Chris,

How far are you on this ? I'm stuck atm :(

I hope you have some reference notes to follow and check out.

Thanks!

Matt

2015-08-20 22:15 GMT+02:00 Matt . <yamakasi....@gmail.com>:
> Hi Chris,
>
> Would be great to see!
>
> If I have it working and we have 2-3 testcases I think we can add it
> to the IPA docs!
>
> Keep me updated!
>
> Thanks
>
> Matt
>
> 2015-08-20 8:49 GMT+02:00 Christopher Lamb <christopher.l...@ch.ibm.com>:
>> Matt
>>
>> Once I got Samba and FreeIPA integrated (by the "good old extensions"
>> path), I always use FreeIPA to administer users. I have never tried the
>> samba tools like smbpasswd.
>>
>> I still have a wiki how-to in the works, but I had to focus on some other
>> issues for a while.
>>
>> Chris
>>
>>
>>
>> From:   "Matt ." <yamakasi....@gmail.com>
>> To:     Youenn PIOLET <piole...@gmail.com>
>> Cc:     Christopher Lamb/Switzerland/IBM@IBMCH,
>>             "freeipa-users@redhat.com" <freeipa-users@redhat.com>
>> Date:   20.08.2015 08:12
>> Subject:        Re: [Freeipa-users] Ubuntu Samba Server Auth against IPA
>>
>>
>>
>> HI Guys,
>>
>> Anyone still a working clue/test here ?
>>
>> I didn't came further as it seems there need to be some domain join /
>> match following the freeipa devs.
>>
>> Thanks!
>>
>> Matt
>>
>> 2015-08-13 13:09 GMT+02:00 Matt . <yamakasi....@gmail.com>:
>>> Hi,
>>>
>>> I might have found somthing which I already seen in the logs.
>>>
>>> I did a smbpasswd my username on the samba server, it connects to ldap
>>> very well. I give my new password and get the following:
>>>
>>> smbldap_search_ext: base => [dc=my,dc=domain], filter =>
>>> [(&(objectClass=ipaNTGroupAttrs)(|
>> (ipaNTSecurityIdentifier=S-1----my--sid---)))],
>>> scope => [2]
>>> Attribute [displayName] not found.
>>> Could not retrieve 'displayName' attribute from cn=Default SMB
>>> Group,cn=groups,cn=accounts,dc=my,dc=domain
>>> Sid S-1----my--sid--- -> MYDOMAIN\Default SMB Group(2)
>>>
>>> So something is missing!
>>>
>>> Thanks so far guys!
>>>
>>> Cheers,
>>>
>>> Matt
>>>
>>> 2015-08-13 12:02 GMT+02:00 Matt . <yamakasi....@gmail.com>:
>>>> Hi Youenn,
>>>>
>>>> OK thanks! this takes me a little but futher now and I see some good
>>>> stuff in my logging.
>>>>
>>>> I'm testing on a Windows 10 Machine which is not member of an AD or
>>>> so, so that might be my issue for now ?
>>>>
>>>> When testing on the samba box itself as my user I get:
>>>>
>>>>
>>>> [myusername@smb-01 ~]$ smbclient //smb-01.domain.local/shares
>>>>
>>>> ...
>>>> Checking NTLMSSP password for MSP\myusername failed:
>> NT_STATUS_WRONG_PASSWORD
>>>> ...
>>>> SPNEGO login failed: NT_STATUS_WRONG_PASSWORD
>>>>
>>>>
>>>> Maybe I have an issue with encrypted passwords ?
>>>>
>>>>
>>>> When we have this all working, I think we have a howto :D
>>>>
>>>> Thanks!
>>>>
>>>> Matt
>>>>
>>>> 2015-08-13 10:53 GMT+02:00 Youenn PIOLET <piole...@gmail.com>:
>>>>> Hi Matt
>>>>>
>>>>> - CentOS : Did you copy ipasam.so and change your smb.conf accordingly?
>>>>> sambaSamAccount is not needed anymore that way.
>>>>> - Default IPA Way : won't work if your Windows is not part of a domain
>>>>> controller. DOMAIN\username may work for some users using Windows 7 -
>> not 8
>>>>> nor 10 (it did for me but I was the only one at the office... quite
>> useless)
>>>>>
>>>>> This config may work on your CentOS (for the ipasam way):
>>>>> workgroup = TEST
>>>>> realm = TEST.NET
>>>>> kerberos method = dedicated keytab
>>>>> dedicated keytab file = FILE:/<.....>/samba.keytab
>>>>> create krb5 conf = no
>>>>> security = user
>>>>> encrypt passwords = true
>>>>> passdb backend = ipasam:ldaps://youripa.test.net
>>>>> ldapsam:trusted = yes
>>>>> ldapsuffix = test.net
>>>>> ldap user suffix = cn=users,cn=accounts
>>>>> ldap group suffix = cn=groups,cn=accounts
>>>>>
>>>>>
>>>>> --
>>>>> Youenn Piolet
>>>>> piole...@gmail.com
>>>>>
>>>>>
>>>>> 2015-08-12 22:15 GMT+02:00 Matt . <yamakasi....@gmail.com>:
>>>>>>
>>>>>> Hi,
>>>>>>
>>>>>> OK the default IPA way works great actually when testing it as
>> described
>>>>>> here:
>>>>>>
>>>>>>
>> http://www.freeipa.org/page/Howto/Integrating_a_Samba_File_Server_With_IPA
>>>>>>
>>>>>> On the samba server I can auth and see my share where I want to
>> connect
>>>>>> to.
>>>>>>
>>>>>> The issue is, on Windows I cannot auth, even when I do DOMAIN\username
>>>>>> as username
>>>>>>
>>>>>> So, the IPA way should work.
>>>>>>
>>>>>> Any comments here ?
>>>>>>
>>>>>> Cheers,
>>>>>>
>>>>>> Matt
>>>>>>
>>>>>> 2015-08-12 19:00 GMT+02:00 Matt . <yamakasi....@gmail.com>:
>>>>>> > HI GUys,
>>>>>> >
>>>>>> > I'm testing this out and I think I almost setup, this on a CentOS
>> samba
>>>>>> > server.
>>>>>> >
>>>>>> > I'm using the ipa-adtrust way of Youeen but it seems we still need
>> to
>>>>>> > add (objectclass=sambaSamAccount)) ?
>>>>>> >
>>>>>> > Info is welcome!
>>>>>> >
>>>>>> > I will report back when I have it working.
>>>>>> >
>>>>>> > Thanks!
>>>>>> >
>>>>>> > Matt
>>>>>> >
>>>>>> > 2015-08-10 11:16 GMT+02:00 Christopher Lamb
>>>>>> > <christopher.l...@ch.ibm.com>:
>>>>>> >> The next route I will try - is the one Youeen took, using
>> ipa-adtrust
>>>>>> >>
>>>>>> >>
>>>>>> >>
>>>>>> >> From:   "Matt ." <yamakasi....@gmail.com>
>>>>>> >> To:     Christopher Lamb/Switzerland/IBM@IBMCH,
>>>>>> >>             "freeipa-users@redhat.com" <freeipa-users@redhat.com>
>>>>>> >> Date:   10.08.2015 10:03
>>>>>> >> Subject:        Re: [Freeipa-users] Ubuntu Samba Server Auth
>> against
>>>>>> >> IPA
>>>>>> >>
>>>>>> >>
>>>>>> >>
>>>>>> >> Hi Chris,
>>>>>> >>
>>>>>> >> Okay this is good to hear.
>>>>>> >>
>>>>>> >> But don't we want a IPA managed Scheme ?
>>>>>> >>
>>>>>> >> When I did a "ipa-adtrust-install --add-sids" it also wanted a
>> local
>>>>>> >> installed Samba and I wonder why.
>>>>>> >>
>>>>>> >> Good that we make some progres on making it all clear.
>>>>>> >>
>>>>>> >> Cheers,
>>>>>> >>
>>>>>> >> Matt
>>>>>> >>
>>>>>> >> 2015-08-10 6:12 GMT+02:00 Christopher Lamb
>>>>>> >> <christopher.l...@ch.ibm.com>:
>>>>>> >>> ldapsam + the samba extensions, pretty much as described in the
>>>>>> >> Techslaves
>>>>>> >>> article. Once I have a draft for the wiki page, I will mail you.
>>>>>> >>>
>>>>>> >>>
>>>>>> >>>
>>>>>> >>> From:   "Matt ." <yamakasi....@gmail.com>
>>>>>> >>> To:     Christopher Lamb/Switzerland/IBM@IBMCH,
>>>>>> >>>             "freeipa-users@redhat.com" <freeipa-users@redhat.com>
>>>>>> >>> Date:   09.08.2015 21:17
>>>>>> >>> Subject:        Re: [Freeipa-users] Ubuntu Samba Server Auth
>> against
>>>>>> >>> IPA
>>>>>> >>>
>>>>>> >>>
>>>>>> >>>
>>>>>> >>> Hi,
>>>>>> >>>
>>>>>> >>> Yes I know about "anything" but which way did you use now ?
>>>>>> >>>
>>>>>> >>>
>>>>>> >>>
>>>>>> >>> 2015-08-09 20:56 GMT+02:00 Christopher Lamb
>>>>>> >> <christopher.l...@ch.ibm.com>:
>>>>>> >>>> Hi Matt
>>>>>> >>>>
>>>>>> >>>> I am on OEL 7.1. - so anything that works on that should be good
>> for
>>>>>> >> RHEL
>>>>>> >>>> and Centos 7.x
>>>>>> >>>>
>>>>>> >>>> I intend to add a how-to to the FreeIPA Wiki over the next few
>> days.
>>>>>> >>>> As
>>>>>> >>> we
>>>>>> >>>> have suggested earlier, we will likely end up with several, one
>> for
>>>>>> >>>> each
>>>>>> >>> of
>>>>>> >>>> the possible integration paths.
>>>>>> >>>>
>>>>>> >>>> Chris
>>>>>> >>>>
>>>>>> >>>>
>>>>>> >>>>
>>>>>> >>>>
>>>>>> >>>>
>>>>>> >>>> From:   "Matt ." <yamakasi....@gmail.com>
>>>>>> >>>> To:     Christopher Lamb/Switzerland/IBM@IBMCH,
>>>>>> >>>>             "freeipa-users@redhat.com" <freeipa-users@redhat.com>
>>>>>> >>>> Date:   09.08.2015 16:45
>>>>>> >>>> Subject:        Re: [Freeipa-users] Ubuntu Samba Server Auth
>> against
>>>>>> >>>> IPA
>>>>>> >>>>
>>>>>> >>>>
>>>>>> >>>>
>>>>>> >>>> Hi Chris,
>>>>>> >>>>
>>>>>> >>>> This sounds great!
>>>>>> >>>>
>>>>>> >>>> What are you using now, both CentOS ? So Samba and FreeIPA ?
>>>>>> >>>>
>>>>>> >>>> Maybe it's good to explain which way you used now in steps too,
>> so we
>>>>>> >>>> can combine or create multiple howto's ?
>>>>>> >>>>
>>>>>> >>>> At least we are going somewhere!
>>>>>> >>>>
>>>>>> >>>> Thanks,
>>>>>> >>>>
>>>>>> >>>> Matt
>>>>>> >>>>
>>>>>> >>>> 2015-08-09 14:54 GMT+02:00 Christopher Lamb
>>>>>> >>> <christopher.l...@ch.ibm.com>:
>>>>>> >>>>> Hi Matt
>>>>>> >>>>>
>>>>>> >>>>> My test integration of FreeIPA 4.x and Samba 4.x with the "good
>> old
>>>>>> >>> Samba
>>>>>> >>>>> Schema extensions) is up and working, almost flawlessly.
>>>>>> >>>>>
>>>>>> >>>>> I can add users and groups via the FreeIPA CLI, and they get the
>>>>>> >> correct
>>>>>> >>>>> ObjectClasses / attributes required for Samba.
>>>>>> >>>>>
>>>>>> >>>>> So far I have not yet bothered to try the extensions to the
>> WebUI,
>>>>>> >>>> because
>>>>>> >>>>> it is currently giving me the classic "Your session has expired.
>>>>>> >>>>> Please
>>>>>> >>>>> re-login." error which renders the WebUI useless.
>>>>>> >>>>>
>>>>>> >>>>> The only problem I have so far encountered managing Samba /
>> FreeIPA
>>>>>> >>> users
>>>>>> >>>>> via FreeIPA CLI commands is with the handling of the attribute
>>>>>> >>>>> sambaPwdLastSet. This is the subject of an existing thread, also
>>>>>> >> updated
>>>>>> >>>>> today.
>>>>>> >>>>>
>>>>>> >>>>> There is also an existing alternative to hacking group.py, using
>>>>>> >>>>> "Class
>>>>>> >>>> of
>>>>>> >>>>> Service" (Cos) documented in this thread from February 2015
>>>>>> >>>>>
>>>>>> >>>
>>>>>> >>>
>> https://www.redhat.com/archives/freeipa-users/2015-February/msg00172.html
>>>>>> >>>> .
>>>>>> >>>>> I have not yet tried it, but it sounds reasonable.
>>>>>> >>>>>
>>>>>> >>>>> Chris
>>>>>> >>>>>
>>>>>> >>>>>
>>>>>> >>>>>
>>>>>> >>>>>
>>>>>> >>>>>
>>>>>> >>>>> From:   "Matt ." <yamakasi....@gmail.com>
>>>>>> >>>>> To:     Christopher Lamb/Switzerland/IBM@IBMCH
>>>>>> >>>>> Cc:     "freeipa-users@redhat.com" <freeipa-users@redhat.com>,
>>>>>> >>>>> Youenn
>>>>>> >>>>>             PIOLET <piole...@gmail.com>
>>>>>> >>>>> Date:   06.08.2015 16:19
>>>>>> >>>>> Subject:        Re: [Freeipa-users] Ubuntu Samba Server Auth
>> against
>>>>>> >> IPA
>>>>>> >>>>>
>>>>>> >>>>>
>>>>>> >>>>>
>>>>>> >>>>> Hi Chris,
>>>>>> >>>>>
>>>>>> >>>>> OK, than we might create two different versions of the wiki, I
>> think
>>>>>> >>>>> this is nice.
>>>>>> >>>>>
>>>>>> >>>>> I'm still figuring out why I get that:
>>>>>> >>>>>
>>>>>> >>>>> IPA Error 4205: ObjectclassViolation
>>>>>> >>>>>
>>>>>> >>>>> missing attribute "sambaGroupType" required by object class
>>>>>> >>>>> "sambaGroupMapping"
>>>>>> >>>>>
>>>>>> >>>>> Matt
>>>>>> >>>>>
>>>>>> >>>>> 2015-08-06 16:09 GMT+02:00 Christopher Lamb
>>>>>> >>>> <christopher.l...@ch.ibm.com>:
>>>>>> >>>>>> Hi Matt
>>>>>> >>>>>>
>>>>>> >>>>>> As far as I can make out, there are at least 2 viable Samba /
>>>>>> >>>>>> FreeIPA
>>>>>> >>>>>> integration paths.
>>>>>> >>>>>>
>>>>>> >>>>>> The route I took is suited where there is no Active Directory
>>>>>> >> involved:
>>>>>> >>>>> In
>>>>>> >>>>>> my case all the Windows, OSX and Linux clients are islands that
>> sit
>>>>>> >>>>>> on
>>>>>> >>>>> the
>>>>>> >>>>>> same network.
>>>>>> >>>>>>
>>>>>> >>>>>> The route that Youenn has taken (unless I have got completely
>> the
>>>>>> >> wrong
>>>>>> >>>>> end
>>>>>> >>>>>> of the stick) requires Active Directory in the architecture.
>>>>>> >>>>>>
>>>>>> >>>>>> Chris
>>>>>> >>>>>>
>>>>>> >>>>>>
>>>>>> >>>>>>
>>>>>> >>>>>> From:   "Matt ." <yamakasi....@gmail.com>
>>>>>> >>>>>> To:     Youenn PIOLET <piole...@gmail.com>
>>>>>> >>>>>> Cc:     Christopher Lamb/Switzerland/IBM@IBMCH,
>>>>>> >>>>>>             "freeipa-users@redhat.com"
>> <freeipa-users@redhat.com>
>>>>>> >>>>>> Date:   06.08.2015 14:42
>>>>>> >>>>>> Subject:        Re: [Freeipa-users] Ubuntu Samba Server Auth
>>>>>> >>>>>> against
>>>>>> >>> IPA
>>>>>> >>>>>>
>>>>>> >>>>>>
>>>>>> >>>>>>
>>>>>> >>>>>> Hi,
>>>>>> >>>>>>
>>>>>> >>>>>> OK, this sounds already quite logical, but I'm still refering
>> to
>>>>>> >>>>>> the
>>>>>> >>>>>> old howto we found earlier, does that one still apply somewhere
>> or
>>>>>> >>>>>> not
>>>>>> >>>>>> at all ?
>>>>>> >>>>>>
>>>>>> >>>>>> Thanks,
>>>>>> >>>>>>
>>>>>> >>>>>> Matt
>>>>>> >>>>>>
>>>>>> >>>>>>
>>>>>> >>>>>>
>>>>>> >>>>>> 2015-08-06 12:23 GMT+02:00 Youenn PIOLET <piole...@gmail.com>:
>>>>>> >>>>>>> Hey guys,
>>>>>> >>>>>>>
>>>>>> >>>>>>> I'll try to make a tutorial soon, sorry I'm quite in a rush
>> these
>>>>>> >>>>> days :)
>>>>>> >>>>>>>
>>>>>> >>>>>>> General idea:
>>>>>> >>>>>>>
>>>>>> >>>>>>> On FreeIPA (4.1)
>>>>>> >>>>>>> - `ipa-adtrust-install --add-sids` (creates
>>>>>> >>>>>>> ipaNTsecurityidentifier
>>>>>> >>>>>>> attribude, also known as SID)
>>>>>> >>>>>>> - regenerate each user password to build ipaNTHash attribute,
>> not
>>>>>> >> here
>>>>>> >>>>> by
>>>>>> >>>>>>> default on users
>>>>>> >>>>>>> - use your ldap browser to check ipaNTHash values are here on
>> user
>>>>>> >>>>>> objects
>>>>>> >>>>>>> - create a CIFS service for your samba server
>>>>>> >>>>>>> - Create user roles/permissions as described here:
>>>>>> >>>>>>>
>>>>>> >>>>>>
>>>>>> >>>>>
>>>>>> >>>>
>>>>>> >>>
>>>>>> >>
>>>>>> >>
>> http://freeipa-users.redhat.narkive.com/ez2uKpFS/authenticate-samba-3-or-4-with-freeipa
>>
>>>>>> >>
>>>>>> >>>
>>>>>> >>>>
>>>>>> >>>>>
>>>>>> >>>>>>
>>>>>> >>>>>>> so that CIFS service will be able to read
>> ipaNTsecurityidentifier
>>>>>> >>>>>>> and
>>>>>> >>>>>>> ipaNTHash attributes in LDAP (ACI)
>>>>>> >>>>>>> - SCP ipasam.so module to your cifs server (this is the magic
>>>>>> >> trick) :
>>>>>> >>>>>> scp
>>>>>> >>>>>>> /usr/lib64/samba/pdb/ipasam.so
>>>>>> >>>>>>> root@samba-server.domain:/usr/lib64/samba/pdb/ You can also
>> try to
>>>>>> >>>>>> recompile
>>>>>> >>>>>>> it.
>>>>>> >>>>>>>
>>>>>> >>>>>>> On SAMBA Server side (CentOS 7...)
>>>>>> >>>>>>> - Install server keytab file for CIFS
>>>>>> >>>>>>> - check ipasam.so is here.
>>>>>> >>>>>>> - check you can read password hash in LDAP with `ldapsearch -Y
>>>>>> >>>>>>> GSSAPI
>>>>>> >>>>>>> uid=admin ipaNTHash` thanks to kerberos
>>>>>> >>>>>>> - make your smb.conf following the linked thread and restart
>>>>>> >>>>>>> service
>>>>>> >>>>>>>
>>>>>> >>>>>>> I don't know if it works in Ubuntu. I know sssd has evolved
>>>>>> >>>>>>> quickly
>>>>>> >>> and
>>>>>> >>>>>>> ipasam may use quite recent functionalities, the best is to
>> just
>>>>>> >>>>>>> try.
>>>>>> >>>>> You
>>>>>> >>>>>>> can read in previous thread : "If you insist on Ubuntu you
>> need to
>>>>>> >> get
>>>>>> >>>>>>> ipasam somewhere, most likely to compile it yourself".
>>>>>> >>>>>>>
>>>>>> >>>>>>> Make sure your user has ipaNTHash attribute :)
>>>>>> >>>>>>>
>>>>>> >>>>>>> You may want to debug authentication on samba server, I
>> usually do
>>>>>> >>>> this:
>>>>>> >>>>>>> `tail -f /var/log/samba/log* | grep <username>
>>>>>> >>>>>>>
>>>>>> >>>>>>> Cheers
>>>>>> >>>>>>> --
>>>>>> >>>>>>> Youenn Piolet
>>>>>> >>>>>>> piole...@gmail.com
>>>>>> >>>>>>>
>>>>>> >>>>>>>
>>>>>> >>>>>>> 2015-08-05 17:40 GMT+02:00 Matt . <yamakasi....@gmail.com>:
>>>>>> >>>>>>>>
>>>>>> >>>>>>>> Hi,
>>>>>> >>>>>>>>
>>>>>> >>>>>>>> This sounds great to me too, but a howto would help to make
>> it
>>>>>> >>>>>>>> more
>>>>>> >>>>>>>> clear about what you have done here. The thread confuses me a
>>>>>> >>>>>>>> little
>>>>>> >>>>>>>> bit.
>>>>>> >>>>>>>>
>>>>>> >>>>>>>> Can you paste your commands so we can test out too and report
>>>>>> >>>>>>>> back ?
>>>>>> >>>>>>>>
>>>>>> >>>>>>>> Thanks!
>>>>>> >>>>>>>>
>>>>>> >>>>>>>> Matt
>>>>>> >>>>>>>>
>>>>>> >>>>>>>> 2015-08-05 15:18 GMT+02:00 Christopher Lamb
>>>>>> >>>>>> <christopher.l...@ch.ibm.com>:
>>>>>> >>>>>>>> > Hi Youenn
>>>>>> >>>>>>>> >
>>>>>> >>>>>>>> > Good news that you have got an integration working
>>>>>> >>>>>>>> >
>>>>>> >>>>>>>> > Now you have got it going, and the solution is fresh in
>> your
>>>>>> >>>>>>>> > mind,
>>>>>> >>>>> how
>>>>>> >>>>>>>> > about adding a How-to page on this solution to the FreeIPA
>>>>>> >>>>>>>> > wiki?
>>>>>> >>>>>>>> >
>>>>>> >>>>>>>> > Chris
>>>>>> >>>>>>>> >
>>>>>> >>>>>>>> >
>>>>>> >>>>>>>> >
>>>>>> >>>>>>>> > From:   Youenn PIOLET <piole...@gmail.com>
>>>>>> >>>>>>>> > To:     "Matt ." <yamakasi....@gmail.com>
>>>>>> >>>>>>>> > Cc:     Christopher Lamb/Switzerland/IBM@IBMCH,
>>>>>> >>>>>>>> >             "freeipa-users@redhat.com"
>>>>>> >>>>>>>> > <freeipa-users@redhat.com>
>>>>>> >>>>>>>> > Date:   05.08.2015 14:51
>>>>>> >>>>>>>> > Subject:        Re: [Freeipa-users] Ubuntu Samba Server
>> Auth
>>>>>> >>> against
>>>>>> >>>>>> IPA
>>>>>> >>>>>>>> >
>>>>>> >>>>>>>> >
>>>>>> >>>>>>>> >
>>>>>> >>>>>>>> > Hi guys,
>>>>>> >>>>>>>> >
>>>>>> >>>>>>>> > Thank you so much your previous answers.
>>>>>> >>>>>>>> > I realised my SID were stored in ipaNTsecurityidentifier,
>>>>>> >>>>>>>> > thanks
>>>>>> >> to
>>>>>> >>>>>>>> > ipa-adtrust-install --add-sids
>>>>>> >>>>>>>> >
>>>>>> >>>>>>>> > I found an other way to configure smb here:
>>>>>> >>>>>>>> >
>>>>>> >>>>>>>> >
>>>>>> >>>>>>
>>>>>> >>>>>
>>>>>> >>>>
>>>>>> >>>
>>>>>> >>
>>>>>> >>
>> http://freeipa-users.redhat.narkive.com/ez2uKpFS/authenticate-samba-3-or-4-with-freeipa
>>
>>>>>> >>
>>>>>> >>>
>>>>>> >>>>
>>>>>> >>>>>
>>>>>> >>>>>>
>>>>>> >>>>>>>> > It works perfectly.
>>>>>> >>>>>>>> >
>>>>>> >>>>>>>> > I'm using module ipasam.so I have manually scp to the samba
>>>>>> >> server,
>>>>>> >>>>>>>> > Samba is set to use kerberos + ldapsam via this ipasam
>> module.
>>>>>> >>>>>>>> > Following the instructions, I created a user role allowing
>>>>>> >>>>>>>> > service
>>>>>> >>>>>>>> > principal to read ipaNTHash value from the LDAP.
>>>>>> >>>>>>>> > ipaNTHash are generated each time a user changes his
>> password.
>>>>>> >>>>>>>> > Authentication works perfectly on Windows 7, 8 and 10.
>>>>>> >>>>>>>> >
>>>>>> >>>>>>>> > For more details, the previously linked thread is quite
>> clear.
>>>>>> >>>>>>>> >
>>>>>> >>>>>>>> > Cheers
>>>>>> >>>>>>>> >
>>>>>> >>>>>>>> > --
>>>>>> >>>>>>>> > Youenn Piolet
>>>>>> >>>>>>>> > piole...@gmail.com
>>>>>> >>>>>>>> >
>>>>>> >>>>>>>> >
>>>>>> >>>>>>>> > 2015-08-05 11:10 GMT+02:00 Matt . <yamakasi....@gmail.com>:
>>>>>> >>>>>>>> >   Hi Chris.
>>>>>> >>>>>>>> >
>>>>>> >>>>>>>> >   Yes, Apache Studio did that but I was not sure why it
>>>>>> >>>>>>>> > complained
>>>>>> >>>> it
>>>>>> >>>>>>>> >   was "already" there.
>>>>>> >>>>>>>> >
>>>>>> >>>>>>>> >   I'm still getting:
>>>>>> >>>>>>>> >
>>>>>> >>>>>>>> >   IPA Error 4205: ObjectclassViolation
>>>>>> >>>>>>>> >
>>>>>> >>>>>>>> >   missing attribute "sambaGroupType" required by object
>> class
>>>>>> >>>>>>>> >   "sambaGroupMapping"
>>>>>> >>>>>>>> >
>>>>>> >>>>>>>> >   When adding a user.
>>>>>> >>>>>>>> >
>>>>>> >>>>>>>> >   I also see "class" as fielname under my "Last name", this
>> is
>>>>>> >>>>>>>> > not
>>>>>> >>>> OK
>>>>>> >>>>>>>> > also.
>>>>>> >>>>>>>> >
>>>>>> >>>>>>>> >
>>>>>> >>>>>>>> >
>>>>>> >>>>>>>> >   We sure need to make some howto, I think we can nail this
>>>>>> >> down :)
>>>>>> >>>>>>>> >
>>>>>> >>>>>>>> >   Thanks for the heads up!
>>>>>> >>>>>>>> >
>>>>>> >>>>>>>> >   Matthijs
>>>>>> >>>>>>>> >
>>>>>> >>>>>>>> >   2015-08-05 7:51 GMT+02:00 Christopher Lamb
>>>>>> >>>>>>>> > <christopher.l...@ch.ibm.com>:
>>>>>> >>>>>>>> >   > Hi Matt
>>>>>> >>>>>>>> >   >
>>>>>> >>>>>>>> >   > If I use Apache Directory Studio to add an attribute
>>>>>> >>>>>> ipaCustomFields
>>>>>> >>>>>>>> > to
>>>>>> >>>>>>>> >   > cn=ipaConfig,cn=etc, the operation it performs is a
>> modify,
>>>>>> >>>>>>>> > as
>>>>>> >>>>>> shown
>>>>>> >>>>>>>> >   below:
>>>>>> >>>>>>>> >   >
>>>>>> >>>>>>>> >   > #!RESULT OK
>>>>>> >>>>>>>> >   > #!CONNECTION ldap://xxx-ldap2.my.silly.example.com:yyy
>>>>>> >>>>>>>> >   > #!DATE 2015-08-05T05:45:04.608
>>>>>> >>>>>>>> >   > dn:
>> cn=ipaConfig,cn=etc,dc=my,dc=silly,dc=example,dc=com
>>>>>> >>>>>>>> >   > changetype: modify
>>>>>> >>>>>>>> >   > add: ipaCustomFields
>>>>>> >>>>>>>> >   > ipaCustomFields: Samba Group Type,sambagrouptype,true
>>>>>> >>>>>>>> >   >
>>>>>> >>>>>>>> >   > After that I then have a visible attribute
>> ipaCustomFields
>>>>>> >>>>>>>> > as
>>>>>> >>>>>>>> > expected.
>>>>>> >>>>>>>> >   >
>>>>>> >>>>>>>> >   > When adding the attribute, the wizard offered me
>>>>>> >>>>> "ipaCustomFields"
>>>>>> >>>>>>>> > as
>>>>>> >>>>>>>> >   > attribute type in a drop down list.
>>>>>> >>>>>>>> >   >
>>>>>> >>>>>>>> >   > Once we get this cracked, we really must write a how-to
>> on
>>>>>> >>>>>>>> > the
>>>>>> >>>>>>>> > FreeIPA
>>>>>> >>>>>>>> >   > Wiki.
>>>>>> >>>>>>>> >   >
>>>>>> >>>>>>>> >   > Chris
>>>>>> >>>>>>>> >   >
>>>>>> >>>>>>>> >   >
>>>>>> >>>>>>>> >   >
>>>>>> >>>>>>>> >   > From:   Christopher Lamb/Switzerland/IBM@IBMCH
>>>>>> >>>>>>>> >   > To:     "Matt ." <yamakasi....@gmail.com>
>>>>>> >>>>>>>> >   > Cc:     "freeipa-users@redhat.com"
>>>>>> >>>>>>>> > <freeipa-users@redhat.com>
>>>>>> >>>>>>>> >   > Date:   05.08.2015 07:31
>>>>>> >>>>>>>> >   > Subject:        Re: [Freeipa-users] Ubuntu Samba Server
>>>>>> >>>>>>>> > Auth
>>>>>> >>>>>> against
>>>>>> >>>>>>>> >   IPA
>>>>>> >>>>>>>> >   > Sent by:        freeipa-users-boun...@redhat.com
>>>>>> >>>>>>>> >   >
>>>>>> >>>>>>>> >   >
>>>>>> >>>>>>>> >   >
>>>>>> >>>>>>>> >   > Hi Matt
>>>>>> >>>>>>>> >   >
>>>>>> >>>>>>>> >   > I also got the same result at that step, but can see
>>>>>> >>>>>>>> > nothing
>>>>>> >> in
>>>>>> >>>>>>>> > Apache
>>>>>> >>>>>>>> >   > Directory Studio.
>>>>>> >>>>>>>> >   >
>>>>>> >>>>>>>> >   > As I am using existing Samba / FreeIPA groups migrated
>>>>>> >>>>>>>> > across,
>>>>>> >>>>>> they
>>>>>> >>>>>>>> >   > probably were migrated with all the required
>> attributes.
>>>>>> >>>>>>>> >   >
>>>>>> >>>>>>>> >   > Looking more closely at that LDIF: I wonder should it
>> not
>>>>>> >>>>>>>> > be:
>>>>>> >>>>>>>> >   >
>>>>>> >>>>>>>> >   > ldapmodify -Y GSSAPI <<EOF
>>>>>> >>>>>>>> >   > dn: cn=ipaconfig,cn=etc,dc=domain,dc=tld
>>>>>> >>>>>>>> >   > changetype: modify
>>>>>> >>>>>>>> >   > add: ipaCustomFields
>>>>>> >>>>>>>> >   > ipaCustomFields: "Samba Group Type,sambagrouptype,true"
>>>>>> >>>>>>>> >   > EOF
>>>>>> >>>>>>>> >   >
>>>>>> >>>>>>>> >   > i.e. changetype: modify, instead of changetype add ?
>>>>>> >>>>>>>> >   >
>>>>>> >>>>>>>> >   > I don't want to play around with my prod directory - I
>> will
>>>>>> >>>> setup
>>>>>> >>>>>> an
>>>>>> >>>>>>>> > EL
>>>>>> >>>>>>>> >   7.1
>>>>>> >>>>>>>> >   > VM and install FreeIPA 4.x and Samba 4.x That will
>> allow me
>>>>>> >>>>>>>> > to
>>>>>> >>>>>> play
>>>>>> >>>>>>>> >   around
>>>>>> >>>>>>>> >   > more destructively.
>>>>>> >>>>>>>> >   >
>>>>>> >>>>>>>> >   > Chris
>>>>>> >>>>>>>> >   >
>>>>>> >>>>>>>> >   >
>>>>>> >>>>>>>> >   >
>>>>>> >>>>>>>> >   >
>>>>>> >>>>>>>> >   >
>>>>>> >>>>>>>> >   > From:            "Matt ." <yamakasi....@gmail.com>
>>>>>> >>>>>>>> >   > To:              Christopher Lamb/Switzerland/IBM@IBMCH
>>>>>> >>>>>>>> >   > Cc:              Youenn PIOLET <piole...@gmail.com>, "
>>>>>> >>>>>>>> >   freeipa-users@redhat.com"
>>>>>> >>>>>>>> >   >             <freeipa-users@redhat.com>
>>>>>> >>>>>>>> >   > Date:            05.08.2015 01:01
>>>>>> >>>>>>>> >   > Subject:                 Re: [Freeipa-users] Ubuntu
>> Samba
>>>>>> >>> Server
>>>>>> >>>>>>>> > Auth
>>>>>> >>>>>>>> >   against IPA
>>>>>> >>>>>>>> >   >
>>>>>> >>>>>>>> >   >
>>>>>> >>>>>>>> >   >
>>>>>> >>>>>>>> >   > Hi Chris,
>>>>>> >>>>>>>> >   >
>>>>>> >>>>>>>> >   > I'm at the right path, but my issue is that:
>>>>>> >>>>>>>> >   >
>>>>>> >>>>>>>> >   > ldapmodify -Y GSSAPI <<EOF
>>>>>> >>>>>>>> >   > dn: cn=ipaconfig,cn=etc,dc=domain,dc=tld
>>>>>> >>>>>>>> >   > changetype: add
>>>>>> >>>>>>>> >   > add: ipaCustomFields
>>>>>> >>>>>>>> >   > ipaCustomFields: "Samba Group Type,sambagrouptype,true"
>>>>>> >>>>>>>> >   > EOF
>>>>>> >>>>>>>> >   >
>>>>>> >>>>>>>> >   > Does say it exists, my ldap explorer doesn't show it,
>> and
>>>>>> >>>>>>>> > when
>>>>>> >>> I
>>>>>> >>>>>> add
>>>>>> >>>>>>>> >   > it manually as an attribute it still fails when I add a
>>>>>> >>>>>>>> > user
>>>>>> >> on
>>>>>> >>>>>> this
>>>>>> >>>>>>>> >   > sambagrouptype as it's needed by the other attributes
>>>>>> >>>>>>>> >   >
>>>>>> >>>>>>>> >   > So that is my issue I think so far.
>>>>>> >>>>>>>> >   >
>>>>>> >>>>>>>> >   > Any clue about that ?
>>>>>> >>>>>>>> >   >
>>>>>> >>>>>>>> >   > No problem "you don't know something or are no guru" we
>> are
>>>>>> >> all
>>>>>> >>>>>>>> >   > learning! :)
>>>>>> >>>>>>>> >   >
>>>>>> >>>>>>>> >   > Cheers,
>>>>>> >>>>>>>> >   >
>>>>>> >>>>>>>> >   > Matt
>>>>>> >>>>>>>> >   >
>>>>>> >>>>>>>> >   >
>>>>>> >>>>>>>> >   > 2015-08-04 21:22 GMT+02:00 Christopher Lamb <
>>>>>> >>>>>>>> >   christopher.l...@ch.ibm.com>:
>>>>>> >>>>>>>> >   >> Hi Matt, Youeen
>>>>>> >>>>>>>> >   >>
>>>>>> >>>>>>>> >   >> Just to set the background properly, I did not invent
>> this
>>>>>> >>>>>> process.
>>>>>> >>>>>>>> > I
>>>>>> >>>>>>>> >   > know
>>>>>> >>>>>>>> >   >> only a little about FreeIPA, and almost nothing about
>>>>>> >>>>>>>> > Samba,
>>>>>> >>>> but
>>>>>> >>>>>> I
>>>>>> >>>>>>>> >   guess
>>>>>> >>>>>>>> >   > I
>>>>>> >>>>>>>> >   >> was lucky enough to get the integration working on a
>>>>>> >>>>>>>> > Sunday
>>>>>> >>>>>>>> > afternoon.
>>>>>> >>>>>>>> >   (I
>>>>>> >>>>>>>> >   >> did have an older FreeIPA 3.x / Samba 3.x installation
>> as
>>>>>> >>>>>>>> > a
>>>>>> >>>>>>>> >   reference).
>>>>>> >>>>>>>> >   >>
>>>>>> >>>>>>>> >   >> It sounds like we need to step back, and look at the
>> test
>>>>>> >> user
>>>>>> >>>>>> and
>>>>>> >>>>>>>> >   group
>>>>>> >>>>>>>> >   > in
>>>>>> >>>>>>>> >   >> the FreeIPA LDAP tree. I find using an LDAP browser
>> makes
>>>>>> >> this
>>>>>> >>>>>> much
>>>>>> >>>>>>>> >   > easier.
>>>>>> >>>>>>>> >   >>
>>>>>> >>>>>>>> >   >> My FreeIPA / Samba Users have the following Samba
>>>>>> >>>>>>>> > extensions
>>>>>> >>> in
>>>>>> >>>>>>>> >   FreeIPA
>>>>>> >>>>>>>> >   >> (cn=accounts, cn=users):
>>>>>> >>>>>>>> >   >>
>>>>>> >>>>>>>> >   >> * objectClass: sambasamaccount
>>>>>> >>>>>>>> >   >>
>>>>>> >>>>>>>> >   >> * Attributes: sambaSID, sambaNTPassword,
>> sambaPwdLastSet
>>>>>> >>>>>>>> >   >>
>>>>>> >>>>>>>> >   >> My FreeIPA / Samba Groups have the following Samba
>>>>>> >>>>>>>> > extensions
>>>>>> >>>> in
>>>>>> >>>>>>>> >   FreeIPA
>>>>>> >>>>>>>> >   >> (cn=accounts, cn=groups):
>>>>>> >>>>>>>> >   >>
>>>>>> >>>>>>>> >   >> * objectClass: sambaGroupMapping
>>>>>> >>>>>>>> >   >>
>>>>>> >>>>>>>> >   >> * Attributes: sambaGroupType, sambaSID
>>>>>> >>>>>>>> >   >>
>>>>>> >>>>>>>> >   >> The Users must belong to one or more of the samba
>> groups
>>>>>> >>>>>>>> > that
>>>>>> >>>>> you
>>>>>> >>>>>>>> > have
>>>>>> >>>>>>>> >   >> setup.
>>>>>> >>>>>>>> >   >>
>>>>>> >>>>>>>> >   >> If you don't have something similar to the above
>> (which
>>>>>> >> sounds
>>>>>> >>>>>> like
>>>>>> >>>>>>>> > it
>>>>>> >>>>>>>> >   is
>>>>>> >>>>>>>> >   >> the case), then something went wrong applying the
>>>>>> >>>>>>>> > extensions.
>>>>>> >>>> It
>>>>>> >>>>>>>> > would
>>>>>> >>>>>>>> >   be
>>>>>> >>>>>>>> >   >> worth testing comparing a new user / group created
>> post
>>>>>> >> adding
>>>>>> >>>>>> the
>>>>>> >>>>>>>> >   >> extensions to a previous existing user.
>>>>>> >>>>>>>> >   >>
>>>>>> >>>>>>>> >   >> i.e.
>>>>>> >>>>>>>> >   >> are the extensions missing on existing users / groups?
>>>>>> >>>>>>>> >   >> are the extensions missing on new users / groups?
>>>>>> >>>>>>>> >   >>
>>>>>> >>>>>>>> >   >> Cheers
>>>>>> >>>>>>>> >   >>
>>>>>> >>>>>>>> >   >> Chris
>>>>>> >>>>>>>> >   >>
>>>>>> >>>>>>>> >   >>
>>>>>> >>>>>>>> >   >>
>>>>>> >>>>>>>> >   >>
>>>>>> >>>>>>>> >   >>
>>>>>> >>>>>>>> >   >> From:   Youenn PIOLET <piole...@gmail.com>
>>>>>> >>>>>>>> >   >> To:     "Matt ." <yamakasi....@gmail.com>
>>>>>> >>>>>>>> >   >> Cc:     Christopher Lamb/Switzerland/IBM@IBMCH,
>>>>>> >>>>>>>> >   >>             "freeipa-users@redhat.com"
>>>>>> >>>>> <freeipa-users@redhat.com>
>>>>>> >>>>>>>> >   >> Date:   04.08.2015 18:56
>>>>>> >>>>>>>> >   >> Subject:        Re: [Freeipa-users] Ubuntu Samba
>> Server
>>>>>> >>>>>>>> > Auth
>>>>>> >>>>>>>> > against
>>>>>> >>>>>>>> >   IPA
>>>>>> >>>>>>>> >   >>
>>>>>> >>>>>>>> >   >>
>>>>>> >>>>>>>> >   >>
>>>>>> >>>>>>>> >   >> Hi there,
>>>>>> >>>>>>>> >   >>
>>>>>> >>>>>>>> >   >> I have difficulties to follow you at this point :)
>>>>>> >>>>>>>> >   >> Here is what I've done and what I've understood:
>>>>>> >>>>>>>> >   >>
>>>>>> >>>>>>>> >   >> ## SMB Side
>>>>>> >>>>>>>> >   >> - Testparm OK
>>>>>> >>>>>>>> >   >> - I've got the same NT_STATUS_NO_SUCH_USER when I try
>> to
>>>>>> >>>>> connect.
>>>>>> >>>>>>>> >   >> - pdbedit -Lv output is all successfull but I can see
>>>>>> >>>>>>>> > there
>>>>>> >> is
>>>>>> >>>> a
>>>>>> >>>>>>>> >   filter :
>>>>>> >>>>>>>> >   >> (&(uid=*)(objectclass=sambaSamAccount). In LDAP, the
>> users
>>>>>> >>>> don't
>>>>>> >>>>>>>> > have
>>>>>> >>>>>>>> >   >> sambaSamAccount.
>>>>>> >>>>>>>> >   >>
>>>>>> >>>>>>>> >   >> ## LDAP / FreeIPA side
>>>>>> >>>>>>>> >   >> - Since SMB server uses LDAP, I did
>> ipa-adtrust-install on
>>>>>> >>>>>>>> > my
>>>>>> >>>>>>>> > FreeIPA
>>>>>> >>>>>>>> >   >> server to get samba LDAP extensions.
>>>>>> >>>>>>>> >   >> - I can see samba classes exist in LDAP but are not
>> used
>>>>>> >>>>>>>> > on
>>>>>> >> my
>>>>>> >>>>>>>> > group
>>>>>> >>>>>>>> >   >> objects nor my user objects
>>>>>> >>>>>>>> >   >> - I have add sambaSamAccount in FreeIPA default user
>>>>>> >>>>>>>> > classes,
>>>>>> >>>>>>>> >   >> and sambaGroupMapping to default group classes. In
>> that
>>>>>> >>>>>>>> > state
>>>>>> >>> I
>>>>>> >>>>>>>> > can't
>>>>>> >>>>>>>> >   >> create user nor groups anymore, as new samba
>> attributes
>>>>>> >>>>>>>> > are
>>>>>> >>>>>> needed
>>>>>> >>>>>>>> > for
>>>>>> >>>>>>>> >   >> instantiation.
>>>>>> >>>>>>>> >   >> - I have add in etc ipaCustomFields: 'Samba Group
>>>>>> >>>>>>>> >   > Type,sambagrouptype,true'
>>>>>> >>>>>>>> >   >> but I don't get what it does.
>>>>>> >>>>>>>> >   >> - I tried to add the samba.js plugin. It works, and
>> adds
>>>>>> >>>>>>>> > the
>>>>>> >>>>>>>> > "local"
>>>>>> >>>>>>>> >   > option
>>>>>> >>>>>>>> >   >> when creating a group in FreeIPA, supposed to set
>>>>>> >>>> sambagrouptype
>>>>>> >>>>>> to
>>>>>> >>>>>>>> > 4
>>>>>> >>>>>>>> >   or
>>>>>> >>>>>>>> >   > 2
>>>>>> >>>>>>>> >   >> (domain). It doesn't work and tells that
>> sambagrouptype
>>>>>> >>>>> attribute
>>>>>> >>>>>>>> >   doesn't
>>>>>> >>>>>>>> >   >> exist (but it should now I put sambaGroupType class by
>>>>>> >>>>>> default...)
>>>>>> >>>>>>>> >   >>
>>>>>> >>>>>>>> >   >> ## Questions
>>>>>> >>>>>>>> >   >> 0) Can I ask samba not to search sambaSamAccount and
>> use
>>>>>> >>> unix /
>>>>>> >>>>>>>> > posix
>>>>>> >>>>>>>> >   >> instead? I guess no.
>>>>>> >>>>>>>> >   >> 1) How to generate the user/group SIDs ? They are
>>>>>> >>>>>>>> > requested
>>>>>> >> to
>>>>>> >>>>>> add
>>>>>> >>>>>>>> >   >> sambaSamAccount classes.
>>>>>> >>>>>>>> >   >> This article doesn't seem relevant since we don't use
>>>>>> >>>>>>>> > domain
>>>>>> >>>>>>>> >   controller
>>>>>> >>>>>>>> >   >>
>>>>>> >>>>>>>> >   >
>>>>>> >>>>>>>> >
>>>>>> >>>>>>>> >
>>>>>> >>>>>>
>>>>>> >>>>>
>>>>>> >>>>
>>>>>> >>>
>>>>>> >>
>>>>>> >>
>> http://docs.fedoraproject.org/en-US/Fedora/17/html/FreeIPA_Guide/cifs.html
>>>>>> >>>>>>>> >
>>>>>> >>>>>>>> >   >> and netgetlocalsid returns an error.
>>>>>> >>>>>>>> >   >> 2) How to fix samba.js plugin?
>>>>>> >>>>>>>> >   >> 3) I guess an equivalent of samba.js is needed for
>> user
>>>>>> >>>>> creation,
>>>>>> >>>>>>>> >   where
>>>>>> >>>>>>>> >   > can
>>>>>> >>>>>>>> >   >> I find it?
>>>>>> >>>>>>>> >   >> 4) Is your setup working with Windows 8 / Windows 10
>> and
>>>>>> >>>>>>>> > not
>>>>>> >>>>> only
>>>>>> >>>>>>>> >   Windows
>>>>>> >>>>>>>> >   >> 7?
>>>>>> >>>>>>>> >   >>
>>>>>> >>>>>>>> >   >> Thanks a lot for your previous and future answers
>>>>>> >>>>>>>> >   >>
>>>>>> >>>>>>>> >   >> --
>>>>>> >>>>>>>> >   >> Youenn Piolet
>>>>>> >>>>>>>> >   >> piole...@gmail.com
>>>>>> >>>>>>>> >   >>
>>>>>> >>>>>>>> >   >>
>>>>>> >>>>>>>> >   >> 2015-08-04 17:55 GMT+02:00 Matt .
>>>>>> >>>>>>>> > <yamakasi....@gmail.com>:
>>>>>> >>>>>>>> >   >>   Hi,
>>>>>> >>>>>>>> >   >>
>>>>>> >>>>>>>> >   >>   Yes, log is anonymised.
>>>>>> >>>>>>>> >   >>
>>>>>> >>>>>>>> >   >>   It's strange, my user doesn't have a
>> SambaPwdLastSet,
>>>>>> >>>>>>>> > also
>>>>>> >>>>> when
>>>>>> >>>>>> I
>>>>>> >>>>>>>> >   >>   change it's password it doesn't get it in ldap.
>>>>>> >>>>>>>> >   >>
>>>>>> >>>>>>>> >   >>   There must be something going wrong I guess.
>>>>>> >>>>>>>> >   >>
>>>>>> >>>>>>>> >   >>   Matt
>>>>>> >>>>>>>> >   >>
>>>>>> >>>>>>>> >   >>   2015-08-04 17:45 GMT+02:00 Christopher Lamb
>>>>>> >>>>>>>> >   > <christopher.l...@ch.ibm.com
>>>>>> >>>>>>>> >   >>   >:
>>>>>> >>>>>>>> >   >>   > Hi Matt
>>>>>> >>>>>>>> >   >>   >
>>>>>> >>>>>>>> >   >>   > I assume [username] is a real username, identical
>> to
>>>>>> >>>>>>>> > that
>>>>>> >>>> in
>>>>>> >>>>>>>> > the
>>>>>> >>>>>>>> >   >>   FreeIPA
>>>>>> >>>>>>>> >   >>   > cn=accounts, cn=users tree? (i.e. you anonymised
>> the
>>>>>> >>>>>>>> > log
>>>>>> >>>>>>>> > extract).
>>>>>> >>>>>>>> >   >>   >
>>>>>> >>>>>>>> >   >>   > You user should be a member of the appropriate
>> samba
>>>>>> >>> groups
>>>>>> >>>>>>>> > that
>>>>>> >>>>>>>> >   you
>>>>>> >>>>>>>> >   >>   setup
>>>>>> >>>>>>>> >   >>   > in FreeIPA.
>>>>>> >>>>>>>> >   >>   >
>>>>>> >>>>>>>> >   >>   > You should check that the user attribute
>>>>>> >>>>>>>> > SambaPwdLastSet
>>>>>> >>> is
>>>>>> >>>>>> set
>>>>>> >>>>>>>> > to
>>>>>> >>>>>>>> >   a
>>>>>> >>>>>>>> >   >>   > positive value (e.g. 1). If not you get an error
>> in
>>>>>> >>>>>>>> > the
>>>>>> >>>>> Samba
>>>>>> >>>>>>>> > logs
>>>>>> >>>>>>>> >   -
>>>>>> >>>>>>>> >   > I
>>>>>> >>>>>>>> >   >>   > would need to play around again with a test user
>> to
>>>>>> >>>>>>>> > find
>>>>>> >>>> out
>>>>>> >>>>>>>> > the
>>>>>> >>>>>>>> >   > exact
>>>>>> >>>>>>>> >   >>   > error.
>>>>>> >>>>>>>> >   >>   >
>>>>>> >>>>>>>> >   >>   > I don't understand what you mean about syncing the
>>>>>> >>>>>>>> > users
>>>>>> >>>>>> local,
>>>>>> >>>>>>>> >   but
>>>>>> >>>>>>>> >   > we
>>>>>> >>>>>>>> >   >>   did
>>>>>> >>>>>>>> >   >>   > not need to do anything like that.
>>>>>> >>>>>>>> >   >>   >
>>>>>> >>>>>>>> >   >>   > Chris
>>>>>> >>>>>>>> >   >>   >
>>>>>> >>>>>>>> >   >>   >
>>>>>> >>>>>>>> >   >>   >
>>>>>> >>>>>>>> >   >>   >
>>>>>> >>>>>>>> >   >>   > From:   "Matt ." <yamakasi....@gmail.com>
>>>>>> >>>>>>>> >   >>   > To:     Christopher Lamb/Switzerland/IBM@IBMCH
>>>>>> >>>>>>>> >   >>   > Cc:     "freeipa-users@redhat.com"
>>>>>> >>>>> <freeipa-users@redhat.com>
>>>>>> >>>>>>>> >   >>   > Date:   04.08.2015 15:33
>>>>>> >>>>>>>> >   >>   > Subject:        Re: [Freeipa-users] Ubuntu Samba
>>>>>> >>>>>>>> > Server
>>>>>> >>>> Auth
>>>>>> >>>>>>>> >   against
>>>>>> >>>>>>>> >   >>   IPA
>>>>>> >>>>>>>> >   >>   >
>>>>>> >>>>>>>> >   >>   >
>>>>>> >>>>>>>> >   >>   >
>>>>>> >>>>>>>> >   >>   > Hi Chris,
>>>>>> >>>>>>>> >   >>   >
>>>>>> >>>>>>>> >   >>   > A puppet run added another passdb backend, that
>> was
>>>>>> >>> causing
>>>>>> >>>>>> my
>>>>>> >>>>>>>> >   issue.
>>>>>> >>>>>>>> >   >>   >
>>>>>> >>>>>>>> >   >>   > What I still experience is:
>>>>>> >>>>>>>> >   >>   >
>>>>>> >>>>>>>> >   >>   >
>>>>>> >>>>>>>> >   >>   > [2015/08/04 15:29:45.477783,  3]
>>>>>> >>>>>>>> >   >>   > ../source3/auth/check_samsec.c:399
>> (check_sam_security)
>>>>>> >>>>>>>> >   >>   >   check_sam_security: Couldn't find user
>> 'username' in
>>>>>> >>>>>> passdb.
>>>>>> >>>>>>>> >   >>   > [2015/08/04 15:29:45.478026,  2]
>>>>>> >>>>>>>> >   >>   > ../source3/auth/auth.c:288
>> (auth_check_ntlm_password)
>>>>>> >>>>>>>> >   >>   >   check_ntlm_password:  Authentication for user
>>>>>> >> [username]
>>>>>> >>>>> ->
>>>>>> >>>>>>>> >   >>   > [username] FAILED with error
>> NT_STATUS_NO_SUCH_USER
>>>>>> >>>>>>>> >   >>   >
>>>>>> >>>>>>>> >   >>   >
>>>>>> >>>>>>>> >   >>   > I also wonder if I shall still sync the users
>> local,
>>>>>> >>>>>>>> > or
>>>>>> >> is
>>>>>> >>>>> it
>>>>>> >>>>>>>> >   > needed ?
>>>>>> >>>>>>>> >   >>   >
>>>>>> >>>>>>>> >   >>   > Thanks again,
>>>>>> >>>>>>>> >   >>   >
>>>>>> >>>>>>>> >   >>   > Matt
>>>>>> >>>>>>>> >   >>   >
>>>>>> >>>>>>>> >   >>   > 2015-08-04 14:16 GMT+02:00 Christopher Lamb <
>>>>>> >>>>>>>> >   >>   christopher.l...@ch.ibm.com>:
>>>>>> >>>>>>>> >   >>   >> Hi Matt
>>>>>> >>>>>>>> >   >>   >>
>>>>>> >>>>>>>> >   >>   >> From our smb.conf file:
>>>>>> >>>>>>>> >   >>   >>
>>>>>> >>>>>>>> >   >>   >> [global]
>>>>>> >>>>>>>> >   >>   >>    security = user
>>>>>> >>>>>>>> >   >>   >>    passdb backend =
>>>>>> >>>>>>>> > ldapsam:ldap://xxx-ldap2.my.silly.example.com
>>>>>> >>>>>>>> >   >>   >>    ldap suffix = dc=my,dc=silly,dc=example,dc=com
>>>>>> >>>>>>>> >   >>   >>    ldap admin dn = cn=Directory Manager
>>>>>> >>>>>>>> >   >>   >>
>>>>>> >>>>>>>> >   >>   >> So yes, we use Directory Manager, it works for
>> us. I
>>>>>> >> have
>>>>>> >>>>>> not
>>>>>> >>>>>>>> >   tried
>>>>>> >>>>>>>> >   >>   with
>>>>>> >>>>>>>> >   >>   > a
>>>>>> >>>>>>>> >   >>   >> less powerful user, but it is conceivable that a
>>>>>> >>>>>>>> > lesser
>>>>>> >>>>> user
>>>>>> >>>>>>>> > may
>>>>>> >>>>>>>> >   not
>>>>>> >>>>>>>> >   >>   see
>>>>>> >>>>>>>> >   >>   >> all the required attributes, resulting in "no
>> such
>>>>>> >>>>>>>> > user"
>>>>>> >>>>>>>> > errors.
>>>>>> >>>>>>>> >   >>   >>
>>>>>> >>>>>>>> >   >>   >> Chris
>>>>>> >>>>>>>> >   >>   >>
>>>>>> >>>>>>>> >   >>   >>
>>>>>> >>>>>>>> >   >>   >>
>>>>>> >>>>>>>> >   >>   >>
>>>>>> >>>>>>>> >   >>   >> From:   "Matt ." <yamakasi....@gmail.com>
>>>>>> >>>>>>>> >   >>   >> To:     Christopher Lamb/Switzerland/IBM@IBMCH
>>>>>> >>>>>>>> >   >>   >> Cc:     "freeipa-users@redhat.com"
>>>>>> >>>>>> <freeipa-users@redhat.com>
>>>>>> >>>>>>>> >   >>   >> Date:   04.08.2015 13:32
>>>>>> >>>>>>>> >   >>   >> Subject:        Re: [Freeipa-users] Ubuntu Samba
>>>>>> >>>>>>>> > Server
>>>>>> >>>>> Auth
>>>>>> >>>>>>>> >   against
>>>>>> >>>>>>>> >   >>   IPA
>>>>>> >>>>>>>> >   >>   >>
>>>>>> >>>>>>>> >   >>   >>
>>>>>> >>>>>>>> >   >>   >>
>>>>>> >>>>>>>> >   >>   >> Hi Chris,
>>>>>> >>>>>>>> >   >>   >>
>>>>>> >>>>>>>> >   >>   >> Thanks for the heads up, indeed local is 4 I see
>> now
>>>>>> >> when
>>>>>> >>>> I
>>>>>> >>>>>>>> > add a
>>>>>> >>>>>>>> >   >>   >> group from the GUI, great thanks!
>>>>>> >>>>>>>> >   >>   >>
>>>>>> >>>>>>>> >   >>   >> But do you use Directory Manager as ldap admin
>> user
>>>>>> >>>>>>>> > or
>>>>>> >>>> some
>>>>>> >>>>>>>> > other
>>>>>> >>>>>>>> >   >>   >> admin account ?
>>>>>> >>>>>>>> >   >>   >>
>>>>>> >>>>>>>> >   >>   >> I'm not sure id DM is needed and it should get
>> that
>>>>>> >>>>>>>> > deep
>>>>>> >>>>>> into
>>>>>> >>>>>>>> >   IPA.
>>>>>> >>>>>>>> >   >>   >> Also when starting samba it cannot find "such
>> user"
>>>>>> >>>>>>>> > as
>>>>>> >>>> that
>>>>>> >>>>>>>> >   sounds
>>>>>> >>>>>>>> >   >>   >> quite known as it has no UID.
>>>>>> >>>>>>>> >   >>   >>
>>>>>> >>>>>>>> >   >>   >> From your config I see you use DM, this should
>> work ?
>>>>>> >>>>>>>> >   >>   >>
>>>>>> >>>>>>>> >   >>   >> Thanks!
>>>>>> >>>>>>>> >   >>   >>
>>>>>> >>>>>>>> >   >>   >>
>>>>>> >>>>>>>> >   >>   >> Matt
>>>>>> >>>>>>>> >   >>   >>
>>>>>> >>>>>>>> >   >>   >>
>>>>>> >>>>>>>> >   >>   >
>>>>>> >>>>>>>> >   >>   >
>>>>>> >>>>>>>> >   >>   >
>>>>>> >>>>>>>> >   >>   >
>>>>>> >>>>>>>> >   >>
>>>>>> >>>>>>>> >   >>   --
>>>>>> >>>>>>>> >   >>   Manage your subscription for the Freeipa-users
>> mailing
>>>>>> >> list:
>>>>>> >>>>>>>> >   >>
>> https://www.redhat.com/mailman/listinfo/freeipa-users
>>>>>> >>>>>>>> >   >>   Go to http://freeipa.org for more info on the
>> project
>>>>>> >>>>>>>> >   >>
>>>>>> >>>>>>>> >   >>
>>>>>> >>>>>>>> >   >>
>>>>>> >>>>>>>> >   >
>>>>>> >>>>>>>> >   >
>>>>>> >>>>>>>> >   >
>>>>>> >>>>>>>> >   >
>>>>>> >>>>>>>> >   > --
>>>>>> >>>>>>>> >   > Manage your subscription for the Freeipa-users mailing
>>>>>> >>>>>>>> > list:
>>>>>> >>>>>>>> >   > https://www.redhat.com/mailman/listinfo/freeipa-users
>>>>>> >>>>>>>> >   > Go to http://freeipa.org for more info on the project
>>>>>> >>>>>>>> >   >
>>>>>> >>>>>>>> >   >
>>>>>> >>>>>>>> >   >
>>>>>> >>>>>>>> >   >
>>>>>> >>>>>>>> >
>>>>>> >>>>>>>> >   --
>>>>>> >>>>>>>> >   Manage your subscription for the Freeipa-users mailing
>> list:
>>>>>> >>>>>>>> >   https://www.redhat.com/mailman/listinfo/freeipa-users
>>>>>> >>>>>>>> >   Go to http://freeipa.org for more info on the project
>>>>>> >>>>>>>> >
>>>>>> >>>>>>>> >
>>>>>> >>>>>>>> >
>>>>>> >>>>>>>
>>>>>> >>>>>>>
>>>>>> >>>>>>
>>>>>> >>>>>>
>>>>>> >>>>>>
>>>>>> >>>>>>
>>>>>> >>>>>
>>>>>> >>>>>
>>>>>> >>>>>
>>>>>> >>>>>
>>>>>> >>>>
>>>>>> >>>>
>>>>>> >>>>
>>>>>> >>>>
>>>>>> >>>
>>>>>> >>>
>>>>>> >>>
>>>>>> >>>
>>>>>> >>
>>>>>> >>
>>>>>> >>
>>>>>> >>
>>>>>
>>>>>
>>
>>
>>
>>

-- 
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go to http://freeipa.org for more info on the project

Reply via email to