I have multiple SLES 12.1 Servers which I joined into the AD Domain via
net ads join -u <OU_MANAGER> osName='SLES' osVer='12.1' createcomputer="<OU1>/<OU2>/Servers. It is important to note that I only have an OU Manager Account for OU2 and do not manage the AD itself.
The join finishes successful, but there is the typical
DNS_GSS_ERROR which I can't fix since according to the Troubleshooting you need to be the AD admin.
Nonetheless I joined the domain and when activating the option to allow login for domain users via YaST (somehow it does not work when I do the nsswitch.conf, pam and sshd settings myself) I can logon with the domain users.
The problem is I want to synchronize the UID/GID of the users, since they run decentral Java Applications and they are dependant on that.
/etc/samba/smb.conf looks as follows:
[global] workgroup = XXXX realm = XXXX.YYYY.NET security = ADS kerberos method = secrets and keytab template homedir = /home/%D/%U template shell = /bin/bash winbind refresh tickets = yes idmap gid = 19500-19999 idmap uid = 19500-19999 usershare allow guests = No winbind offline logon = yes
When I now try to change the idmap to the following
[global] workgroup = XXXX realm = XXXX.YYYY.NET security = ADS kerberos method = secrets and keytab template homedir = /home/%D/%U template shell = /bin/bash winbind refresh tickets = yes #idmap gid = 19500-19999 #idmap uid = 19500-19999 idmap config * : backend = tdb idmap config * : range = 1000-5000 idmap config XXXX : backend = rid idmap config XXXX : range = 19500-19999 usershare allow guests = No winbind offline logon = yes
and then run
smbcontrol all reload-config followed by
systemctl restart smb winbind I won't be able to log on with domain users anymore.
I receive the following error:
Kinit for <Servername>$@XXXX.YYYY.NET to access cifs/<domain controller>.xxxx.yyyy.net@XXXX.YYYY.NET failed: Preauthentication failed
But I can use
net ads kerberos kinit -u <OU Manager> and
kinit -u <OU Manager> so I don't see the issue?
Has anybody else any more ideas or am I missing anything? Is it the fault of the AD Admins or mine?