[Samba] Samba 4.19 and OpenLDAPs

[Shannon Price]

I had a side suggestion from a list member whether nslcd was a possibility, using winbind for the authentication and nslcd to get the rfc2307 attributes.  This was essentially my approach since nslcd and SSSD are performing the same role - connecting to an LDAP server for RFC2307.  I have SSSD working with RHEL.  RHEL has dropped NSLCD packages in favor of SSSD, but they are still available in Ubuntu, so there could be a path with Ubuntu serving Samba instead.

The Samba option "security = ads" and the net join establishes the authentication with AD, but I haven't been able to get the idmap to fall back to LDAP (except the klunky id_map = script that I mention below.  It seems like the ADS setting causes the idmap settings (e.g. idmap_ldap) to be ignored.

--
Shannon Price
Auburn University

-----Original Message-----
From: Shannon Price
Sent: Monday, May 12, 2025 4:42 PM
To: samba at lists.samba.org
Subject: RE: [Samba] Samba 4.19 and OpenLDAPs



I have this working using "idmap_script" for the idmapping (homegrown script).  I authenticate vs Active Directory and use SSSD to talk to OpenLDAP on the backend for group membership and posix attributes (homedir mostly).  My nsswitch.conf looks like this:


passwd:     sss files systemd
group:      sss files systemd

ID mapping is done very simply (my script is VERY short and for now uses a flat file for username-SID-UID user mapping).  Group memberships come from OpenLDAP.  It all looks very simple and clean.  Samba still tries to enumerate all of my group mappings.  It pulls all of my groups from Active Directory (which have no meaning in my Linux/Samba environment).  This means that my idmap script gets called over and over when I initially connect.  I had hoped that "winbind enum groups" would suppress this behavior, but it doesn't.

Winbind is running.  This is my smb.conf for reference:

[global]
        # workgroup and naming
        workgroup = UNIV

        # server settings
        interfaces = 127.0.0.1, xxx.xxx.xxx.xxx
        bind interfaces only = yes
        deadtime = 15
        strict locking = no
        lock directory = /var/spool/locks/samba

        # logging
        log file = /var/log/samba/log.smbd
        log level = 2
        max log size = 51200

        # authentication
        client max protocol = SMB3
        security = ads
        client signing = yes
        kerberos method = secrets and keytab
        realm = UNIV.EDU

        idmap config * : backend  = script
        idmap config * : range = 200-20000000
        idmap config * : script = /etc/samba/idmap.sh

        winbind enum groups = no

--
Shannon



-----Original Message-----
From: samba <samba-bounces at lists.samba.org> On Behalf Of Shannon Price via samba
Sent: Tuesday, May 6, 2025 11:54 AM
To: samba at lists.samba.org
Subject: Re: [Samba] Samba 4.19 and OpenLDAPs


If we use "security=user" (and idmap_rfc2307), we won't be able to authenticate against another source, right?  (e.g. an AD domain)?  The password would also need to come from Samba?

I saw an older posting from you about "idmap_script"  is that still a valid backend?  The man page exists, but I don't want to go down more deprecated rabbit holes.

--
Shannon

-----Original Message-----
From: samba <samba-bounces at lists.samba.org> On Behalf Of Rowland Penny via samba
Sent: Tuesday, May 6, 2025 11:50 AM
To: samba at lists.samba.org
Cc: Rowland Penny <rpenny at samba.org>
Subject: Re: [Samba] Samba 4.19 and OpenLDAPs

On Tue, 6 May 2025 16:31:29 +0000
Shannon Price via samba <samba at lists.samba.org> wrote:

>
> Sorry - my redaction was incomplete/incorrect in the smb.conf message.
> Corrected, redacted smb.conf below.  I need to authenticate against
> AD, which does work, but idmap vs LDAP server (OpenLDAP).

Samba cannot do that.

>
> Why wouldn't I see traffic between the Samba server and the LDAP
> server?  ("well there wouldn't be")

You have 'security = ads' , if you use this, Samba must be a domain member in an ADS realm, it requires Kerberos and Samba must be joined to the realm using 'net'.

To use idmap_rfc2307, you need to use 'security = user' and probably also SMBv1 (I have never used idmap_rfc2307, so am not sure about this, but normally using an ldap backend with Samba requires SMBv1 e.g. a PDC).

Different backends use different code paths in Samba.

Rowland

--
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

--
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba