freeipa

#9075 ipa-adtrust-install not adding ipaNTGroupAttrs to posixgroups
Closed: fixed by croadfeldt. Opened by croadfeldt.

Closed: fixed
Reopen Issue

Request for enhancement

As , I want so that .

Issue

[description of the issue]
Deployed a clean slate freeipa install using Fedora 35. Followed instructions from https://bgstack15.wordpress.com/2017/05/10/samba-share-with-freeipa-auth to integrate with Samba on two servers. Integration worked except for granting access via IPA posixgroup membership. After research I found that the posixGroups were missing the ipaNTGroupAttrs objectClass. It's my understanding that objectClass should have been added during the ipa-adtrust-install --add-sids execution.

Steps to Reproduce

  1. Install Freeipa
  2. Create a posixGroup
  3. Add users to posixGroup
  4. Execute ipa-adtrust-install --add-sids
  5. Inspect posixgroup: cn=targetgroup,cn=groups,cn=accounts,dc=example,dc=com

Actual behavior

(what happens)
No ipaNTGroupAttrs objectclass added to the target posixgroup

Expected behavior

(what do you expect to happen)
ipaNTGroupAttrs objectclass added to the target posixgroup

Version/Release/Distribution

$ rpm -q freeipa-server freeipa-client ipa-server ipa-client 389-ds-base pki-ca krb5-server

Additional info:

Any additional information, configuration, data or log snippets that is needed for reproduction or investigation of the issue.

Log file locations: https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Linux_Domain_Identity_Authentication_and_Policy_Guide/config-files-logs.html
Troubleshooting guide: https://www.freeipa.org/page/Troubleshooting

Can provide logs if needed, let me know which ones are relevant.

Did some more testing, new groups do contain the objectClass ipaNTGroupAttrs as well as the requisite value for ipaNTGSecurityIdentifier. Sadly that has not fixed the issue with members of the group being denied access to the share though. Will bring that issue to the mailing list to ensure my config is correct.

Please do not use the method you referenced. It is completely outdated.

If you need to integrate Samba and FreeIPA, there is a command ipa-client-samba in the same package (freeipa-client-samba on Fedora) to do so on IPA clients.

The whole setup is documented in RHEL IdM documentation: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/configuring_and_managing_identity_management/setting-up-samba-on-an-idm-domain-member_configuring-and-managing-idm

I've tried those instructions multiple times. Unfortunately it has yet to work. But before I start troubleshooting that issue, I would like to confirm that those instructions are for kerberos auth into samba only? It appears that way. I need to be able to support password auth in addition to kerberos auth. Which is why I followed the instructions above as it accomplished both. Kerberos through the ipasam and password through ldap. That works fine, except for group memberships, more accurately nested group membership.

This is working as expected now. No config changes occurred, still using the instructions from the link below. Group membership is now working as expected. My guess is that a update resolved it. Unfortunately I just noticed it was resolved after I took up trying to troubleshoot the issue again.

Metadata Update from @croadfeldt:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

Forgot the link.

https://bgstack15.wordpress.com/2017/05/10/samba-share-with-freeipa-auth
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.