Hi everybody,

First of all, thank you for providing all that helpful support in this list, it's amazing!

I've a couple of servers running on CentOS, having FreeIPA as authentication source and SaMBa for sharing files with some Windows machines. The configuration is the same as indicated in the post https://bgstack15.wordpress.com/2017/05/10/samba-share-with-freeipa-auth/

Versions are the latest as of today: CentOS 7.4.1708 up-to-date, FreeIPA 4.5.0, SSSD 1.15.2 and SaMBa 4.6.2. Everything is working flawlessly.

These days I'm trying the same config on Fedora 27 (on the two sides: ipa and samba). Versions are the latest: Fedora 27 up-to-date, FreeIPA 4.6.2, SSSD 1.16.1 and SaMBa 4.7.6...

... and I can't get it work.

[root@sambaserver ~]# systemctl start smb
[root@sambaserver ~]# systemctl status smb
● smb.service - Samba SMB Daemon
   Loaded: loaded (/usr/lib/systemd/system/smb.service; enabled; vendor preset: disabled)
   Active: active (running) since Thu 2018-03-22 10:54:42 CET; 20s ago
 Main PID: 656 (smbd)
   Status: "smbd: ready to serve connections..."
    Tasks: 3 (limit: 4915)
   CGroup: /system.slice/smb.service
           ├─656 /usr/sbin/smbd --foreground --no-process-group
           ├─832 /usr/sbin/smbd --foreground --no-process-group
           └─833 /usr/sbin/smbd --foreground --no-process-group

mar 22 10:54:41 sambaserver.ipaserverdomain smbd[656]: [2018/03/22 10:54:41.603487,  0] ../source3/lib/smbldap.c:1046(smbldap_connect_system)
mar 22 10:54:41 sambaserver.ipaserverdomain smbd[656]:   failed to bind to server ldaps://ipaserver.ipaserverdomain with dn="[Anonymous bind]" Error: Local error
mar 22 10:54:41 sambaserver.ipaserverdomain smbd[656]:           (unknown)
mar 22 10:54:42 sambaserver.ipaserverdomain smbd[656]: GSSAPI client step 1
mar 22 10:54:42 sambaserver.ipaserverdomain smbd[656]: GSSAPI client step 1
mar 22 10:54:42 sambaserver.ipaserverdomain smbd[656]: GSSAPI client step 1
mar 22 10:54:42 sambaserver.ipaserverdomain smbd[656]: GSSAPI client step 2
mar 22 10:54:42 sambaserver.ipaserverdomain systemd[1]: Started Samba SMB Daemon.
mar 22 10:54:42 sambaserver.ipaserverdomain smbd[656]: [2018/03/22 10:54:42.999414,  0] ../lib/util/become_daemon.c:124(daemon_ready)
mar 22 10:54:42 sambaserver.ipaserverdomain smbd[656]:   STATUS=daemon 'smbd' finished starting up and ready to serve connections

[root@sambaserver ~]# cat /var/log/samba/log.smbd
.../...
[2018/03/22 10:54:19.827292,  2] ../source3/lib/smbldap.c:841(smbldap_open_connection)
  smbldap_open_connection: connection opened
[2018/03/22 10:54:19.843503,  2] ../source3/lib/smbldap.c:1046(smbldap_connect_system)
  failed to bind to server ldaps://ipaserver.ipaserverdomain with dn="[Anonymous bind]" Error: Can't contact LDAP server
        TLS error -8023:A PKCS #11 module returned CKR_DEVICE_ERROR, indicating that a problem has occurred with the token or slot.
[2018/03/22 10:54:19.843558,  1] ../source3/lib/smbldap.c:1259(get_cached_ldap_connect)
  Connection to LDAP server failed for the 16 try!
[2018/03/22 10:54:20.845647,  3] ../source3/smbd/server_exit.c:244(exit_server_common)
  Server exit (termination signal)
[2018/03/22 10:54:41.463285,  3] ../source3/param/loadparm.c:3862(lp_load_ex)
  lp_load_ex: refreshing parameters
[2018/03/22 10:54:41.470801,  3] ../source3/param/loadparm.c:549(init_globals)
  Initialising global parameters
[2018/03/22 10:54:41.470868,  3] ../source3/param/loadparm.c:2776(lp_do_section)
  Processing section "[global]"
[2018/03/22 10:54:41.470980,  2] ../source3/param/loadparm.c:2793(lp_do_section)
  Processing section "[aplicacions]"
[2018/03/22 10:54:41.471043,  2] ../source3/param/loadparm.c:2793(lp_do_section)
  Processing section "[compartit]"
[2018/03/22 10:54:41.471099,  2] ../source3/param/loadparm.c:2793(lp_do_section)
  Processing section "[escaner]"
[2018/03/22 10:54:41.471153,  2] ../source3/param/loadparm.c:2793(lp_do_section)
  Processing section "[usuaris]"
[2018/03/22 10:54:41.471202,  2] ../source3/param/loadparm.c:2793(lp_do_section)
  Processing section "[wpkg]"
[2018/03/22 10:54:41.471288,  3] ../source3/param/loadparm.c:1611(lp_add_ipc)
  adding IPC service
[2018/03/22 10:54:41.482042,  3] ../source3/smbd/server.c:1822(main)
  loaded services
[2018/03/22 10:54:41.535960,  1] ../source3/profile/profile.c:51(set_profile_level)
  INFO: Profiling turned OFF from pid 656
[2018/03/22 10:54:41.535998,  3] ../source3/smbd/server.c:1842(main)
  Standard input is not a socket, assuming -D option
[2018/03/22 10:54:41.536011,  3] ../source3/smbd/server.c:1854(main)
  Becoming a daemon.
[2018/03/22 10:54:41.536379,  2] ../source3/passdb/pdb_interface.c:161(make_pdb_method_name)
  No builtin backend found, trying to load plugin
[2018/03/22 10:54:41.582725,  3] ../lib/util/modules.c:167(load_module_absolute_path)
  load_module_absolute_path: Module '/usr/lib64/samba/pdb/ipaserversam.so' loaded
[2018/03/22 10:54:41.590445,  2] ../source3/lib/smbldap.c:841(smbldap_open_connection)
  smbldap_open_connection: connection opened
[2018/03/22 10:54:41.603262,  0] ipaserver_sam.c:4245(bind_callback_cleanup)
  kerberos error: code=-1765328230, message=Cannot find KDC for realm "ipaserverdomain"
[2018/03/22 10:54:41.603487,  0] ../source3/lib/smbldap.c:1046(smbldap_connect_system)
  failed to bind to server ldaps://ipaserver.ipaserverdomain with dn="[Anonymous bind]" Error: Local error
        (unknown)
[2018/03/22 10:54:41.603539,  1] ../source3/lib/smbldap.c:1259(get_cached_ldap_connect)
  Connection to LDAP server failed for the 1 try!
[2018/03/22 10:54:42.604598,  2] ../source3/lib/smbldap.c:841(smbldap_open_connection)
  smbldap_open_connection: connection opened
[2018/03/22 10:54:42.742964,  3] ../source3/lib/smbldap.c:1063(smbldap_connect_system)
  ldap_connect_system: successful connection to the LDAP server
[2018/03/22 10:54:42.750197,  1] ipaserver_sam.c:4724(pdb_init_ipaserversam)
  pdb_init_ipaserversam: support for pdb_enum_upn_suffixes enabled for domain ipaserverdomain
[2018/03/22 10:54:42.856428,  3] ../source3/lib/util_procid.c:54(pid_to_procid)
  pid_to_procid: messaging_dgm_get_unique failed: El fitxer o directori no existeix
[2018/03/22 10:54:42.976566,  3] ../source3/rpc_server/svcctl/srv_svcctl_reg.c:565(svcctl_init_winreg)
  Initialise the svcctl registry keys if needed.
[2018/03/22 10:54:42.998031,  3] ../source3/rpc_server/eventlog/srv_eventlog_reg.c:59(eventlog_init_winreg)
  Initialise the eventlog registry keys if needed.
[2018/03/22 10:54:42.999414,  0] ../lib/util/become_daemon.c:124(daemon_ready)
  STATUS=daemon 'smbd' finished starting up and ready to serve connections
[2018/03/22 10:54:43.007591,  2] ../source3/smbd/server.c:1395(smbd_parent_loop)
  waiting for connections

That's driving me mad. Everything is working well: ipaserver, ipaclient, dns, kerberos, kinit, tickets, users, resolution, keytabs, etc. I can't figure out why SaMBa cannot find KDC and then trying to contact LDAPS server with "Anonymous bind" when the dedicated keytab explicitly gives this permissions. Commands like kinit <user> and kinit -kt <keytab> <principal> are working as expected.

In CentOS this config is running out of the box. What am I missing? Are there any incompatibility with newer versions shipped with Fedora? Maybe is there a bug somwhere? Maybe it's me the bug?

Any hint would be welcome ;-)

Thank you all

A.