[SSSD-users] Attempting to Get sssd to Work With Samba 4.3 Active Directory

Rowland Penny repenny241155 at gmail.com
Tue Jan 6 08:39:35 UTC 2015


On 06/01/15 05:26, Scott Harvey` wrote:
> On 1/5/2015 3:19 AM, Rowland Penny wrote:
>>
>> Hi, your sssd.conf shows that your domain name is 
>> 'netserver02.harvey.net' and RSAT shows the NIS domain to be 
>> 'harvey', so could 'netserver02' be the hostname of the machine and 
>> 'harvey.net' is the domain name ?
>>
>> Could you please also post your smb.conf
>>
>> Rowland
>>
>> _______________________________________________
>> sssd-users mailing list
>> sssd-users at lists.fedorahosted.org
>> https://lists.fedorahosted.org/mailman/listinfo/sssd-users
>>
> Thank you for getting back.
> The NIS name cannot be changed in Active Directory at least not in the 
> menu.
> It seems I remember reading the the nis name should be domain name not 
> harvey.net.
>
> Contents of smb.conf:
> ------------------------------------------------------------------------------------- 
>
> # Global parameters
> [global]
>     workgroup = HARVEY
>     realm = HARVEY.NET
>     netbios name = NETSERVER02
>     server string = Samba PDC Harvey House
>     server role = active directory domain controller
>     dns forwarder = 192.168.1.1
>     #
>     allow dns updates = nonsecure
>     server services = +dns, +dnsupdate
>     #
>     idmap_ldb:use rfc2307 = yes
>     #
> # From
> #https://wiki.archlinux.org/index.php/Active_Directory_Integration
> #
> #    encrypt passwords = yes
> #    password server = netserver02.harvey.net
>     #
> #    idmap config * : backend = rid
> #    idmap config * : range = 10000-20000
>         #
> #    winbind use default domain = Yes
> #    winbind enum users = Yes
> #    winbind enum groups = Yes
> #    winbind nested groups = Yes
> #    winbind separator = +
> #    winbind refresh tickets = yes
>     #
>     template shell = /bin/bash
>     template homedir = /home/%D/%U
>     #
>     #preferred master = no
>     #dns proxy = no
>     #wins server = netserver02.harvey.net
>         #wins proxy = no
>     #
>     #inherit acls = Yes
>     #map acl inherit = Yes
>     #acl group control = yes
>     #
> # End From
> #
>     #acl map full control = True
>     #acl group control = yes
>     #
>     # Controlling Access Control list, the way windows does
>     #  For member domain controllers only
>     #
>     #vfs objects = acl_xattr
>     #map acl inherit = Yes
>     #store dos attributes = Yes
>     #
>     #
>     # this tells Samba to use a separate log file for each machine
>     # that connects
>     #log file = /var/samba/log/log.%m
>     # Put a capping on the size of the log files (in Kb).
>     #
>     log level = 3
>     max log size = 1000
>         log file = /var/samba/log/%m.log
>         #
>     hosts allow = 192.168.1.0/26 192.168.1.64/26 192.168.1.128/26 
> 127.0.0.1
>     hosts deny  = 0.0.0.0/0
>     # Note this will have to remain because authentication
>         # does not work with sssd yet service principle not recgonice 
> etc..
>         # this seems to work for a semi manual approach for 
> synchronize password
>         # with the local account on this server
>     unix password sync = Yes
> # passwd chat etc.. does not seem to be needed in this setup This 
> server is the Active directory it's not
> #clear what is making it work sssd is not requied
> # it function I have cycled smamb4 service off/on to make sure it's 
> the setttings have been updated
> #    passwd program = /usr/bin/passwd %u
> #    passwd chat = *New*password* %n\n *Retype*new*password* %n\n 
> *passwd:*all*authentication*tokens*updated*successfully*
>     #
> [netlogon]
>     path = /usr/local/samba/var/locks/sysvol/harvey.net/scripts
>     read only = No
>
> [sysvol]
>     path = /usr/local/samba/var/locks/sysvol
>     read only = No
>
> #============================ Share Definitions 
> ==============================
> -------------------------------------
> _______________________________________________
> sssd-users mailing list
> sssd-users at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-users

OK, it is what I thought, try changing these lines in sssd.conf:

domains = netserver02.harvey.net

[domain/netserver02.harvey.net]

To:

domains = harvey.net

[domain/harvey.net]

Also you have this line in smb.conf:

unix password sync = Yes

Why? I do hope that you are not trying to have Unix users and users in 
AD with the same username.

Rowland



More information about the sssd-users mailing list