Connect OMV to Active Directory 2012

Zitat von citynet

Trying to use the LDAP plugin to get my Domain Users and Groups so i can apply permision on my Share Folder

Nothing Seems to Work
Please HELP

Without given errors and even a rudimentary list of what you did and what you have...no one can help you...

Zitat von citynet

After a few hours of attempt I manage to get the user list under ACL

I'm not sure which part is necessary and which is not, but it is working now

I install dose to packages

Code

apt-get install libnss-winbind
apt-get install libpam-winbind

Edit /etc/nsswitch.conf (add winbind)

Code

passwd:         files winbind ldap sss
group:          files winbind ldap sss
shadow:         files winbind ldap sss


hosts:          files dns mdns4 mdns4_minimal [NOTFOUND=return]
networks:       files


protocols:      db files
services:       db files sss winbind
ethers:         db files
rpc:            db files


netgroup:       nis sss winbind
sudoers:        files sss winbind

Alles anzeigen

Add dose extra options to samba from the UI

Code

client signing = yes
client use spnego = yes
kerberos method = secrets and keytab
password server = SERVER.EXAMPLE.COM
realm = EXAMPLE.COM
security = ads
idmap config * : range = 16777221-19777221
winbind use default domain = Yes
winbind enum users = Yes
winbind enum groups = Yes
winbind nested groups = Yes
winbind separator = +
winbind refresh tickets = yes
winbind offline logon = yes
winbind cache time = 300

Alles anzeigen

the most Problematic part was to find out my "idmap config * : range"

now why the users and group are only under ACL and not in the users and group section?

Alles anzeigen

Thanks for this.

I recently upgraded to OMV 3 and attempted the steps in dethegeek's Guide how to join OpenMediaVault 3.x in an Active Directory domain, but, unfortunately, no matter what my settings were in sssd.conf/smb.conf/logins.def, I was not able to get my Windows 2012 AD passwd/group entries to list.

So eventually I gave up on sssd and made these adjustments and enabled winbind before sssd in nsswitch.conf (basically like the steps in dethegeek's earlier guide Join a Windows 2008 R2 domain, except now also using sssd) and it worked like a charm, just like before.

I'm not sure why sssd/realmd is able to join AD fine but is incapable of showing my users ..but whatever.. At least it is working.

(For completeness sake, I also adjusted my smb.conf settings and performed a netads join member -k -S <domain_controller_server> -U <domain_admin> -d 1 immediately after performing the realm join. This is probably unnecessary, but I like that "net ads testjoin" and "net ads info" look good, in addition to "realm list" )

(Also, I adjusted smb.conf so that it is only using the dedicated krb5 keytab.)

Zitat von donh

Glad you got it going. Have you seen this thread? https://forum.openmediavault.o…Directory-LDAP-Revisited/ There is a script you can try if you have a spare vm.

Thanks

Yeah I checked that. Thanks for taking the time to make that. It seems to be essentially the same steps as the new 2012 guide that I tried with a few different sssd.conf parameters automated. I tried these edits manually but it didn't seem to help the issue with sssd not enumerating my users in passwd. Not sure why not. Firewall is disabled on my DC..

I joined the AD using realmd first, then net ads second. Both passed.

..Also, I've been trying to use ONLY "dedicated keytab" in my samba.conf, like how it is in the OMV 3.0 guide.'

But, no matter what, I cannot mount my drives without smb.conf set to "kerberos method = secrets and keytab".

I've been using the keytab that was generated during the realmd AD join, but I even went out of my way today to create my own keytab from scratch--one that is valid on my domain and can be to used to authenticate on my OMV host through "kinit -k"-- but even that won't work.