SOLVED Join AD

[carlo5369]

Hi,
I try to read everywhere before posting but no luck, so I'm asking for help
I' try to join a windows 2003 (...) AD domain with FreeNAS-11.0-U4 (54848d13b)
check ntp --> ok
put freenas in dns --> ok
add computer --> ok
user --> ok
...
join the domain nothing appends, no row in messages but i found in debug.log
Oct 18 14:15:35 freenasRA uwsgi: [common.warden:437] warden_base.__init__: args = -v
Oct 18 14:15:35 freenasRA uwsgi: [common.warden:443] warden_base.__init__: leave
Oct 18 14:15:35 freenasRA uwsgi: [common.warden:449] warden_base.run: enter
Oct 18 14:15:35 freenasRA uwsgi: [common.warden:458] warden_base.cmd = /usr/local/bin/warden list -v
Oct 18 14:15:35 freenasRA uwsgi: [common.cmd:189] cmd_pipe.__init__: cmd = /usr/local/bin/warden list -v, kwargs = {'pipeopen_kwargs': {}}
Oct 18 14:15:35 freenasRA uwsgi: [common.cmd:219] cmd_pipe.__init__: leave
Oct 18 14:15:35 freenasRA uwsgi: [common.warden:467] warden_base.run: leave
Oct 18 14:15:35 freenasRA uwsgi: [middleware.notifier:198] Popen()ing: route -nv show default|grep 'interface:'|awk '{ print $2 }'
Oct 18 14:15:35 freenasRA uwsgi: [middleware.notifier:198] Popen()ing: route -nv show -inet6 default|grep 'interface:'|awk '{ print $2 }'
Oct 18 14:16:18 freenasRA uwsgi: [ws4py:360] Closing message received (1000) 'b'''
Oct 18 14:16:18 freenasRA uwsgi: [ws4py:360] Closing message received (1000) 'b'''
Oct 18 14:16:19 freenasRA uwsgi: [common.freenasldap:2441] FreeNAS_ActiveDirectory.__init__: enter
Oct 18 14:16:19 freenasRA uwsgi: [common.freenasldap:1536] FreeNAS_ActiveDirectory_Base.__init__: enter
Oct 18 14:16:19 freenasRA uwsgi: [common.freenasldap:1389] FreeNAS_ActiveDirectory_Base.__set_defaults: enter
Oct 18 14:16:19 freenasRA uwsgi: [common.freenasldap:1425] FreeNAS_ActiveDirectory_Base.__set_defaults: leave
Oct 18 14:16:19 freenasRA uwsgi: [common.freenasldap:1151] FreeNAS_ActiveDirectory_Base.get_SRV_records: looking up SRV records for _ldap._tcp.dc._msdcs.AD_Domain.mcr
Oct 18 14:16:19 freenasRA uwsgi: [common.freenasldap:1151] FreeNAS_ActiveDirectory_Base.get_SRV_records: looking up SRV records for _kerberos._tcp.AD_Domain.mcr
Oct 18 14:16:19 freenasRA uwsgi: [common.freenasldap:1151] FreeNAS_ActiveDirectory_Base.get_SRV_records: looking up SRV records for _kpasswd._tcp.AD_Domain.mcr
Oct 18 14:16:19 freenasRA uwsgi: [common.freenasldap:131] FreeNAS_LDAP_Directory.__init__: enter
Oct 18 14:16:19 freenasRA uwsgi: [common.frenascache:307] FreeNAS_LDAP_QueryCache.__init__: enter
Oct 18 14:16:19 freenasRA uwsgi: [common.frenascache:89] FreeNAS_BaseCache._init__: enter
Oct 18 14:16:19 freenasRA uwsgi: [common.frenascache:110] FreeNAS_BaseCache._init__: cachedir = /var/tmp/.cache/.query
Oct 18 14:16:19 freenasRA uwsgi: [common.frenascache:113] FreeNAS_BaseCache._init__: cachefile = /var/tmp/.cache/.query/.cache.db
Oct 18 14:16:19 freenasRA uwsgi: [common.frenascache:115] FreeNAS_BaseCache._init__: leave
Oct 18 14:16:19 freenasRA uwsgi: [common.frenascache:315] FreeNAS_LDAP_QueryCache.__init__: leave
Oct 18 14:16:19 freenasRA uwsgi: [common.freenasldap:177] FreeNAS_LDAP_Directory.__init__: host = Name_server.AD_Domain.mcr, port = 636, binddn = freenas_user@AD_Domain.mcr, basedn = None, ssl = on
Oct 18 14:16:19 freenasRA uwsgi: [common.freenasldap:179] FreeNAS_LDAP_Directory.__init__: leave
Oct 18 14:16:19 freenasRA uwsgi: [common.freenasldap:277] FreeNAS_LDAP_Directory.open: enter
Oct 18 14:16:19 freenasRA uwsgi: [common.freenasldap:284] FreeNAS_LDAP_Directory.open: uri = ldaps://Name_server.AD_Domain.mcr:636
Oct 18 14:16:19 freenasRA uwsgi: [common.freenasldap:287] FreeNAS_LDAP_Directory.open: initialized
Oct 18 14:16:19 freenasRA uwsgi: [directoryservice.models:1036] ActiveDirectory: Unable to create kerberos realm: <built-in method set_option of LDAP object at 0x81c9854b8> returned a result with an error set
Oct 18 14:16:21 freenasRA uwsgi: [directoryservice.form:690] [ServiceMonitoring] Remove activedirectory service, frequency: 60, retry: 10
Oct 18 14:16:21 freenasRA uwsgi: [ws4py:360] Closing message received (1000) 'b'''


root@freenasRA:~ # wbinfo -t
checking the trust secret for domain AD_DOMAIN via RPC calls failed
wbcCheckTrustCredentials(AD_DOMAIN): error code was NT_STATUS_NO_SUCH_DOMAIN (0xc00000df)
failed to call wbcCheckTrustCredentials: WBC_ERR_AUTH_ERROR
Could not check secret
root@freenasRA:~ #
(I'm sure about password!)

Can somebody help me?
Thank you in advance and feel free to contact me for further information.
Carlo

 

[Artion]

What exact procedure did you follow?

 

[carlo5369]

I check that time is sync with Domain Controller
I register an A host freenasRA in dns
I create freenas_user in domain
I create a computer in AD FreenasRA associated to freenas_user
Put dns address in freenas
InDirectory\ActiveDirecory
domain name: AD_Domain.mcr
Domain account freenas_user (I also try with Domain Administrator)
Password ***** (checked twice!)
Enable X
Save ....

 

[carlo5369]

I've just retry and now on the web page appears

• returned a result with an error set

after pushing Save

 

[carlo5369]

I click everywhere ...
in ldap I've this error message
Notice: samba extensions not detected. CIFS authentication to LDAP disabled.
????

 

[dlavigne]

See the NOTE at http://doc.freenas.org/11/directoryservice.html#ldap.

 

[Artion]

I check that time is sync with Domain Controller
I register an A host freenasRA in dns
I create freenas_user in domain
I create a computer in AD FreenasRA associated to freenas_user
Put dns address in freenas
InDirectory\ActiveDirecory
domain name: AD_Domain.mcr
Domain account freenas_user (I also try with Domain Administrator)
Password ***** (checked twice!)
Enable X
Save ....

Other than making FN synchronize time with the domain and make sure it resolves domain names and vice versa (that means make FN to use the same NTP and DNS server as the domain, and this last has an entry for FN) the only thing you need is a domain user that has the permission to join computers to the domain (does the user you created?).

Also on the manual:

 

[carlo5369]

Hi Artion
yes seems everything ok
From FN
root@freenasRA:~ # nslookup
> freenasra
Server: 10.34.0.50
Address: 10.34.0.50#53

Name: freenasra.Ad_Domain.mcr
Address: 10.34.0.10
> AD_DOMAIN
;; Got SERVFAIL reply from 10.34.0.50, trying next server
Server: 10.34.0.1
Address: 10.34.0.1#53

** server can't find AD_Domain10.34.: SERVFAIL
> AD_Domain.mcr
Server: 10.34.0.50
Address: 10.34.0.50#53

Name: AD_Domain.mcr
Address: 10.34.0.50
Name: ravennaprocura.mcr
Address: 10.34.0.1

> 10.34.0.50
Server: 10.34.0.50
Address: 10.34.0.50#53

50.0.34.10.in-addr.arpa name = xxx-ns-192.AD_domain.mcr.
From a Pc
C:\Users\sys>ping freenasra

Esecuzione di Ping freenasra.AD_domain.mcr [10.34.0.10] con 32 byte di dati:
Risposta da 10.34.0.10: byte=32 durata<1ms TTL=64
Risposta da 10.34.0.10: byte=32 durata<1ms TTL=64
Risposta da 10.34.0.10: byte=32 durata<1ms TTL=64
Risposta da 10.34.0.10: byte=32 durata<1ms TTL=64

Statistiche Ping per 10.34.0.10:
Pacchetti: Trasmessi = 4, Ricevuti = 4,
Persi = 0 (0% persi),
Tempo approssimativo percorsi andata/ritorno in millisecondi:
Minimo = 0ms, Massimo = 0ms, Medio = 0ms


Sys is my "super user" with admin rights (I've also try with Domain Administrator)
...
grazie e buona giornata

 

[Artion]

grazie e buona giornata

perciò era simile a questa :p

se pensi che il problema è risolto puoi impostare il thread come Solved? vedi nella mia firma come fare ;)

 

[carlo5369]

(continuo in inglese per il "pubblico")
The problem still remain.
I try commands in section 9.1.2 that you suggest and the result was "1".

I report a bug, and support ask me for the logs.

Meanwhile i have a v9.X .... try to join another domain and (obviously) everithing goes ok

 

[carlo5369]

Just some rows to close the topic.
I need to go in production so I reset the nas start a configuration from "blank" and joined AD correctly.

Suggested docs from Artion where very useful (italians do it better!)
I mark as solved the tread.
Thank you to all for support
Carlo
just for your information I still have a ticket open with "bug reports"