[Samba] Openldap + Samba 3 PDC

[David Sonenberg]

I'm trying to get Samba up but I can't seem to get the LDAP connection
working correctly.  I can run a search from ldapsearch, but samba is
complaining that it can't connect.  

Here's the error from log.smbd
[2004/12/29 16:04:04, 0] lib/smbldap.c:smbldap_connect_system(850)
  failed to bind to server with dn= cn=Manager Error: Invalid
credentials
     
[2004/12/29 16:04:04, 1] lib/smbldap.c:another_ldap_try(990)
  Connection to LDAP server failed for the 1 try!


my smb.conf file:

[global]
interfaces = eth0 10.1.0.143/24
workgroup = STROZTEST
netbios name = AUTH
passdb backend = ldapsam:ldaps://10.1.0.143:636
username map = /etc/samba/smbusers
printcap name = cups
add user script = /usr/local/samba/sbin/smbldap-useradd.pl -m '%u'
delete user script = /usr/local/samba/sbin/smbldap-userdel.pl %u
add group script = /usr/local/samba/sbin/smbldap-groupadd.pl -p '%g'
delete group script = /usr/local/samba/sbin/smbldap-groupdel.pl '%g'
add user to group script = /usr/local/samba/sbin/ \
smbldap-groupmod.pl -m '%g' '%u'
delete user from group script = /usr/local/samba/sbin/ \
smbldap-groupmod.pl -x '%g' '%u'
set primary group script = /usr/local/samba/sbin/ \
smbldap-usermod.pl -g '%g' '%u'
add machine script = /usr/local/samba/sbin/smbldap-useradd.pl -w '%u'
logon script = scripts\logon.bat
logon path = \\%L\Profiles\%U
#logon drive = H:
#logon home = \\%L\%U
domain logons = Yes
os level = 35
preferred master = Yes
domain master = Yes
ldap suffix = dc=strozllc,dc=com
ldap machine suffix = ou=People
ldap user suffix = ou=People
ldap group suffix = ou=People
ldap idmap suffix = ou=People
ldap admin dn = cn=Manager
ldap ssl = yes
ldap passwd sync = Yes
idmap uid = 15000-20000
idmap gid = 15000-20000
winbind separator = +
#printing = cups


and my slapd.conf file:

# See slapd.conf(5) for details on configuration options.
# This file should NOT be world readable.
#
include      /etc/openldap/schema/core.schema
include      /etc/openldap/schema/cosine.schema
include      /etc/openldap/schema/inetorgperson.schema
include      /etc/openldap/schema/nis.schema
include      /etc/openldap/schema/samba.schema


# Define global ACLs to disable default read access.

# Do not enable referrals until AFTER you have a working directory
# service AND an understanding of referrals.
#referral   ldap://root.openldap.org

pidfile      /var/openldap/run/slapd.pid
argsfile   /var/openldap/run/slapd.args

# Load dynamic backend modules:
# modulepath   /usr/sbin/openldap
# moduleload   back_bdb.la
# moduleload   back_ldap.la
# moduleload   back_ldbm.la
# moduleload   back_passwd.la
# moduleload   back_shell.la

# Sample security restrictions
#   Require integrity protection (prevent hijacking)
#   Require 112-bit (3DES or better) encryption for updates
#   Require 63-bit encryption for simple bind
# security ssf=1 update_ssf=112 simple_bind=64

# Sample access control policy:
#   Root DSE: allow anyone to read it
#   Subschema (sub)entry DSE: allow anyone to read it
#   Other DSEs:
#      Allow self write access
#      Allow authenticated users read access
#      Allow anonymous users to authenticate
#   Directives needed to implement policy:
# access to dn.base="" by * read
# access to dn.base="cn=Subschema" by * read
# access to *
#   by self write
#   by users read
#   by anonymous auth
#
# if no access controls are present, the default policy
# allows anyone and everyone to read anything but restricts
# updates to rootdn.  (e.g., "access to * by * read")
#
# rootdn can always read and write EVERYTHING!

# allow the "ldap admin dn" access, but deny everyone else
#access to attrs=lmPassword, ntPassword
#   by dn="cn=Samba Admin,ou=People,dc=strozllc,dc=com" write
#   by * none

#######################################################################
# BDB database definitions
#######################################################################

database   bdb
suffix      "dc=strozllc,dc=com"
rootdn      "cn=Manager,dc=strozllc,dc=com"
# Cleartext passwords, especially for the rootdn, should
# be avoid.  See slappasswd(8) and slapd.conf(5) for details.
# Use of strong authentication encouraged.
# Change password with 'slappasswd -h {Md5}'

rootpw      {MD5}xxxxxxxxxxxxxxxxxxxxxxxxxxxx
# The database directory MUST exist prior to running slapd AND
# should only be accessible by the slapd and slap tools.
# Mode 700 recommended.
directory   /var/openldap/openldap-data

# Use crypt to has the passwords
#password-hash {crypt}

# Define SSL and TLS properties
TLSCertificateFile    /etc/ssl/ldap.pem
TLSCertificateKeyFile   /etc/openldap/ssl/ldap.pem
TLSCACertificateFile   /etc/ssl/ldap.pem

# Indices to maintain

index   objectClass      eq
index   cn         pres,sub,eq
index   sn         pres,sub,eq
index   uid         pres,sub,eq
index   displayName      pres,sub,eq
index   uidNumber      eq
index   gidNumber      eq
index   memberUid      eq
index   sambaSID      eq
index   sambaPrimaryGroupSID   eq
index   sambaDomainName      eq
index   default         sub   

#######################################################################
# replication via slurpd(8)
#######################################################################

# master server configuration
#replogfile      /var/openldap/openldap-slurp
#replica-pidfile /var/openldap/slurpd.pid
#replica         host=slave.example.com:389
#                binddn="cn=admin,dc=example,dc=org"
#                bindmethod=simple credentials=secret

# slave server(s) configuration
#updatedn        "cn=admin,dc=example,dc=org"
#updateref       ldap://master.example.org


David Sonenberg
Systems / Network Administrator
Stroz Friedberg, LLC
15 Maiden Lane, Suite 1208
New York, NY  10038
212.981.6527 (o)  |  917.495.4918 (c)