I asked this question on stackoverflow and realized I might get better responses here.
Attempting to set up Samba + OpenLDAP using nss_ldap uner Linux. Alls software is compiled by me from source so no RPMs, YUM, etc...
Using Pozix Linux which is our own distribution - vanilla login system meaning out of the box the distro relies on standard /etc/passwd, /etc/group.
Installed all necessary software to convert system to an LDAP based system which seems to work with other software such as SSH except SAMBA.
Was able to join Windows7 to Samba stand alone PDC, I can not login with a domain account unless that account is also added to the /etc/passwd file.
I get: user in passdb, but getpwnam() fails!
Everything I've read points to an NSS_LDAP issue. Here is a list of things I've done:
- getent passwd shows users perfectly fine
- I am able to ssh into the same Linux host using a user account that is only in the LDAP database.
- id test (test is my test account only in LDAP) that works
- ./pdbedit -Lv test works
- ./net rpc rights list accounts -Uroot works, I see root has all necessary rights
- per suggestion from stackoverflow, I changed my nsswitch.conf file from (files ldap) to (ldap files) which essentially changed the dump order of getent passwd & didn't resolve the issue.
- commented out rootbinddn and add the bindpw with clear-text version of the password to eliminate any questions with ldap.secret
- smb.conf has ldapsam:trusted = yes
- smb.conf and ldap.conf both have ssl off a
- Not running nscd
Everyting on the samba.org site chapter-5 about making users happy works except for:
./smbclient //tsrvr/test -Utest
This produces the subject error message in log.smbd and ldap debug log shows a query for test with no errors and a successful return value.
If I put 'test' into /etc/passwd, then it works!
It's as if the relationship between nss_ldap and smbd is broken and I stress relationship because LDAP appears OK (slapcat, ldapsearch, etc... all work)... It appears that nss_ldap library is getting a return value that when handed back to smbd, it somehow is not understood.
I would really appreciate any suggestions. I see this problem listed often. Often related to PAM but I'm not using PAM.
Additionally, if I crack open the /etc/passwd file and add a line for the user in question, I can then login.
I'm not using PAM. I added the two Windows7 registry updates required per the Samba.org site.
Software stack is as follows: Samba 3.5.3 OpenLDAP 2.4.21 nss_ldap 264
---------------------[ update ]---------------------
I began looking at Samba source code.
I found this function in samba3/auth/auth_util.c (about line 580)
auth_serversupplied_info *result;
const char *username = pdb_get_username(sampass);
pwd = getpwnam_alloc(result, username);
pwd evaluates to NULL even though username is valid. getpwnam_alloc allocates memory for result structure and fills it with the Unix UID, primary GID, etc...
Everything I read says that this call uses NSS. I hope someone from Samba team who has knowledge of this than I can chime in.
---------------------[ update ]--------------------- Examining samba source code here is what I'm discovering:
The failure is happening in auth/auth_util.c (line 580) with a call to getpwnam_alloc
getpwnam_alloc attempts to do some sort of caching and if the username is not found in recent cache the code falls through with a call to:
sys_getpwnam found in lib/system.c which is just a wrapper for getpwnam
Documented here: http://opengroup.org/onlinepubs/007908775/xsh/getpwnam.html
Doesn't appear as of Samba checks the errno described; will add some debug and report back.
Definitely a failure to the OS library implementing getpwnam but not sure what yet.