How to use samba using LDAP user authentication on RHEL5?

Mike Bleiweiss schreef:
> On Tue, 30 Dec 2008 11:09:52 +0100
> Jan Gerrit Kootstra <jan.gerrit DeleteThis @kootstra.org.uk> wrote:
>
>
>> Can anyone of you point me to a "simple" howto?
>
> Are you wanting to authenticate against LDAP hosted on RHEL, or authenticate against a Windows AD? If the former - here's a decent howto:
>
> http://pbraun.nethence.com/doc/net/samba-ldap.html
>
>
Dear Mike,


I want to authenticate against LDAP hosted on RHEL.
I tried this howto already, but it fails.
I get errors like this:

[2009/01/01 17:48:47, 0] auth/auth_util.c:create_builtin_administrators(792)
create_builtin_administrators: Failed to create Administrators
[2009/01/01 17:48:47, 0] auth/auth_util.c:create_builtin_users(758)
create_builtin_users: Failed to create Users
[2009/01/01 17:48:47, 0] auth/auth_util.c:create_builtin_administrators(792)
create_builtin_administrators: Failed to create Administrators
[2009/01/01 17:48:47, 0] auth/auth_util.c:create_builtin_users(758)
create_builtin_users: Failed to create Users


Kind regards,


Jan Gerrit Kootstra

On Fri, 02 Jan 2009 11:15:54 +0100
Jan Gerrit Kootstra <jan.gerrit.RemoveThis@kootstra.org.uk> wrote:

> I get errors like this:
>
> [2009/01/01 17:48:47, 0] auth/auth_util.c:create_builtin_administrators(792)
> create_builtin_administrators: Failed to create Administrators
> [2009/01/01 17:48:47, 0] auth/auth_util.c:create_builtin_users(758)
> create_builtin_users: Failed to create Users
> [2009/01/01 17:48:47, 0] auth/auth_util.c:create_builtin_administrators(792)
> create_builtin_administrators: Failed to create Administrators
> [2009/01/01 17:48:47, 0] auth/auth_util.c:create_builtin_users(758)
> create_builtin_users: Failed to create Users

Check your smb.conf file - what value do you have for "idmap backend"? There is a problem with winbind with certain values for idmap backend that bork up "builtin" group creation. Save what you have for that value, set it back to "idmap backend = tdc", run "net sam createbuiltingroup", then go back into smb.conf and put idmap backend back to what it was before. After that, restart samba and winbind.

I hope that works out for you.

--
Mike Bleiweiss
Devout Unixophile

On Fri, 02 Jan 2009 22:18:58 +0100
Jan Gerrit Kootstra <jan.gerrit DeleteThis @kootstra.org.uk> wrote:

> net sam createbuiltingroup Administrators
> Creating Administrators failed with NT_STATUS_ACCESS_DENIED

Can you post your smb.conf and the output of smbstatus and testparm?




--
Mike Bleiweiss
Devout Unixophile

Mike Bleiweiss schreef:
> On Fri, 02 Jan 2009 11:15:54 +0100
> Jan Gerrit Kootstra <jan.gerrit.TakeThisOut@kootstra.org.uk> wrote:
>
>> I get errors like this:
>>
>> [2009/01/01 17:48:47, 0] auth/auth_util.c:create_builtin_administrators(792)
>> create_builtin_administrators: Failed to create Administrators
>> [2009/01/01 17:48:47, 0] auth/auth_util.c:create_builtin_users(758)
>> create_builtin_users: Failed to create Users
>> [2009/01/01 17:48:47, 0] auth/auth_util.c:create_builtin_administrators(792)
>> create_builtin_administrators: Failed to create Administrators
>> [2009/01/01 17:48:47, 0] auth/auth_util.c:create_builtin_users(758)
>> create_builtin_users: Failed to create Users
>
> Check your smb.conf file - what value do you have for "idmap backend"? There is a problem with winbind with certain values for idmap backend that bork up "builtin" group creation. Save what you have for that value, set it back to "idmap backend = tdc", run "net sam createbuiltingroup", then go back into smb.conf and put idmap backend back to what it was before. After that, restart samba and winbind.
>
> I hope that works out for you.
>
Mike,


This is what I get:

net sam createbuiltingroup Administrators
Creating Administrators failed with NT_STATUS_ACCESS_DENIED


Kind regards,


Jan Gerrit Kootstra

On Sat, 03 Jan 2009 10:12:54 +0100
Jan Gerrit Kootstra <jan.gerrit.TakeThisOut@kootstra.org.uk> wrote:

> Here is the smbstatus output:

Hmmm... everything looks okay. I'm left scratching my head.

Question: when you had LDAP set up on this box before, did you use the same domain/workgroup name?

Also, how are your group mappings set up? What does "net groupmap list" give you?

If you need to redo your group mappings, there is a great web page at
http://www.mrp3.com/windows-to-unix-samba.html - it has tons of information on group
mappings and other related items, including a script to do the group associations for
you.


--
Mike Bleiweiss
Devout Unixophile

Mike Bleiweiss schreef:
> On Sat, 03 Jan 2009 10:12:54 +0100
> Jan Gerrit Kootstra <jan.gerrit.DeleteThis@kootstra.org.uk> wrote:
>
>> Here is the smbstatus output:
>
> Hmmm... everything looks okay. I'm left scratching my head.
>
> Question: when you had LDAP set up on this box before, did you use the same domain/workgroup name?
>
> Also, how are your group mappings set up? What does "net groupmap list" give you?
>
> If you need to redo your group mappings, there is a great web page at
> http://www.mrp3.com/windows-to-unix-samba.html - it has tons of information on group
> mappings and other related items, including a script to do the group associations for
> you.
>
>
Mike,


Thank you so for.

net groupmap list


The mapgroup.sh fails:

adding entry for group Domain Admins failed!
adding entry for group Domain Users failed!
adding entry for group Domain Guests failed!
No rid or sid specified, choosing a RID
Got RID 1013
adding entry for group Administrators failed!
No rid or sid specified, choosing a RID
Got RID 1014
adding entry for group Users failed!
No rid or sid specified, choosing a RID
Got RID 1015
adding entry for group Guests failed!
No rid or sid specified, choosing a RID
Got RID 1016
adding entry for group Power Users failed!
No rid or sid specified, choosing a RID
Got RID 1017
adding entry for group Account Operators failed!
No rid or sid specified, choosing a RID
Got RID 1018
adding entry for group System Operators failed!
No rid or sid specified, choosing a RID
Got RID 1019
adding entry for group Print Operators failed!
No rid or sid specified, choosing a RID
Got RID 1020
adding entry for group Backup Operators failed!
No rid or sid specified, choosing a RID
Got RID 1021
adding entry for group Replicators failed!

So I am as puzzled as you are.

I use the same domain/workgroupname.


Kind regards,


Jan Gerrit Kootstra