Freenas not picking up AD domain user names

[mikesm]

Hi. I originally posted this in the sharing forum before I realized it was really an user authentication issue.

I am running Freenas 11.1-U6, upgraded from Freenas 9 about 3 months ago and working well. I took the system down last week to reconfigure the locations of some disks in the machine to prepare to add a new volume later. The system came back up fine, but NFS sharing is not working.

I have 2 volumes that are shared via CIFS and user identities mapped in an Active Directory domain. This all works fine and wbinfo -u , wbinfo -g, etc... shows all the AD users and groups, and the windows systems can access the volumes just fine.

I have a linux machine that accesses these same volumes via NFS, and I use mapall in the NFS sharing menu to set all the accesses to a windows domain user owner and group. The linux server runs a DVR, and I want to map all the recordings to common windows user so they can be accessed by a variety of systems via CIFS. However, after the reboot, the NFS share on the linux system isn't writeable. When I looked at the NFS share, I can't save the share with the parameters that worked before, because mapall can't select any of the windows domain users, only the users registered on the freenas server. None of the windows domain users show up in any permissions menu options on the system.

This used to work just fine, and it worked after my cutover to Freenas 11.1-U5. But after my reboot last week, it's won't save the NFS share configuration with the same settings it was running before the reboot.

I just upgraded to U6, but that didn't fix the problem.

Does anyone know what the issue could be?

Here is my parms file in case that's useful (edited a bit for privacy):

# Global parameters
[global]
dos charset = CP437
multicast dns register = No
realm = XXX.NET
server string = FreeNAS Server
workgroup = YYY
domain master = No
lm announce = Yes
local master = No
preferred master = No
nsupdate command = /usr/local/bin/samba-nsupdate -g
client ldap sasl wrapping = plain
logging = syslog:1
max log size = 51200
kernel change notify = No
panic action = /usr/local/libexec/samba/samba-backtrace
disable spoolss = Yes
load printers = No
printcap name = /dev/null
map to guest = Bad User
obey pam restrictions = Yes
security = ADS
server role = member server
deadtime = 15
max open files = 1885304
template shell = /bin/sh
winbind cache time = 7200
winbind enum groups = Yes
winbind enum users = Yes
winbind offline logon = Yes
winbind refresh tickets = Yes
dns proxy = No
idmap config YYY: schema mode = rfc2307
idmap config YYY: range = 10000-90000000
idmap config YYY: backend = ad
idmap config *: range = 90000001-100000000
idmap config * : backend = tdb
store dos attributes = Yes
strict locking = No
directory name cache size = 0
dos filemode = Yes
acl allow execute always = Yes
ea support = Yes
create mask = 0666
directory mask = 0777


[MP3 Library]
path = "/mnt/Media/Files/MP3 Library"
veto files = /.snapshot/.windows/.mac/.zfs/
guest ok = Yes
read only = No
vfs objects = zfs_space zfsacl streams_xattr
zfsacl:acesort = dontcare
nfs4:chown = true
nfs4:acedup = merge
nfs4:mode = special


[Media]
path = "/mnt/Media"
veto files = /.snapshot/.windows/.mac/.zfs/
read only = No
vfs objects = zfs_space zfsacl
zfsacl:acesort = dontcare
nfs4:chown = true
nfs4:acedup = merge
nfs4:mode = special


[Media2]
path = "/mnt/Media22"
veto files = /.snapshot/.windows/.mac/.zfs/
read only = No
vfs objects = zfs_space zfsacl
zfsacl:acesort = dontcare
nfs4:chown = true
nfs4:acedup = merge
nfs4:mode = special

thanks!
Mike

 

[anodos]

Sounds like possibly an issue with cachetool (which basically makes your AD users/groups visible in the UI). Can you try just filling in the AD user into the mountall field i.e. YYY\bob.

 

[mikesm]

Sounds like possibly an issue with cachetool (which basically makes your AD users/groups visible in the UI). Can you try just filling in the AD user into the mountall field i.e. YYY\bob.

Thanks for the reply!

The field is populated already with the correct info as it has the settings from when it worked before.

When I edit it manually and then try and save, I get the same config error. The fields stay populated, and the system has the correct info in red flagged as the error.

I wasn't trykbg to use the pull down menu to input the info as the user and group was there already.

Thx
Mike

 

[anodos]

Thanks for the reply!

The field is populated already with the correct info as it has the settings from when it worked before.

When I edit it manually and then try and save, I get the same config error. The fields stay populated, and the system has the correct info in red flagged as the error.

I wasn't trykbg to use the pull down menu to input the info as the user and group was there already.

Thx
Mike

If it's appropriate for your environment, try checking the box "Use Default Domain" under directory services -> Active Directory and then using "bob" in the mapall instead of "YYY\bob". If you don't mind, PM me a debug file.

 

[mikesm]

If it's appropriate for your environment, try checking the box "Use Default Domain" under directory services -> Active Directory and then using "bob" in the mapall instead of "YYY\bob". If you don't mind, PM me a debug file.

Thanks for the response. No go when using default domain. It still complains about the user I picked.

Which debug file are you looking for? Happy to PM you.

Thx
Mike

 

[anodos]

Thanks for the response. No go when using default domain. It still complains about the user I picked.

Which debug file are you looking for? Happy to PM you.

Thx
Mike

Just send the whole tar file. System->Advanced->Save Debug.

 

[mikesm]

Now this is interesting, when I try that, it gives me the green box on the top with "an error occurred".

What could be causing that?

thx
mike

 

[mikesm]

NM, had to refresh the browser. Will upload and PM you when complete.

thx
mike

 

[mikesm]

Well, I figured this out. I had the idmap backend set to ad. I found some prior articles about this being an issue (dont know why), but was surprised to see rid as the default, which I don't ever recall changing. Anyways, changing it to rid and restarting directory seems to have fixed the problem.

Thanks!
Mike