Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've setup a CentOS 7 machine, and joined it to our AD via realmd through:

yum install realmd samba-common oddjob oddjob-mkhomedir sssd
realm join --user=myuser@mydomain.local mydomain.local

After that, realm list returns the expected output

[root@webdev samba]# realm list
  type: kerberos
  realm-name: MYDOMAIN.LOCAL
  domain-name: mydomain.local
  configured: kerberos-member
  server-software: active-directory
  client-software: sssd
  required-package: oddjob
  required-package: oddjob-mkhomedir
  required-package: sssd
  required-package: adcli
  required-package: samba-common
  login-formats: %U@mydomain.local
  login-policy: allow-realm-logins

and I can login via SSH using my AD credentials ( so I get myuser@mydomain.local@hostname).

I now need to allow Windows users to access a folder on the machine, however Samba seems to be unwilling to cooperate - all combinations or username and password come back as wrong. I do not know how to debug this, or if I am missing something out.

The smb.conf file is basically:

 [root@webdev samba]# testparm
 Load smb config files from /etc/samba/smb.conf
 rlimit_max: increasing rlimit_max (1024) to minimum Windows limit (16384)
 Processing section "[vHosts]"
 Loaded services file OK.
 Press enter to see a dump of your service definitions

    workgroup = MYDOMAINLOCAL
    realm = MYDOMAIN.LOCAL
    server string = Samba Server Version %v
    security = DOMAIN
    log file = /var/log/samba/log.%m
    max log size = 50
    load printers = No
    idmap config * : backend = tdb
    hosts allow = 127., 10.0.
    cups options = raw

    comment = Virtual Host repository
    path = /var/www/vhosts
    valid users = MYDOMAINLOCAL\%S
    read only = No

I should note that I've changed the directory ( /var/www/vhosts ) system permissions to 777.

Any help will be greatly appreciated. Thanks in advance!


  • DC is Windows 2003 R2, clients are Windows 7
  • Have tried setting security to both ads and domain, with similar results (no cigar)
  • Error message being received at the Windows credentials dialog is "Access is denied"
  • Tried both with firewall disabled and enabled, no difference
  • SELinux is disabled

Searching for krb* packages:

[root@webdev logs]# rpm -qa | grep krb

and the command output getent passwd MYDOMAINLOCAL\myuser and getent passwd mydomain.local\myuser return blank ( no output ).

share|improve this question
Hello hexblot, can you please give us more information about your Windows Server version and Windows client version ? On your windows client you see your vHosts folder but can't access to it due to wrong credential error, right ? -Quick thought- iptables is configured ? Have you tried : security = ADS ? – NooJ Jul 21 '14 at 13:22
@NooJ added the info in the post above. Let me know if you need more. – hexblot Jul 21 '14 at 13:31

Answering my own question :

the only thing wrong was the valid users section in smb.conf - it appears that %S didn't work at all.

Thus, for a security group named "WebDevGrp" in Windows, on CentOS it will be shown as webdevgrp@mydomain.local ( you can test via groups myuser@mydomain.local ), and you can then make the Samba share like so :

  comment = Virtual Host repository
  path = /var/www/vhosts
  public = no
  writable = yes
  guest ok = no
  valid users = @"webdevgrp@mydomain.local"

and you don't even get prompted for a password - it's all seamless!

PS. when debugging Samba, add log level = 3 to your config, makes a heck of a difference!.

PPS. I've written a guide to the whole process - going from vanilla freshly installed CentOS 7 to having Samba shares with AD authentication / authorization which you can find at my blog here

share|improve this answer

Recently I had to configure a Windows/Samba test environment on Fedora and Windows 2012/Windows 7 and had some similar issues. After changing this registry keys on Windows servers/clients everything worked nice :




But I was using winbind/kinit/etc. to perform AD integration. Maybe this could help you.


  • Have you installed kerberos package like : krb5-workstation krb5 -libs krb5 -auth -dialog on your CentOS ?
  • Does "getent passwd" return you windows domain users ?
share|improve this answer
See amended answer regarding your questions. I'm trying to find someone who has access to tamper with the registry on our Windows servers (I only have access on the Linux side of things). Do note this is a CLI only installation of CentOS. – hexblot Jul 21 '14 at 14:00

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.