Set permissions on Samba shares using Active Directory

[kalero]

Hi,

for the first time, I recently installed FreeNAS latest version (11.2-U4) on a RAID for my company and it should share some Windows directories with permissions for users from two Active Directories. I already set FreeNAS for working with our Active Directories but I notice something strange: if I go to a shell and enter "wbinfo -u", I only get the user list of one Active Directory (let's say server1), but if I enter "getent passwd", I get the user list of both Active Directories (let's say server1 and server2), and in the FreeNAS web interface, in Accounts -> Users, I only see the FreeNAS local users.

With that, when I create a Samba share, I don't see where to set users and permissions, there's any section to set them.

Maybe it's a dumb question, but I'm new on FreeNAS, so some help would be so appreciated. Thanks.

 

[anodos]

Hi,

for the first time, I recently installed FreeNAS latest version (11.2-U4) on a RAID for my company and it should share some Windows directories with permissions for users from two Active Directories. I already set FreeNAS for working with our Active Directories but I notice something strange: if I go to a shell and enter "wbinfo -u", I only get the user list of one Active Directory (let's say server1), but if I enter "getent passwd", I get the user list of both Active Directories (let's say server1 and server2), and in the FreeNAS web interface, in Accounts -> Users, I only see the FreeNAS local users.

With that, when I create a Samba share, I don't see where to set users and permissions, there's any section to set them.

Maybe it's a dumb question, but I'm new on FreeNAS, so some help would be so appreciated. Thanks.

Accounts->Users only shows local users. Depending on configuration, the permissions editor will have AD users in permissions dropdowns (and auto-completion). In all cases, if it's joined to AD, you can just type the User or Group prefixed with the domain name ("DOMAIN\User")

 

[kalero]

Accounts->Users only shows local users. Depending on configuration, the permissions editor will have AD users in permissions dropdowns (and auto-completion). In all cases, if it's joined to AD, you can just type the User or Group prefixed with the domain name ("DOMAIN\User")

Hi anodos, thanks for your answer. The problem is that there is no permissions editor when I edit a Samba share.

 

[anodos]

You edit the dataset permissions for the dataset underlying the share.

 

[kalero]

You edit the dataset permissions for the dataset underlying the share.

OK, I understand. Anyway, why the dropdowns are not being populated by AD's users and groups? What's the configuration in which that's depending on?

 

[anodos]

There's a checkbox in Directory Services-> Active Directory 'disable freenas cache' . It should be unchecked. Not populating may be an indication that your server is not joined to AD. You can check this by opening a shell and typing 'wbinfo -t'

 

[kalero]

There's a checkbox in Directory Services-> Active Directory 'disable freenas cache' . It should be unchecked. Not populating may be an indication that your server is not joined to AD. You can check this by opening a shell and typing 'wbinfo -t'

"Disable FreeNAS cache" was already unchecked, and if I enter "wbinfo -t" I get "checking the trust secret for domain MYDOMAIN via RPC calls succeeded", so I understand the FreeNAS is correctly joined to our AD. Anyway, I think it's strange "wbinfo -u" returns only users from one AD and "getent passwd" returns users from both ADs. One AD is MYDOMAIN and the other one is SUBDOMAIN.MYDOMAIN. Any idea?

 

[anodos]

"Disable FreeNAS cache" was already unchecked, and if I enter "wbinfo -t" I get "checking the trust secret for domain MYDOMAIN via RPC calls succeeded", so I understand the FreeNAS is correctly joined to our AD. Anyway, I think it's strange "wbinfo -u" returns only users from one AD and "getent passwd" returns users from both ADs. One AD is MYDOMAIN and the other one is SUBDOMAIN.MYDOMAIN. Any idea?

Have you enabled trusted domains? (There's a checkbox for that in the webui).

 

[kalero]

Have you enabled trusted domains? (There's a checkbox for that in the webui).

Yes, "Allow trusted domains" is checked. I'm attaching two screenshots with our FreeNAS' Active Directory configuration. Thanks.