I am trying to set up a Samba server to use an LDAP server for authentication only, but pull all account information (user ID etc.) from SSSD, PAM etc. Basically, the server should act as a standalone server except that the user names and passwords will be checked against LDAP.
The LDAP server only provides the
InetOrgPerson object classes, and it is not under my control; I cannot change it.
There is a lot of information out on the Internet about making Samba work with LDAP, but invariably it involves modifying the LDAP schema. That is not an option in our situation. Nor should it be necessary, since I only want to authenticate the users against the user name and password.
Incidentally, I know that Samba does not allow authenticating with an anonymous bind (because the passwords are transmitted hashed). As far as I can tell, that's a separate issue addressed by providing an LDAP admin DN.
The system is already set up to authenticate local logins, SSH etc. via SSSD to the same LDAP server. This works and is well-tested.
Software: RedHat 7.3, Samba 4.4.4, LDAP server is Oracle LDAP (probably based on OpenLDAP, but it is outside my control).
I am looking for instructions on how to accomplish this.