>>>>> > >> I find it? >>>>>> >>>>>>>> > >> 4) Is your setup working with Windows 8 / Windows 10 >> and >>>>>> >>>>>>>> > not >>>>>> >>>>> only >>>>>> >>>>>>>> > Windows >>>>>> >>>>>>>> > >> 7? >>>>>> >>>>>>>> > >> >>>>>> >>>>>>>> > >> Thanks a lot for your previous and future answers >>>>>> >>>>>>>> > >> >>>>>> >>>>>>>> > >> -- >>>>>> >>>>>>>> > >> Youenn Piolet >>>>>> >>>>>>>> > >> piole...@gmail.com >>>>>> >>>>>>>> > >> >>>>>> >>>>>>>> > >> >>>>>> >>>>>>>> > >> 2015-08-04 17:55 GMT+02:00 Matt . >>>>>> >>>>>>>> > <yamakasi....@gmail.com>: >>>>>> >>>>>>>> > >> Hi, >>>>>> >>>>>>>> > >> >>>>>> >>>>>>>> > >> Yes, log is anonymised. >>>>>> >>>>>>>> > >> >>>>>> >>>>>>>> > >> It's strange, my user doesn't have a >> SambaPwdLastSet, >>>>>> >>>>>>>> > also >>>>>> >>>>> when >>>>>> >>>>>> I >>>>>> >>>>>>>> > >> change it's password it doesn't get it in ldap. >>>>>> >>>>>>>> > >> >>>>>> >>>>>>>> > >> There must be something going wrong I guess. >>>>>> >>>>>>>> > >> >>>>>> >>>>>>>> > >> Matt >>>>>> >>>>>>>> > >> >>>>>> >>>>>>>> > >> 2015-08-04 17:45 GMT+02:00 Christopher Lamb >>>>>> >>>>>>>> > > <christopher.l...@ch.ibm.com >>>>>> >>>>>>>> > >> >: >>>>>> >>>>>>>> > >> > Hi Matt >>>>>> >>>>>>>> > >> > >>>>>> >>>>>>>> > >> > I assume [username] is a real username, identical >> to >>>>>> >>>>>>>> > that >>>>>> >>>> in >>>>>> >>>>>>>> > the >>>>>> >>>>>>>> > >> FreeIPA >>>>>> >>>>>>>> > >> > cn=accounts, cn=users tree? (i.e. you anonymised >> the >>>>>> >>>>>>>> > log >>>>>> >>>>>>>> > extract). >>>>>> >>>>>>>> > >> > >>>>>> >>>>>>>> > >> > You user should be a member of the appropriate >> samba >>>>>> >>> groups >>>>>> >>>>>>>> > that >>>>>> >>>>>>>> > you >>>>>> >>>>>>>> > >> setup >>>>>> >>>>>>>> > >> > in FreeIPA. >>>>>> >>>>>>>> > >> > >>>>>> >>>>>>>> > >> > You should check that the user attribute >>>>>> >>>>>>>> > SambaPwdLastSet >>>>>> >>> is >>>>>> >>>>>> set >>>>>> >>>>>>>> > to >>>>>> >>>>>>>> > a >>>>>> >>>>>>>> > >> > positive value (e.g. 1). If not you get an error >> in >>>>>> >>>>>>>> > the >>>>>> >>>>> Samba >>>>>> >>>>>>>> > logs >>>>>> >>>>>>>> > - >>>>>> >>>>>>>> > > I >>>>>> >>>>>>>> > >> > would need to play around again with a test user >> to >>>>>> >>>>>>>> > find >>>>>> >>>> out >>>>>> >>>>>>>> > the >>>>>> >>>>>>>> > > exact >>>>>> >>>>>>>> > >> > error. >>>>>> >>>>>>>> > >> > >>>>>> >>>>>>>> > >> > I don't understand what you mean about syncing the >>>>>> >>>>>>>> > users >>>>>> >>>>>> local, >>>>>> >>>>>>>> > but >>>>>> >>>>>>>> > > we >>>>>> >>>>>>>> > >> did >>>>>> >>>>>>>> > >> > not need to do anything like that. >>>>>> >>>>>>>> > >> > >>>>>> >>>>>>>> > >> > Chris >>>>>> >>>>>>>> > >> > >>>>>> >>>>>>>> > >> > >>>>>> >>>>>>>> > >> > >>>>>> >>>>>>>> > >> > >>>>>> >>>>>>>> > >> > From: "Matt ." <yamakasi....@gmail.com> >>>>>> >>>>>>>> > >> > To: Christopher Lamb/Switzerland/IBM@IBMCH >>>>>> >>>>>>>> > >> > Cc: "freeipa-users@redhat.com" >>>>>> >>>>> <freeipa-users@redhat.com> >>>>>> >>>>>>>> > >> > Date: 04.08.2015 15:33 >>>>>> >>>>>>>> > >> > Subject: Re: [Freeipa-users] Ubuntu Samba >>>>>> >>>>>>>> > Server >>>>>> >>>> Auth >>>>>> >>>>>>>> > against >>>>>> >>>>>>>> > >> IPA >>>>>> >>>>>>>> > >> > >>>>>> >>>>>>>> > >> > >>>>>> >>>>>>>> > >> > >>>>>> >>>>>>>> > >> > Hi Chris, >>>>>> >>>>>>>> > >> > >>>>>> >>>>>>>> > >> > A puppet run added another passdb backend, that >> was >>>>>> >>> causing >>>>>> >>>>>> my >>>>>> >>>>>>>> > issue. >>>>>> >>>>>>>> > >> > >>>>>> >>>>>>>> > >> > What I still experience is: >>>>>> >>>>>>>> > >> > >>>>>> >>>>>>>> > >> > >>>>>> >>>>>>>> > >> > [2015/08/04 15:29:45.477783, 3] >>>>>> >>>>>>>> > >> > ../source3/auth/check_samsec.c:399 >> (check_sam_security) >>>>>> >>>>>>>> > >> > check_sam_security: Couldn't find user >> 'username' in >>>>>> >>>>>> passdb. >>>>>> >>>>>>>> > >> > [2015/08/04 15:29:45.478026, 2] >>>>>> >>>>>>>> > >> > ../source3/auth/auth.c:288 >> (auth_check_ntlm_password) >>>>>> >>>>>>>> > >> > check_ntlm_password: Authentication for user >>>>>> >> [username] >>>>>> >>>>> -> >>>>>> >>>>>>>> > >> > [username] FAILED with error >> NT_STATUS_NO_SUCH_USER >>>>>> >>>>>>>> > >> > >>>>>> >>>>>>>> > >> > >>>>>> >>>>>>>> > >> > I also wonder if I shall still sync the users >> local, >>>>>> >>>>>>>> > or >>>>>> >> is >>>>>> >>>>> it >>>>>> >>>>>>>> > > needed ? >>>>>> >>>>>>>> > >> > >>>>>> >>>>>>>> > >> > Thanks again, >>>>>> >>>>>>>> > >> > >>>>>> >>>>>>>> > >> > Matt >>>>>> >>>>>>>> > >> > >>>>>> >>>>>>>> > >> > 2015-08-04 14:16 GMT+02:00 Christopher Lamb < >>>>>> >>>>>>>> > >> christopher.l...@ch.ibm.com>: >>>>>> >>>>>>>> > >> >> Hi Matt >>>>>> >>>>>>>> > >> >> >>>>>> >>>>>>>> > >> >> From our smb.conf file: >>>>>> >>>>>>>> > >> >> >>>>>> >>>>>>>> > >> >> [global] >>>>>> >>>>>>>> > >> >> security = user >>>>>> >>>>>>>> > >> >> passdb backend = >>>>>> >>>>>>>> > ldapsam:ldap://xxx-ldap2.my.silly.example.com >>>>>> >>>>>>>> > >> >> ldap suffix = dc=my,dc=silly,dc=example,dc=com >>>>>> >>>>>>>> > >> >> ldap admin dn = cn=Directory Manager >>>>>> >>>>>>>> > >> >> >>>>>> >>>>>>>> > >> >> So yes, we use Directory Manager, it works for >> us. I >>>>>> >> have >>>>>> >>>>>> not >>>>>> >>>>>>>> > tried >>>>>> >>>>>>>> > >> with >>>>>> >>>>>>>> > >> > a >>>>>> >>>>>>>> > >> >> less powerful user, but it is conceivable that a >>>>>> >>>>>>>> > lesser >>>>>> >>>>> user >>>>>> >>>>>>>> > may >>>>>> >>>>>>>> > not >>>>>> >>>>>>>> > >> see >>>>>> >>>>>>>> > >> >> all the required attributes, resulting in "no >> such >>>>>> >>>>>>>> > user" >>>>>> >>>>>>>> > errors. >>>>>> >>>>>>>> > >> >> >>>>>> >>>>>>>> > >> >> Chris >>>>>> >>>>>>>> > >> >> >>>>>> >>>>>>>> > >> >> >>>>>> >>>>>>>> > >> >> >>>>>> >>>>>>>> > >> >> >>>>>> >>>>>>>> > >> >> From: "Matt ." <yamakasi....@gmail.com> >>>>>> >>>>>>>> > >> >> To: Christopher Lamb/Switzerland/IBM@IBMCH >>>>>> >>>>>>>> > >> >> Cc: "freeipa-users@redhat.com" >>>>>> >>>>>> <freeipa-users@redhat.com> >>>>>> >>>>>>>> > >> >> Date: 04.08.2015 13:32 >>>>>> >>>>>>>> > >> >> Subject: Re: [Freeipa-users] Ubuntu Samba >>>>>> >>>>>>>> > Server >>>>>> >>>>> Auth >>>>>> >>>>>>>> > against >>>>>> >>>>>>>> > >> IPA >>>>>> >>>>>>>> > >> >> >>>>>> >>>>>>>> > >> >> >>>>>> >>>>>>>> > >> >> >>>>>> >>>>>>>> > >> >> Hi Chris, >>>>>> >>>>>>>> > >> >> >>>>>> >>>>>>>> > >> >> Thanks for the heads up, indeed local is 4 I see >> now >>>>>> >> when >>>>>> >>>> I >>>>>> >>>>>>>> > add a >>>>>> >>>>>>>> > >> >> group from the GUI, great thanks! >>>>>> >>>>>>>> > >> >> >>>>>> >>>>>>>> > >> >> But do you use Directory Manager as ldap admin >> user >>>>>> >>>>>>>> > or >>>>>> >>>> some >>>>>> >>>>>>>> > other >>>>>> >>>>>>>> > >> >> admin account ? >>>>>> >>>>>>>> > >> >> >>>>>> >>>>>>>> > >> >> I'm not sure id DM is needed and it should get >> that >>>>>> >>>>>>>> > deep >>>>>> >>>>>> into >>>>>> >>>>>>>> > IPA. >>>>>> >>>>>>>> > >> >> Also when starting samba it cannot find "such >> user" >>>>>> >>>>>>>> > as >>>>>> >>>> that >>>>>> >>>>>>>> > sounds >>>>>> >>>>>>>> > >> >> quite known as it has no UID. >>>>>> >>>>>>>> > >> >> >>>>>> >>>>>>>> > >> >> From your config I see you use DM, this should >> work ? >>>>>> >>>>>>>> > >> >> >>>>>> >>>>>>>> > >> >> Thanks! >>>>>> >>>>>>>> > >> >> >>>>>> >>>>>>>> > >> >> >>>>>> >>>>>>>> > >> >> Matt >>>>>> >>>>>>>> > >> >> >>>>>> >>>>>>>> > >> >> >>>>>> >>>>>>>> > >> > >>>>>> >>>>>>>> > >> > >>>>>> >>>>>>>> > >> > >>>>>> >>>>>>>> > >> > >>>>>> >>>>>>>> > >> >>>>>> >>>>>>>> > >> -- >>>>>> >>>>>>>> > >> Manage your subscription for the Freeipa-users >> mailing >>>>>> >> list: >>>>>> >>>>>>>> > >> >> https://www.redhat.com/mailman/listinfo/freeipa-users >>>>>> >>>>>>>> > >> Go to http://freeipa.org for more info on the >> project >>>>>> >>>>>>>> > >> >>>>>> >>>>>>>> > >> >>>>>> >>>>>>>> > >> >>>>>> >>>>>>>> > > >>>>>> >>>>>>>> > > >>>>>> >>>>>>>> > > >>>>>> >>>>>>>> > > >>>>>> >>>>>>>> > > -- >>>>>> >>>>>>>> > > Manage your subscription for the Freeipa-users mailing >>>>>> >>>>>>>> > list: >>>>>> >>>>>>>> > > https://www.redhat.com/mailman/listinfo/freeipa-users >>>>>> >>>>>>>> > > Go to http://freeipa.org for more info on the project >>>>>> >>>>>>>> > > >>>>>> >>>>>>>> > > >>>>>> >>>>>>>> > > >>>>>> >>>>>>>> > > >>>>>> >>>>>>>> > >>>>>> >>>>>>>> > -- >>>>>> >>>>>>>> > Manage your subscription for the Freeipa-users mailing >> list: >>>>>> >>>>>>>> > https://www.redhat.com/mailman/listinfo/freeipa-users >>>>>> >>>>>>>> > Go to http://freeipa.org for more info on the project >>>>>> >>>>>>>> > >>>>>> >>>>>>>> > >>>>>> >>>>>>>> > >>>>>> >>>>>>> >>>>>> >>>>>>> >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> >>>>>> >>>>> >>>>>> >>>>> >>>>>> >>>>> >>>>>> >>>>> >>>>>> >>>> >>>>>> >>>> >>>>>> >>>> >>>>>> >>>> >>>>>> >>> >>>>>> >>> >>>>>> >>> >>>>>> >>> >>>>>> >> >>>>>> >> >>>>>> >> >>>>>> >> >>>>> >>>>> >> >> >> >> -- Manage your subscription for the Freeipa-users mailing list: https://www.redhat.com/mailman/listinfo/freeipa-users Go to http://freeipa.org for more info on the project
