I try to install a samba server for active directory authentication and shares.
I managed to configure kerberos (kinit klist works)
I configured smb.conf
.
wbinfo -u<br>
wbinfo -g<br>
getent group *showing all domain groups)<br>
getent users (showing all domain users)<br>
net join was successful
Modifing nsswitch
and common-session
did work as well.
I can log into the machine using AD credentials, locally and over ssh.
Even adding domain administrator group to sudoer worked.
So I assume the authentication is configured correctly.
I now wanted to create a share. One with [homes] and one with access for an AD group.
If i now connect to the share from a win7 computer I get prompted user/password. If I enter the data from the initial local account, that was created during the installation process, I see both shares. The public one and the home directory of the local user.
If i use the AD credentials, i only get access denied.
I even tried to enable guest access and deactivation any access control. But nothing changes. The local user can connect, but the AD user doesn't even get to see the shares.
If i enable logging level 10 I see that the computer is trying to authenticate, but fails.
What am I missing?
[Update]
I found the problem. I don't really understand why that caused that effect, but now the share is working nearly as i want it to.
I did use
idmap uid = 10000-20000<br>
idmap gid = 10000-20000
from the tutorial at http://wiki.ubuntuusers.de/Samba_Winbind I didn't think the warning, that these lines are deprecated will cause problems, as deprecation normally means still supported. That's true for local login. But shares get broken. I replaced these two lines with
idmap config * : range = 10000-20000
and now the share is working.
Only problem left is, in order to connect to the [homes] share I need to use COMPUTERNAME\USERNAME, but I wanted homes to work with DOMAIN\USERNAME?
If anyone knows how to change that it would appreciate it, but as I can just use a normal home share with username subdirectory, I don't consider that a real problem.