LDAP Authentification with Samba

[Mouftik]

Hello All,

I have currently an issue with migrating my FreeNAS from internal list of users to a LDAP Server which I used for a while but you know ... no time for migration :D !

So, Before doing something stupid, I have installed a version of FreeNAS to test if my services were working ... And I was right to test it before.
My LDAP is currently configured as a tree of groups (+sub-groups) and users (And not OU=Users/Ou=Groups). I also configured it for SSL/TLS because as far as I have seen, it was mandatory for FreeNAS (BTW it's a good point) and installed LDAP Schema in it.
I was hopping that with all of my effort, all would work seamless :(

After testing, I am able to login via SSH with multiple users, I also can connect through AFP with the same users, but Samba is giving me headache !!
For what I noticed, my LDAP configuration is right (because working in AFP & SSH, and I checked the Samba Schema in FreeNAS LDAP Config) so should be an SMB problem, but with Samba Schema ... What's the difference ...

I configured SMB logs and get this in log.smdb :
[2016/12/21 11:45:27.743604, 2] ../source3/smbd/server.c:576(remove_child_pid)
Could not find child 35012 -- ignoring
[2016/12/21 11:47:12.407722, 2] ../source3/param/loadparm.c:2689(lp_do_section)
Processing section "[Test]"
[2016/12/21 11:47:12.408839, 2] ../source3/lib/smbldap.c:794(smbldap_open_connection)
smbldap_open_connection: connection opened
[2016/12/21 11:47:12.426619, 2] ../source3/auth/auth.c:315(auth_check_ntlm_password)
check_ntlm_password: Authentication for user [testuser] -> [testuser] FAILED with error NT_STATUS_NO_SUCH_USER
[2016/12/21 11:47:12.556656, 2] ../source3/param/loadparm.c:2689(lp_do_section)
Processing section "[Test]"
[2016/12/21 11:47:12.558180, 2] ../source3/auth/auth.c:315(auth_check_ntlm_password)
check_ntlm_password: Authentication for user [testuser] -> [testuser] FAILED with error NT_STATUS_NO_SUCH_USER

log.nmdb
[2016/12/21 11:46:57.724488, 0] ../source3/nmbd/nmbd_packets.c:1174(process_lanman_packet)
process_lanman_packet: Discarding datagram from IP 10.0.1.56. Source name FREENAS<00> is one of our names !

If any of you have ideas, they are welcome :D

 

[dlavigne]

Were you able to resolve this?

 

[Mouftik]

With this architecture (without ou=groups & ou=users) I didn't found any solution.
In fact I've redone a replica from my LDAP but this time including Samba Schema and using the smbldap-tools (which generate proper samba stuff all around :() and this time AFP & SMB was working.
I wanted to have a "clean" LDAP with all this Samba stuff, but I think that I must use the proper way to configure samba with tools to match what windows server do in AD. So if I want to be able to connect through SMB, my LDAP need to be 'converted' to samba style.

I also found that it would be possible to configure the Samba service to just ask LDAP for UNIX authorization (UID/GUI/ maybe ACL) and retain everything else internally to the service, which would be a wonderful solution. But I didn't test this way, don't want to configure a lot of samba by hand in FreeNAS at this point.

PS : I figure out that FreeNAS 10 will use another way to handle authentication, so maybe this would be a solution for me ?