1:43 p.m.
Hello everyone,
I am attempting to setup a samba file server that uses IPA as a proxy
to authentication AD users. I am using the document below as a
template but its not working as currently documented. I am wondering
if something has changed on the code since that time but the doc
hasn't had any update.
https://www.freeipa.org/page/Howto/Integrating_a_Samba_File_Server_With_IPA
For the samba client, this is the version of binaries that I am using:
[root@samba4 ~]# rpm -qa | grep samba
samba-common-tools-4.7.1-6.el7.x86_64
samba-common-libs-4.7.1-6.el7.x86_64
samba-common-4.7.1-6.el7.noarch
samba-4.7.1-6.el7.x86_64
samba-client-libs-4.7.1-6.el7.x86_64
samba-client-4.7.1-6.el7.x86_64
samba-libs-4.7.1-6.el7.x86_64
For IPA server, this is the version I am running:
ipa-server-4.5.4-10.el7_5.1.x86_64
There is a trust relationship between the IPA and the Active
directory. The AD is on corp.example.com domain and the IPA is on
eng.example.com. When I point any of the IPA clients to
\\samba4.eng.example.com, all works as expected. However, when I
point any of the AD clients (Windows 10) to \\samba4.eng.example.com,
I am not having any joy. After parsing the logs, the section below
looks like the most relevant part of the logs. What would cause this
issue? Any pointer on how to overcome it would be highly appreciated.
Another odd thing is, if I enroll a RHEL 7 system to AD, and then
attempt to browse the samba share, everything works fine.
I have shared the full logs on the following link too.
https://pastebin.com/wrycv1UR
Regards,
William
[2018/06/13 13:42:20.963867, 5, pid=14330, effective(0, 0), real(0,
0)] ../auth/gensec/gensec_start.c:739(gensec_start_mech)
Starting GENSEC mechanism spnego
[2018/06/13 13:42:20.963942, 5, pid=14330, effective(0, 0), real(0,
0)] ../auth/gensec/gensec_start.c:739(gensec_start_mech)
Starting GENSEC submechanism gse_krb5
[2018/06/13 13:42:20.964334, 10, pid=14330, effective(0, 0), real(0,
0)] ../lib/krb5_wrap/krb5_samba.c:1326(smb_krb5_kt_open_relative)
smb_krb5_open_keytab: resolving: FILE:/etc/samba/samba.keytab
[2018/06/13 13:42:20.965559, 10, pid=14330, effective(0, 0), real(0,
0)] ../source3/smbd/smb2_server.c:3011(smbd_smb2_request_done_ex)
smbd_smb2_request_done_ex: idx[1] status[NT_STATUS_OK] body[64]
dyn[yes:96] at ../source3/smbd/smb2_negprot.c:657
[2018/06/13 13:42:20.965625, 10, pid=14330, effective(0, 0), real(0,
0)] ../source3/smbd/smb2_server.c:923(smb2_set_operation_credit)
smb2_set_operation_credit: requested 1, charge 1, granted 1, current
possible/max 512/512, total granted/max/low/range 1/8192/2/1
[2018/06/13 13:42:35.997960, 10, pid=14330, effective(0, 0), real(0,
0)] ../source3/smbd/smb2_server.c:1080(smbd_server_connection_terminate_ex)
smbd_server_connection_terminate_ex: conn[ipv4:192.168.11.108:61944]
reason[NT_STATUS_CONNECTION_RESET] at
../source3/smbd/smb2_server.c:3935
[2018/06/13 13:42:35.998102, 4, pid=14330, effective(0, 0), real(0,
0)] ../source3/smbd/sec_ctx.c:320(set_sec_ctx_internal)
setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
[2018/06/13 13:42:35.998142, 5, pid=14330, effective(0, 0), real(0,
0)] ../libcli/security/security_token.c:53(security_token_debug)
Security token: (NULL)
[2018/06/13 13:42:35.998174, 5, pid=14330, effective(0, 0), real(0,
0)] ../source3/auth/token_util.c:651(debug_unix_user_token)
UNIX token of user 0