Yrurtj

I followed this site's tutorial to install SSSD (without WinBind) to join a Windows Server 2008 domain. And it is a great success. Before that I was trying to use Zentyal to set up share folders but no luck ... Zentyal always show errors ...

I wanted to use GUI to complete the job but when I failed in Webmin Samba and Zentyal, the only option I left is to set up one by one with command, and implement the smb.conf by hand. Luckily the tutorial can join the domain without any problems, and I can setup the Samba share.

Here is the smb.conf

[global]

        workgroup = ADDOMAIN

        server string = Samba Server Version %v

        security = ads

        # encrypt passwords = yes

        # passdb backend = tdbsam

        idmap config * : backend = tdb

        realm = addomain.tld

        access based share enum = yes



        # this is just a member server

        domain master = no

        local master = no

        preferred master = no



        # in my test network I could not get AD authentication for smb shares to work

        # without adding "kerberos method = secrets and keytab"

        kerberos method = secrets and keytab



        # Add the IPs / network ranges / subnets allowed acces to the server in general.

        # this is not a nesessary entry but in general a good idea.

        # hosts allow = 127. your local network info



        # log files split per-machine:

        log file = /var/log/samba/log.%m



        # enable the following line to debug:

        # log level = 3

        # maximum size of 50KB per log file, then rotate:

        max log size = 50



        # Not interested in printers

        load printers = no

        cups options = raw



        # This stops an annoying message from appearing in logs

        printcap name = /dev/null



        # File Shares under valid users I put a group if you create a group for samba in # active directory and add users to it those users will be able to access smb

        # shares from this server over the network.



[guest]

        comment = guest

        path = /home/samba/guest

        public = yes

        readonly = no

        writable = yes

        guest ok = yes



[admin]

        comment = admin

        path = /home/samba/admin

        public = no

        readonly = no

        writable = yes

        guest ok = no

        valid users = @"admingp@addomain.tld"

There is a user, ADDOMAINadmintest (or admintest@addomain.tld) login a Windows PC and try to access the "Admin" share folder but couldn't grant access. The log says "NT_STATUS_ACCESS_DENIED". But I am sure that the account is in the group.

To make sure the AD and the user info is synced to my CentOS 7, I changed the valid users from @"admingp@addomain.tld" to "admintest@addomain.tld". The user can access the share folder.

Then what I tried to troubleshoot is, use the id command. I have modified the sssd.conf no need to use full qualified name. So ...

# id admintest



  uid=821800500(admintest) gid=821800513(domain users) groups=821800513(domain users)

This is simply strange. Yeah this account is in the domain users but it still have some other groups which belong to including the "admingp".

Then I used the "getent" command to show group members.

# getent group admingp

  admingp:*:821808307:administrator,admintest,ben, ... (etc)

There it is, admintest is in the group. Because it also in the domain users group and I try again to modify the smb.conf, the valid users changed to @"domain users@addomain.tld" and guess what? The share folder is accessible.

So I can conclude that the smb.conf is fine, the AD authentication is fine. But as you noticed, id admintest only displays the first matched group. The others are skipped so I can't set the share folder with Group Permission. And I have dozens of groups and dozens of share folders there I can't simply implement it one by one.

And I final test for the id command. The Linux account "support" belongs to 2 groups. One is "support" itself and the other is "wheel".

# id support

  uid=1000(support) gid=1000(support) groups=1000(support),10(wheel)

Linux users aren't affected. So ... what went wrong? I have attached the sssd.conf here. Please have a look.

[sssd]

domains = addomain.tld

config_file_version = 2

services = nss, pam



[domain/addomain.tld]

ad_domain = addomain.tld

krb5_realm = ADDOMAIN.TLD

realmd_tags = manages-system joined-with-samba

cache_credentials = True

id_provider = ad

krb5_store_password_if_offline = True

default_shell = /bin/bash

ldap_id_mapping = True



# use_fully_qualified_names = True

# fallback_homedir = /home/%u@%d



use_fully_qualified_names = False

fallback_homedir = /home/%u



enumerate = True

access_provider = simple

# access_provider = ldap

Thanks very much in advanced.

I have same issue here... Finally I use the winbind instead of sssd for samba share and AD joining...