I have a network domain running OpenLDAP, MIT Kerberos and Bind9. Now I want to enable some MS Windows hosts access to a NAS, in such a way that user credentials stay in my LDAP and Kerberos infrastructure. The obvious answer to this seems to be Samba, but after several weeks of struggling with integration work (I'm running this network at home for self-training purposes mainly, so I can't devote more than a couple of hours per day), it seems way too complicated to integrate Samba with my environment.

At this point, the only integration option that seems valid is setting up Samba in AD mode (which comes with its own LDAP and DNS, but should integrate with MIT Kerberos), and then work out the integration of my LDAP and DNS information with Samba via synchronization scripts. I regard this option as very error prone and resource consuming.

I believe that my network setup is pretty standard, so, which is the usual way to achieve file sharing with MS Windows hosts in this scenario? I feel that I'm missing something in the big picture. Maybe Samba is not the appropriate solution?

  • I haven't got time to write a proper answer (yet), but I would suggest you take a look at sssd, and in particular sssd-ldap. This is a layer underneath Samba and would replace Winbind. – roaima Mar 5 '18 at 22:27
  • @roaima I've tried with sssd to no avail. All of the articles that I have read about sssd and Samba integration are related to Samba clients. I'm, however, trying to deploy a Samba server. Can you share any reference to Samba servers using sssd for accounting, authorization and authentication? – Guillermo López Alejos Apr 8 '18 at 18:15

After a lot of unsuccessful integration work I've come to the conclusion that, for now, what I want is just not possible. Some others have come to the same conclusion in similar scenarios [1] [2]. The following answer from Andre Bartlett (Samba Team Authentication Developer) clearly states that authentication delegation options are limited to AD or Samba domains [3]:


I have a question regarding Samba4 and the possibility to delegate authentication to an external LDAP server using Cyrus SASL.


No, it isn't possible. Samba can only delegate authentication to AD or Samba domains, not other LDAP servers or SASL, as our authentication protocols do not disclose the plaintext password. AD and Samba domains support pass-though mechanisms for NTLM, and we can accept Kerberos tickets issued by Kerberos servers.'

To be an AD DC, you need to be the source of truth for passwords. I can only suggest you arrange the reverse, that your OpenLDAP servers talk to the Samba AD DC.

I've also tried deploying Samba as a Domain Controller, only to find out that it only uses its own internal LDAP distribution (i.e. no integration with my running LDAP) [4], and with very limited MIT Kerberos support... [5]

I might be able to enable PAM authentication at the cost of password confidentiality [6], what is not an option for me.

I'll leave this question open and will be very happy to hear a success story about this problem from anyone.

[1] https://serverfault.com/questions/644145/ubuntu-server-samba-pam-apple-opendirectory [2] https://serverfault.com/questions/264421/samba-file-server-pam-berkeley-db-or-samba-pam [3] https://lists.samba.org/archive/samba/2015-March/189871.html [4] https://wiki.samba.org/index.php/FAQ#Is_It_Planned_to_Support_OpenLDAP_as_Back_End_for_Samba_AD.3F [5] It seems that major Linux distributions maintain Samba packages with support for Heimdal Kerberos only. I've published the Dockerfile I wrote to build Samba with MIT Kerberos support. You can check it out from the following repository in case you need help with this task: https://github.com/glalejos/docker-debian-samba-mit-kerberos [6] https://www.samba.org/samba/docs/current/man-html/smb.conf.5.html#OBEYPAMRESTRICTIONS

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.