Samba and ldap problem

dany4j · 07-06-2008, 02:11 PM

Hello,

I have a problem with samba and ldap. I configured samba as PDC backended by ldap. everything is ok until I try to join the domain on one XP Pro station (both - Linux Cent OS and win XP Pro - virtualized - if counts). On Windows I get that messages "The user name could not be found" but on Linux everything is working OK apparently because the station is added on ldap. The problem that I found searching (google) is that in ldap there is no SambaSAMAccount object. This is my problem how can be that fixed?

Thank you in advance.

bathory · 07-07-2008, 07:10 AM

The sambaSamAccount objectclass is defined in samba.schema, so make sure you have included this schema file in your slapd.conf

Regards

dany4j · 07-07-2008, 09:39 AM

Hello Bathory,

it's included

Code:

include         /etc/openldap/schema/core.schema
include         /etc/openldap/schema/cosine.schema
include         /etc/openldap/schema/inetorgperson.schema
include         /etc/openldap/schema/nis.schema
include         /etc/openldap/schema/samba.schema
allow bind_v2
pidfile         /var/run/openldap/slapd.pid
argsfile        /var/run/openldap/slapd.args
database        bdb
suffix          "dc=speranta,dc=eu"
rootdn          "cn=Manager,dc=speranta,dc=eu"
rootpw          {SSHA}+GdCUnxTSVRyAUrk3gbhuilO23xY99HQ
directory       /var/lib/ldap
index    sambaSID    eq
index    sambaPrimaryGroupSID    eq
index    sambaDomainName    eq
index objectClass,uid,uidNumber,gidNumber,memberUid eq
index cn,mail,surname,givenname   eq,subinitial
access to attrs=userPassword,sambaLMPassword,sambaNTPassword
    by self write
    by anonymous auth
    by * none
access to *
    by * read

Thank you for the reply.

bathory · 07-08-2008, 01:59 AM

Maybe you're using a samba 2.x schema that has not this objectclass defined. You can take a look at this howto for more details.

Regards

dany4j · 07-08-2008, 02:21 AM

Hello bathory,

As I remember the samba scheme I copied it from /usr/share/doc/samba-3.0.28/LDAP/..... I don't have access to check from here (I'm at work) but I'll check when I get home. I installed with yum so I guessed that is up to date.

Is there anything else I should check?

When joining a workstation is there something I should do before?

Thank you.

bathory · 07-08-2008, 05:40 AM

You can read this howto and especially the steps 13, 14 on the 3rd page to join a windows client to samba/openldap.

Regards

dany4j · 07-08-2008, 09:44 AM

Hi,

I think I found something but I don't know how to "fix" it in smbldap-useradd or where I must change.

So, I noticed looking at the database with Ldapadmin that the ou=Computers contains an entry uid=STATION01$ ... BUT with the USER ICON not the computer icon so I delete it an right click on ou=Computers selected New -> Computer... and entered the name of the station "station01" then I choose the domain from the drop down list a.n then OK. Now I have an entry uid=STATION01$ whit computer icon. I went to mai workstation an added normally to the domain ... and ... surprise ... it works "Welcome to speranta domain."

So, I think smbldap-useradd -w %u creates an user account in computers and from there comes the problem. At least this is how I think.

If this is the problem how can I fix it so when I join the domain the smbldap-useradd -w to add an Computer object not a User object?

This is the smb.conf scripts i case u want to see if it's correct

Code:

add user script = /etc/opt/IDEALX/smbldap-tools/smbldap-useradd -m '%u'
delete user script = /etc/opt/IDEALX/smbldap-tools/smbldap-userdel '%u'
add group script = /etc/opt/IDEALX/smbldap-tools/smbldap-groupadd -p '%g'
delete group script = /etc/opt/IDEALX/smbldap-tools/smbldap-groupdel '%g'
add user to group script = /etc/opt/IDEALX/smbldap-tools/smbldap-groupmod -m '%u' '%g'
delete user from group script = /etc/opt/IDEALX/smbldap-tools/smbldap-groupmod -x '%u' '%g'
set primary group script = /etc/opt/IDEALX/smbldap-tools/smbldap-groupmod -g '%g' '%u'
add machine script = /etc/opt/IDEALX/smbldap-tools/smbldap-useradd -w '%u'

Thank you for your answers.

bathory · 07-09-2008, 02:53 AM

There are known problems with smbldap-tools depending on the various versions of the tools, samba and windows clients. You should try the "add machine" script from command line to find the correct options. Perhaps you can try:

Code:

add machine script = /usr/sbin/smbldap-useradd -w -a -H "[W]" "%u"

according to this post.

dany4j · 07-09-2008, 03:03 AM

Thank you bathory for the reply I'll test it when I get home.

Have a nice day.

dany4j · 07-09-2008, 04:05 PM

Hi bathory,

I managed to make it work somehow, The modification I made were to smb.conf

Code:

add machine script = /etc/opt/IDEALX/smbldap-tools/smbldap-useradd -i '%u'

to smbldap-useradd I comented out the if statement with option i (line 225 to my file)

Code:

########################

# MACHINE ACCOUNT
if (defined($Options{'w'}) or defined($Options{'i'})) {

  #print "About to create machine $userName:\n";                                                                                                             
  if (!add_posix_machine ($userName,$userUidNumber,$userGidNumber,$Options{'t'})) {
    die "$0: error while adding posix account\n";
  }

#  if (defined($Options{'i'})) {

(of course the ending "}" too - line 267)

and modified "I" with "W" in account flags

Code:

add => [sambaAcctFlags => '[I          ]'],

with

Code:

add => [sambaAcctFlags => '[W          ]'],

The only problem I have now is that first time I add the station to the domain I get the same error (The user name could not be found), but the uid=station01$ is successfully created in the ou=Computers, and if I add again the station to the domain it joins. is there a way to delay the check of station01$ object. Otherwise said ... to check it after it was created so, that will be ok and hopefully will join from the first try.

If what I did (modifications) is wrong please tell me but for now is the only way I made the smbldap-tools add the computer corectly.

With respect,
Dani

P.S. I tried

Code:

add machine script = /usr/sbin/smbldap-useradd -w -a -H "[W]" "%u"

but didn't work for me ... same user icon

bathory · 07-10-2008, 01:57 AM

AFAIK it's a known bug (feature?) of smbldap-tools. Read this to see how you can join a windows box to samba. Or use lam
As for the delay, you can use the "-t" option:

Quote:

-t time. Wait 'time' seconds before exiting (when adding Windows Workstation)

Regards

dany4j · 07-10-2008, 02:39 AM

Thank you bathory for your reply,

Using lam is a solution but not a good one at least for the sake of automation because if I implement a PDC to some company every time they reinstall win* (and/or change the station name) they have to call me? I'm telling this knowing that this is possible to add the station automaticaly without those manual steps.

Adding automaticaly, like that in the tutorial, without modification of those files (my previous post) it's not possible, I receive the same error "The user name could not be found" and a user object is created.

I had tried this morning (I'm beginning to have nightmares

) the -t (tried -t 10 ) and same result "the user name...."

I will try today to install samba from source (not with yum) and try version 3.2.0 (now I have 3.0.28) and smbldap-tools the latest version (I thought that nobody develops anymore smbldap-tools but this morning I found the site of the new developers HERE and HERE).

Thank you again for your time and answers. If you find a new solution ... I'm happy to hear it 'cause like I told you ... the nightmares are coming ...

With respect,
Dani

dany4j · 07-19-2008, 04:35 AM

Hello all,
I came back to post an answer for those who have the same problem. The way I fixed the problem is by upgrading smbldap-tools (at this time 0.9.5) and in machine add script -w is -W (capitalized) as u can see in smbldap-useradd --help

The only problem witch I still have is that the first time I try to join machine I receive an error with "user name could not be found" but after I retry ... it joins.

Have a nice day.

P.S. I don't know if it counts but I copied samba.schema from samba 3.2.0 source package (the samba on the server is still 3.0.28)