1

I have multiple SLES 12.1 Servers which I joined into the AD Domain via net ads join -u <OU_MANAGER> osName='SLES' osVer='12.1' createcomputer="<OU1>/<OU2>/Servers. It is important to note that I only have an OU Manager Account for OU2 and do not manage the AD itself. The join finishes successful, but there is the typical DNS_GSS_ERROR which I can't fix since according to the Troubleshooting you need to be the AD admin. Nonetheless I joined the domain and when activating the option to allow login for domain users via YaST (somehow it does not work when I do the nsswitch.conf, pam and sshd settings myself) I can logon with the domain users.

The problem is I want to synchronize the UID/GID of the users, since they run decentral Java Applications and they are dependant on that.

My current /etc/samba/smb.conf looks as follows:

[global]
    workgroup = XXXX
    realm = XXXX.YYYY.NET

    security = ADS
    kerberos method = secrets and keytab

    template homedir = /home/%D/%U
    template shell = /bin/bash

    winbind refresh tickets = yes
    idmap gid = 19500-19999
    idmap uid = 19500-19999
    usershare allow guests = No
    winbind offline logon = yes

When I now try to change the idmap to the following

[global]
    workgroup = XXXX
    realm = XXXX.YYYY.NET

    security = ADS
    kerberos method = secrets and keytab

    template homedir = /home/%D/%U
    template shell = /bin/bash

    winbind refresh tickets = yes
    #idmap gid = 19500-19999
    #idmap uid = 19500-19999
    idmap config * : backend = tdb
    idmap config * : range = 1000-5000
    idmap config XXXX : backend = rid
    idmap config XXXX : range = 19500-19999
    usershare allow guests = No
    winbind offline logon = yes

and then run smbcontrol all reload-config followed by systemctl restart smb winbind I won't be able to log on with domain users anymore. I receive the following error:

Kinit for <Servername>$@XXXX.YYYY.NET to access cifs/<domain controller>.xxxx.yyyy.net@XXXX.YYYY.NET failed: Preauthentication failed

But I can use net ads kerberos kinit -u <OU Manager> and kinit -u <OU Manager> so I don't see the issue?

Has anybody else any more ideas or am I missing anything? Is it the fault of the AD Admins or mine?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.