On ti, 07 kesä 2022, Mathias Homann via FreeIPA-users wrote:
Hi all,
I have successfully deployed a FreeIPA server in docker using the image from
https://hub.docker.com/r/freeipa/freeipa-server/, and on the linux side
everything works just fine - user logins, automount, using IPA as
authentication source for AWX and portainer, you name it.
Today I have joined my samba server to the ipa realm, and finally turned off
nis - and that's where the *** hit the fan: samba isn't working anymore.
If I run that samba as standalone I can't connect because it seems that samba
(on opensuse) doesn't know how to get user details from sssd, so when I tred
to connect I got this:
[2022/06/07 17:49:25.744112, 0] ../../source3/passdb/lookup_sid.c:
1633(get_primary_group_sid)
Failed to find a Unix account for lemmy
So I made my way through
https://www.freeipa.org/page/Howto/
Integrating_a_Samba_File_Server_With_IPA but that's not helping either.
Now, when I try something like "smbclient -k -L smbserver" I get some weird
"session setup failed: NT_STATUS_INVALID_PARAMETER" message on the commandline
- but it works just fine when I run the same command against the actual ipa
server.
Right now I'm using the minimal smb.conf from that website.
What am I missing?
FreeIPA's wiki page with a howto is pretty much outdated. It has mention
of that but since it is contributed by community members, we have left
it in place.
We have -- at least in Fedora and RHEL -- a working Samba domain member
configuration that is generated by ipa-client-samba tool
(freeipa-client-samba package in Fedora or ipa-client-samba in RHEL). It
is based on use of SSSD and Samba with idmap_sss.
You can read more details on how it is configured at
https://freeipa.readthedocs.io/en/latest/designs/adtrust/samba-domain-mem...
and
https://freeipa.readthedocs.io/en/latest/designs/adtrust/samba-domain-con...
Since this was implemented, Samba further tightened supported
configurations. Basically, if you are using Kerberos, there are only two
supported configurations:
- domain member in AD domain
- domain member in IPA domain
In both configurations we use winbindd with specific IDMAP backends:
'ad' or 'sss' for AD setup and 'sss' for IPA. Using 'ad'
backend is not
going to work with IPA domain because Samba's idmap_ad expects AD LDAP
schema and global catalog.
If you cannot get 'sss' IDMAP module in openSUSE, my only recommendation
would be to migrate your Samba server to Fedora. This is one of areas
where tight integration between OS distribution components is important
to have.
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland