Connect OpenMediaVault to an Windows Server 2012R2 AD/LDAP

  • Disclaimer: This Guide is far from perfect. These are the steps that I made, to connect an OpenMediaVault Server to an Windows Server 2012R2 AD/LDAP.
    I'm not responsible for any problems you may run into using this Guide.


    I strongly recommend to test this Guide in a Virtual testing environment before using on Productive Systems!



    So. Donh and me did it and connected OpenMediaVault to an 2012R2 AD/LDAP. Weird thing, Users page in webgui is fucking slow for me, groups page is nearly instant. On donh's installation with an 2008R2 Server the users tab is way faster.


    Step-by-step:


    1. Enable SSH
    2. Enable Samba, Set WORKGROUP to 'LOCAL' (WHEN your PDC is DC01.LOCAL.DOMAIN, change it according to your domain structure)
    2.1 Extra options for Samba:


    Code
    realm=DC01.LOCAL.DOMAIN
    winbind cache time = 3600
    winbind enum users = yes
    winbind enum groups = yes
    winbind use default domain = yes
    winbind separator = +


    3. nano /usr/share/openmediavault/mkconf/samba.d/15ldap
    3.1 Change Security = User to Security = ads
    3.2 Change both IDMAPUID and IMAPGID from 1000-2000 to 16777216-33554431


    4. Install anything thats needed (dnsutils to be able to use nslookup if needed)


    Code
    apt-get install krb5-config krb5-user krb5-clients winbind dnsutils


    4.1 Configure it according to your situation. You most likely fill in the IP/Hostname of your PDC/DC everytime!


    5. Install openmediavault-ldap and configure it like you would normally. (See attachment: ldap_settings, change according to your structure!)


    6. Apply anyhting in the GUI. Leave the GUI untouched after that! Otherwise the following changes will get reverted!


    7. Edit /etc/nsswitch.conf to look like the following:



    8. Restart samba and winbind


    Code
    service samba restart
    service winbind restart


    9. Add the following to your /etc/hosts file (REMEMBER: Change according your needs!)


    Code
    10.0.15.1 dc01.local dc01


    10. Edit /etc/krb5.conf
    10.1 Remove all dummy domains
    10.2 add the following to the config file under [domain_realm] (CHANGE ACCORDING TO YOUR NEEDS!)


    Code
    .local.domain = LOCAL.DOMAIN
    local.domain = LOCAL.DOMAIN


    10.3 The whole file should like that



    11. Check (with DATE, not in the webinterface!) that your time on your CLI is synchron with the time of your PDC!


    12. execute the following command - thats the first step where you most likely run into errors!


    Code
    kinit administrator


    13. join the fucking AD/LDAP


    Code
    net ads join -U administrator


    13.1. If That doesn't work, you can specify the exact hostname of the PDC


    Code
    net ads join -U administrator -S DC01.LOCAL.DOMAIN


    14. Check if winbind can access your AD/LDAP


    Code
    wbinfo -t


    14.1. Check if winbind can access Users and groups from the LDAP


    Code
    wbinfo -u
    wbinfo -g


    14.2. nano /etc/login.defs change UID_MAX GID_MAX as follows. Then you might need to do ldconfig.



    15. Check if OpenMediaVault can access it (You should see your OpenMediaVault Users AND your AD Users)


    Code
    getent passwd


    16. Check the Groups Page in the Webinterface. (This was nearly instant for both donh and me).


    17. Check Users Page in the Webinterface. (This was different for donh (Windows Server 2008R2) and me (Windows Server 2012R2) - mine was slow as hell, so maybe it timeouts for you, then access the Users Page again!)


    +18. To check for things I might have missed, here is my whole smb.conf



    +18.1 /etc/hosts



    10 hours. And I'm not satisfied with it how it works here. Donh and I are unsure why its so slow for me. Hardware is out of the question. Donhs configs are a bit different from mine, he will post them later.


    Nuff Said.


    Greetings
    David

    Images

    "Well... lately this forum has become support for everything except omv" [...] "And is like someone is banning Google from their browsers"


    Only two things are infinite, the universe and human stupidity, and I'm not sure about the former.

    Upload Logfile via WebGUI/CLI
    #openmediavault on freenode IRC | German & English | GMT+1
    Absolutely no Support via PM!


    I host parts of the omv-extras.org Repository, the OpenMediaVault Live Demo and the pre-built PXE Images. If you want you can take part and help covering the costs by having a look at my profile page.

  • Here are my smb.conf and krb5.conf files. This is not the easiest thing to do. Thanks David for your hard work on it. This was based on these links. http://bugtracker.openmediavault.org/view.php?id=707


    http://bugtracker.openmediavault.org/view.php?id=487



  • Thank you too. Without your initial effort I would've not done it.


    So, Datadigger, knock yourself out and try what you can accomplish. Or if you can spot mistakes, just say them out loud.


    Greetings
    David

    "Well... lately this forum has become support for everything except omv" [...] "And is like someone is banning Google from their browsers"


    Only two things are infinite, the universe and human stupidity, and I'm not sure about the former.

    Upload Logfile via WebGUI/CLI
    #openmediavault on freenode IRC | German & English | GMT+1
    Absolutely no Support via PM!


    I host parts of the omv-extras.org Repository, the OpenMediaVault Live Demo and the pre-built PXE Images. If you want you can take part and help covering the costs by having a look at my profile page.

  • Ok to fix nsswitch changing all the time edit /usr/share/openmediavault/mkconfig/nsswitch like this. It may break things that use mdns like apple stuff. Music players?



    I added info about mdns to the bug tracker
    http://bugtracker.openmediavault.org/view.php?id=707

  • Quote from "davidh2k"

    ..... just say them out loud.


    That's what I'm known for. ;)


    Good job, boys! Thanks a lot for this nice piece of work.

    Homebox: Bitfenix Prodigy Case, ASUS E45M1-I DELUXE ITX, 8GB RAM, 5x 4TB HGST Raid-5 Data, 1x 320GB 2,5" WD Bootdrive via eSATA from the backside
    Companybox 1: Standard Midi-Tower, Intel S3420 MoBo, Xeon 3450 CPU, 16GB RAM, 5x 2TB Seagate Data, 1x 80GB Samsung Bootdrive - testing for iSCSI to ESXi-Hosts
    Companybox 2: 19" Rackservercase 4HE, Intel S975XBX2 MoBo, C2D@2200MHz, 8GB RAM, HP P212 Raidcontroller, 4x 1TB WD Raid-0 Data, 80GB Samsung Bootdrive, Intel 1000Pro DualPort (Bonded in a VLAN) - Temp-NFS-storage for ESXi-Hosts

  • You're welcome.


    Greetings
    David

    "Well... lately this forum has become support for everything except omv" [...] "And is like someone is banning Google from their browsers"


    Only two things are infinite, the universe and human stupidity, and I'm not sure about the former.

    Upload Logfile via WebGUI/CLI
    #openmediavault on freenode IRC | German & English | GMT+1
    Absolutely no Support via PM!


    I host parts of the omv-extras.org Repository, the OpenMediaVault Live Demo and the pre-built PXE Images. If you want you can take part and help covering the costs by having a look at my profile page.

  • Havn't had much time to work on the LDAP settings today, because I decided to raise a new W2K12 R2 server for testing as a VM on my testbed, running on an ESXi host. This thing installed pretty well, but it didn't want to start over after installation. These new server need a special setting in the start option, it should read EFI boot instead of Bios and that took a while until I found that out.


    Then I worked down the points of your post, David and everything up to #15 was successful. But it didn't pull the users nor the groups and the auth log said that it couldn't connect to the LDAP server due to invalid credentials.
    That was the point where I lost my patience, sweeped up the ripped hairs and went home. More to come tomorrow.

    Homebox: Bitfenix Prodigy Case, ASUS E45M1-I DELUXE ITX, 8GB RAM, 5x 4TB HGST Raid-5 Data, 1x 320GB 2,5" WD Bootdrive via eSATA from the backside
    Companybox 1: Standard Midi-Tower, Intel S3420 MoBo, Xeon 3450 CPU, 16GB RAM, 5x 2TB Seagate Data, 1x 80GB Samsung Bootdrive - testing for iSCSI to ESXi-Hosts
    Companybox 2: 19" Rackservercase 4HE, Intel S975XBX2 MoBo, C2D@2200MHz, 8GB RAM, HP P212 Raidcontroller, 4x 1TB WD Raid-0 Data, 80GB Samsung Bootdrive, Intel 1000Pro DualPort (Bonded in a VLAN) - Temp-NFS-storage for ESXi-Hosts

  • Done. If the disclaimer sounds like shit, I'm falling asleep here....


    Greetings
    David

    "Well... lately this forum has become support for everything except omv" [...] "And is like someone is banning Google from their browsers"


    Only two things are infinite, the universe and human stupidity, and I'm not sure about the former.

    Upload Logfile via WebGUI/CLI
    #openmediavault on freenode IRC | German & English | GMT+1
    Absolutely no Support via PM!


    I host parts of the omv-extras.org Repository, the OpenMediaVault Live Demo and the pre-built PXE Images. If you want you can take part and help covering the costs by having a look at my profile page.

  • David try this and see if it is faster. It uses other programs than the ones in the plugin but apt takes care of every thing. Make a backup or clone just in case. It is what I used before finding and switching to the plugin.


    Code
    apt-get install libnss-ldapd libpam-ldapd nslcd unscd
  • Hello,


    first of all, thank you very much for this guide!


    I have one problem, though. Everything went fine until the very last steps 16 and 17. There are neither users nor groups shown in my webinterface, although winbind can access AD/LDAP as well as users and groups.


    Do you guys have any idea what could cause my problem?


    Thank you very much in advance

  • Hm okay, I still have one pretty annoying problem. If I try to fetch the users via GUI it takes forever and eventually times out with an error message. Same story with groups with the exception that there it works aproxemately in 1 out of 15 times.


    I tried the guide from david as well as the guide from datadigger. I also installed the packages recommended by donh. I even tried it with another domaincontroller (SBS 2011 and Server 2012 standard).


    I read the whole ldap plugin thread but was not able to find any solution. Did i miss something or are there any additional tips?


    Thx again in advance

  • I am not sure why it is slow for some users. I do not have a 2012 to test thanks to MS cutting out technet, thanks. Must have been too helpful for their taste.


    Is it quick with "getent passwd" "getent group" "wbinfo -u" "wbinfo -g" ? Is the time set to use the dc as the ntp server? I think those are what is used to get the info. If they are fast it may be something within OMV? There is a fix coming but I am not sure it will fix anything for speed. http://bugtracker.openmediavault.org/view.php?id=993


    Is dns working properly? "nslookup (your domain name)" "nslookup (your domain name).(your extension)" Are you using (your domain name).local?

  • haha microsoft, no comment...


    I put in the IP of my DC as time server for OMV.


    "getent passwd" "getent group" "wbinfo -u" "wbinfo -g" etc... takes some time to show up, but it always shows up. It does not show up instantly, though.


    If I do nslookup my domain I get:


    Code
    Server: 192.168.0.2
    Address: 192.168.0.2#53
    ** server can't find mydomain: SERVFAIL


    If I do nslookup mydomain.local I get:


    Code
    Server: 192.168.0.2
    Address: 192.168.0.2#53
    Name: mydomain.local
    Address: 192.168.0.2


    Yeah my SBS2011 domain is "mydomain".local.

  • Add an entry to /etc/hosts


    Code
    192.168.0.2 mydomain mydomain.local servername.mydomain.local


    /etc/hosts get over writen some times.


    Also execute this and see how long it takes.

    Code
    omv-rpc "UserMgmt" "getUserList" '{"start":0,"limit":null,"sortfield":null,"sortdir":null}'
  • My /etc/hosts now:



    still getting


    Code
    root@florisNAS:~# nslookup mydomain
    Server: 192.168.0.2
    Address: 192.168.0.2#53
    ** server can't find mydomain: SERVFAIL


    My timesettings:



    Getting pretty desperate now... Maybe I should just wait for the next version of OMV /:


    EDIT:

    Code
    omv-rpc "UserMgmt" "getUserList" '{"start":0,"limit":null,"sortfield":null,"sortdir":null}'

    took about 35 seconds

Participate now!

Don’t have an account yet? Register yourself now and be a part of our community!