Hi Alexander,

Thank you very much for this quick and effective response. I get stuck with the anonymous bind and I didn't even notice the TLS error... I'm clueless with the flu :(

If I change LDAPS for plain LDAP it works, but when I try to LDAP+STARTTLS problems arise:

[2018/03/23 10:48:04.846575,  5] ../source3/lib/smbldap.c:1302(smbldap_search_ext)
  smbldap_search_ext: base => [dc=ipaserverdomain], filter => [(&(objectClass=ipaNTUserAttrs)(uid=testuser))], scope => [2]
[2018/03/23 10:48:04.847142,  5] ../source3/lib/smbldap.c:1167(smbldap_close)
  The connection to the LDAP server was closed
[2018/03/23 10:48:04.848881,  0] ../source3/lib/smbldap.c:622(smbldap_start_tls)
  Failed to issue the StartTLS instruction: Connect error
[2018/03/23 10:48:04.849755,  1] ../source3/lib/smbldap.c:1259(get_cached_ldap_connect)
  Connection to LDAP server failed for the 1 try!

But the fact is that any ldapsearch with -ZZ option (so, forcing START_TLS) is working perfectly, so LDAP config and certs seems ok. I don't understand what's happening...

Thanks,

A.

2018-03-22 14:52 GMT+01:00 Alexander Bokovoy <abokovoy@redhat.com>:
On to, 22 maalis 2018, x 31978 via FreeIPA-users wrote:
Hi everybody,

First of all, thank you for providing all that helpful support in this
list, it's amazing!

I've a couple of servers running on CentOS, having FreeIPA as
authentication source and SaMBa for sharing files with some Windows
machines. The configuration is the same as indicated in the post
https://bgstack15.wordpress.com/2017/05/10/samba-share-with-freeipa-auth/

Versions are the latest as of today: CentOS 7.4.1708 up-to-date, FreeIPA
4.5.0, SSSD 1.15.2 and SaMBa 4.6.2. Everything is working flawlessly.

These days I'm trying the same config on Fedora 27 (on the two sides: ipa
and samba). Versions are the latest: Fedora 27 up-to-date, FreeIPA 4.6.2,
SSSD 1.16.1 and SaMBa 4.7.6...

... and I can't get it work.

[root@sambaserver ~]# systemctl start smb
[root@sambaserver ~]# systemctl status smb
● smb.service - Samba SMB Daemon
  Loaded: loaded (/usr/lib/systemd/system/smb.service; enabled; vendor
preset: disabled)
  Active: active (running) since Thu 2018-03-22 10:54:42 CET; 20s ago
Main PID: 656 (smbd)
  Status: "smbd: ready to serve connections..."
   Tasks: 3 (limit: 4915)
  CGroup: /system.slice/smb.service
          ├─656 /usr/sbin/smbd --foreground --no-process-group
          ├─832 /usr/sbin/smbd --foreground --no-process-group
          └─833 /usr/sbin/smbd --foreground --no-process-group

mar 22 10:54:41 sambaserver.ipaserverdomain smbd[656]: [2018/03/22
10:54:41.603487,  0] ../source3/lib/smbldap.c:1046(smbldap_connect_system)
mar 22 10:54:41 sambaserver.ipaserverdomain smbd[656]:   failed to bind to
server ldaps://ipaserver.ipaserverdomain with dn="[Anonymous bind]" Error:
Local error
mar 22 10:54:41 sambaserver.ipaserverdomain smbd[656]:           (unknown)
mar 22 10:54:42 sambaserver.ipaserverdomain smbd[656]: GSSAPI client step 1
mar 22 10:54:42 sambaserver.ipaserverdomain smbd[656]: GSSAPI client step 1
mar 22 10:54:42 sambaserver.ipaserverdomain smbd[656]: GSSAPI client step 1
mar 22 10:54:42 sambaserver.ipaserverdomain smbd[656]: GSSAPI client step 2
mar 22 10:54:42 sambaserver.ipaserverdomain systemd[1]: Started Samba SMB
Daemon.
mar 22 10:54:42 sambaserver.ipaserverdomain smbd[656]: [2018/03/22
10:54:42.999414,  0] ../lib/util/become_daemon.c:124(daemon_ready)
mar 22 10:54:42 sambaserver.ipaserverdomain smbd[656]:   STATUS=daemon
'smbd' finished starting up and ready to serve connections

[root@sambaserver ~]# cat /var/log/samba/log.smbd
.../...
[2018/03/22 10:54:19.827292,  2]
../source3/lib/smbldap.c:841(smbldap_open_connection)
 smbldap_open_connection: connection opened
[2018/03/22 10:54:19.843503,  2]
../source3/lib/smbldap.c:1046(smbldap_connect_system)
 failed to bind to server ldaps://ipaserver.ipaserverdomain with
dn="[Anonymous bind]" Error: Can't contact LDAP server
       TLS error -8023:A PKCS #11 module returned CKR_DEVICE_ERROR,
indicating that a problem has occurred with the token or slot.
[2018/03/22 10:54:19.843558,  1]
../source3/lib/smbldap.c:1259(get_cached_ldap_connect)
 Connection to LDAP server failed for the 16 try!
[2018/03/22 10:54:20.845647,  3]
../source3/smbd/server_exit.c:244(exit_server_common)
 Server exit (termination signal)
[2018/03/22 10:54:41.463285,  3]
../source3/param/loadparm.c:3862(lp_load_ex)
 lp_load_ex: refreshing parameters
[2018/03/22 10:54:41.470801,  3]
../source3/param/loadparm.c:549(init_globals)
 Initialising global parameters
[2018/03/22 10:54:41.470868,  3]
../source3/param/loadparm.c:2776(lp_do_section)
 Processing section "[global]"
[2018/03/22 10:54:41.470980,  2]
../source3/param/loadparm.c:2793(lp_do_section)
 Processing section "[aplicacions]"
[2018/03/22 10:54:41.471043,  2]
../source3/param/loadparm.c:2793(lp_do_section)
 Processing section "[compartit]"
[2018/03/22 10:54:41.471099,  2]
../source3/param/loadparm.c:2793(lp_do_section)
 Processing section "[escaner]"
[2018/03/22 10:54:41.471153,  2]
../source3/param/loadparm.c:2793(lp_do_section)
 Processing section "[usuaris]"
[2018/03/22 10:54:41.471202,  2]
../source3/param/loadparm.c:2793(lp_do_section)
 Processing section "[wpkg]"
[2018/03/22 10:54:41.471288,  3]
../source3/param/loadparm.c:1611(lp_add_ipc)
 adding IPC service
[2018/03/22 10:54:41.482042,  3] ../source3/smbd/server.c:1822(main)
 loaded services
[2018/03/22 10:54:41.535960,  1]
../source3/profile/profile.c:51(set_profile_level)
 INFO: Profiling turned OFF from pid 656
[2018/03/22 10:54:41.535998,  3] ../source3/smbd/server.c:1842(main)
 Standard input is not a socket, assuming -D option
[2018/03/22 10:54:41.536011,  3] ../source3/smbd/server.c:1854(main)
 Becoming a daemon.
[2018/03/22 10:54:41.536379,  2]
../source3/passdb/pdb_interface.c:161(make_pdb_method_name)
 No builtin backend found, trying to load plugin
[2018/03/22 10:54:41.582725,  3]
../lib/util/modules.c:167(load_module_absolute_path)
 load_module_absolute_path: Module '/usr/lib64/samba/pdb/ipaserversam.so'
loaded
[2018/03/22 10:54:41.590445,  2]
../source3/lib/smbldap.c:841(smbldap_open_connection)
 smbldap_open_connection: connection opened
[2018/03/22 10:54:41.603262,  0] ipaserver_sam.c:4245(bind_callback_cleanup)
 kerberos error: code=-1765328230, message=Cannot find KDC for realm
"ipaserverdomain"
[2018/03/22 10:54:41.603487,  0]
../source3/lib/smbldap.c:1046(smbldap_connect_system)
 failed to bind to server ldaps://ipaserver.ipaserverdomain with
dn="[Anonymous bind]" Error: Local error
       (unknown)
[2018/03/22 10:54:41.603539,  1]
../source3/lib/smbldap.c:1259(get_cached_ldap_connect)
 Connection to LDAP server failed for the 1 try!
[2018/03/22 10:54:42.604598,  2]
../source3/lib/smbldap.c:841(smbldap_open_connection)
 smbldap_open_connection: connection opened
[2018/03/22 10:54:42.742964,  3]
../source3/lib/smbldap.c:1063(smbldap_connect_system)
 ldap_connect_system: successful connection to the LDAP server
[2018/03/22 10:54:42.750197,  1] ipaserver_sam.c:4724(pdb_init_ipaserversam)
 pdb_init_ipaserversam: support for pdb_enum_upn_suffixes enabled for
domain ipaserverdomain
[2018/03/22 10:54:42.856428,  3]
../source3/lib/util_procid.c:54(pid_to_procid)
 pid_to_procid: messaging_dgm_get_unique failed: El fitxer o directori no
existeix
[2018/03/22 10:54:42.976566,  3]
../source3/rpc_server/svcctl/srv_svcctl_reg.c:565(svcctl_init_winreg)
 Initialise the svcctl registry keys if needed.
[2018/03/22 10:54:42.998031,  3]
../source3/rpc_server/eventlog/srv_eventlog_reg.c:59(eventlog_init_winreg)
 Initialise the eventlog registry keys if needed.
[2018/03/22 10:54:42.999414,  0]
../lib/util/become_daemon.c:124(daemon_ready)
 STATUS=daemon 'smbd' finished starting up and ready to serve connections
[2018/03/22 10:54:43.007591,  2]
../source3/smbd/server.c:1395(smbd_parent_loop)
 waiting for connections

That's driving me mad. Everything is working well: ipaserver, ipaclient,
dns, kerberos, kinit, tickets, users, resolution, keytabs, etc. I can't
figure out why SaMBa cannot find KDC and then trying to contact LDAPS
server with "Anonymous bind" when the dedicated keytab explicitly gives
this permissions. Commands like kinit <user> and kinit -kt <keytab>
<principal> are working as expected.
It is not 'anonymous bind', it is code in samba that prints phrase
[Anonymous bind] if DN to bind is empty. This is normal for ipasam
module because we use GSSAPI authentication and don't need to explicitly
provide DN in the calls to smbldap utility library.

https://git.samba.org/?p=samba.git;a=blob;f=source3/lib/smbldap.c;h=5a67ab79058dd0cec331d12c86b7b99370731532;hb=HEAD#l1050

What I see in the logs above, you have somewhat incorrect configuration
for your openldap/nss setup:
 failed to bind to server ldaps://ipaserver.ipaserverdomain with
dn="[Anonymous bind]" Error: Can't contact LDAP server
       TLS error -8023:A PKCS #11 module returned CKR_DEVICE_ERROR,

The TLS error is reported by openldap and is translated from the nss
code that it uses. You need to check your configuration. We don't really
support use of ipasam module outside of FreeIPA server itself.

--
/ Alexander Bokovoy