1

I've recently set up a new Samba4 Active Directory to handle centralized authentication for my small office network. On this server is also a postgresql-9.5 instance, and I'm trying to have it authenticate against the AD. Recognizing the difference between authentication (this is what I need) and authorization (I believe this is handled entirely within postgresql once the user has been authenticated), I'm running into problems.

The AD is rather vanilla at the moment, closely following this howto. I've set up some users and the basic kerberos authentication appears to be working (done with kinit myusername@SAMDOM.MYDOMAIN.TLD, verified with klist). Similarly, smbclient //myhost.samdom.mydomain.tld/netlogon -U 'myusername' works.

The localhost is resolving to the samba AD and DNS forwarding is going upstream correctly. These work:

$ host -t SRV _ldap._tcp.samdom.mydomain.tld
$ host -t SRV _kerberos._udp.samdom.mydomain.tld
$ host -t A myhost.samdom.mydomain.tld

BTW: ubuntu-16.04 server, postgresql-9.5, samba-4.3.9

Question:

What am I missing in the configuration of samba and/or postgres to enable authentication against the AD?

DB Setup

Basic connectivity with postgresql appears to be good: it's listening on the appropriate interfaces (all for now), the postgres user can access things locally without a problem. I set up a simple database, output from \list:

   Name    |   Owner    | Encoding |   Collate   |    Ctype    |   Access privileges
-----------+------------+----------+-------------+-------------+-----------------------
 pgtest2   | myusername | UTF8     | en_US.UTF-8 | en_US.UTF-8 |

with users listed (per this query):

 User name  | User ID |    Attributes
------------+---------+-------------------
 myusername |   16384 | create database
 postgres   |      10 | superuser, create+
            |         | database

Failing Auth

However, when I try on the console:

$ psql -h myhost.samdom.mydomain.tld -U myusername@SAMDOM.MYDOMAIN.TLD -d pgtest2
psql: GSSAPI continuation error: Unspecified GSS failure.  Minor code may provide more information
GSSAPI continuation error: No Kerberos credentials available

From /var/log/postgresql/postgresql-9.5-main.log:

myusername@SAMDOM.MYDOMAIN.TLD@pgtest2 LOG:  could not receive data from client: Connection reset by peer
myusername@SAMDOM.MYDOMAIN.TLD@pgtest2 FATAL:  GSSAPI authentication failed for user "myusername@SAMDOM.MYDOMAIN.TLD"
myusername@SAMDOM.MYDOMAIN.TLD@pgtest2 DETAIL:  Connection matched pg_hba.conf line 92: "host all all 0.0.0.0/0 gss krb_realm=SAMDOM.MYDOMAIN.TLD include_realm=1 map=krb"

Config Files

The config file (portions) that I think are appropriate and necessary:

  • /etc/postgresql/9.5/main/pg_hba.conf:

    local   all             postgres                                peer
    local   all             all                                     peer
    host all all 0.0.0.0/0 gss krb_realm=SAMDOM.MYDOMAIN.TLD include_realm=1 map=krb
    host    all             all             127.0.0.1/32            md5
    host    all             all             ::1/128                 md5
    
  • /etc/postgresql/9.5/main/postgres.conf:

    krb_server_keyfile = '/var/lib/postgresql/9.5/main/postgres.keytab'
    

    (The keytab was generated with: samba-tool domain exportkeytab postgres.keytab -U postgres/myhost.samdom.mydomain.tld@SAMDOM.MYDOMAIN.TLD, is mode 400, and owned by postgres:postgres.)

  • /etc/samba/smb.conf:

    # Global parameters
    [global]
            workgroup = SAMDOM
            realm = SAMDOM.MYDOMAIN.TLD
            netbios name = MYHOST
            interfaces = lo eno1
            bind interfaces only = Yes
            server role = active directory domain controller
            dns forwarder = 11.22.33.254
            idmap_ldb:use rfc2307 = yes
            tls enabled =  yes
            tls keyfile = tls/key.pem
            tls certfile = tls/cert.pem
            tls cafile = tls/ca.pem
    [netlogon]
            path = /var/lib/samba/sysvol/samdom.mydomain.tld/scripts
            read only = No
    [sysvol]
            path = /var/lib/samba/sysvol
            read only = No
    
  • Comments are welcome on how to improve the question, what more to include, or other methods to facilitate discourse. (I wish I could provide more bounty from my SO account ...) – r2evans Jun 27 '16 at 21:17
1

Recently I faced the task of authentication of postgress users against samba4 AD domain controller and I found the solution in this page. As you can see, the pg_hba.conf entry in your case would be:

host all all 0.0.0.0/0 ldap ldapserver=localhost ldapprefix="" ldapsuffix="@SAMDOM.MYDOMAIN.TLD"

or if you prefer authenticate users in the form DOMAIN\username:

host all all 0.0.0.0/0 ldap ldapserver=localhost ldapprefix="SANDOM\" ldapsuffix=""

The rol must be created in the database in addition to AD because authorization mechanism, as you noted above, is done inside postgres. Then restart postgresql and try connection.

The downside is that you'll get the error "Strong(er) authentication required" in postgres log, so you must disable the Strong ldap authorization in samba conf file, adding this at global setcion:

ldap server require strong auth = No
  • Thanks Isidoro, I'll look into this a bit more. I'm not thrilled about decreasing "strong auth" in samba, so I need to read into the implications of that. – r2evans Apr 24 '18 at 19:35
  • BTW: stale link, since OpenSCG was purchased by Amazon and that page is now not right. Unless/until it is properly re-published, the web archive has it available from 2017 Nov 24. – r2evans Apr 24 '18 at 19:37
  • Thank you r2evans. I've updated the link to web.archive. – Isidoro Arroyo Barrantes Apr 26 '18 at 13:01
  • I should have accepted this a long time ago. I'm still not happy with the answer, but that's because of several of the nuances with Samba4 and ancillary authentication of other libraries/apps. I apologize for waiting so long to give you the credit, Isidoro. – r2evans Jan 7 at 3:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.