Configured Samba to join our domain, but logon fails from Windows machine

Question

I've configured a Fedora 11 installation to join our domain. It seems to join successfully (though it reports a DNS update failure) but when I try to access \\fedoraserver.test.mycompany.com I'm prompted for a password. So I enter adminuser and the password and that fails, so I try test.mycompany.com\adminuser and that too fails. What am I missing?

EDIT (Update 9/1/09): I can now connect to the machine and see the shares on it (see my response to djhowell's answer) but when I try to connect, I get an error saying The network path was not found. I checked the log entry on the Fedora computer for the computer I'm connecting from (/var/log/samba/log.ComputerX) and it reads:

[2009/09/01 12:02:46,  1] libads/cldap.c:recv_cldap_netlogon(157)
    no reply received to cldap netlogon
[2009/09/01 12:02:46,  1] libads/ldap.c:ads_find_dc(417)
    ads_find_dc: failed to find a valid DC on our site (Default-First-Site-Name), trying to find another DC

Config files as of 9/1/09:

smb.conf:

[global]
Workgroup = TEST
realm = TEST.MYCOMPANY.COM
password server = DC.TEST.MYCOMPANY.COM
security = DOMAIN
server string = Test Samba Server
log file = /var/log/samba/log.%m
max log size = 50
idmap uid = 15000-20000
idmap gid = 15000-20000
windbind use default domain = yes
cups options = raw
client use spnego = no
server signing = auto
client signing = auto

[share]
comment = Test Share
path = /mnt/storage1
valid users = adminuser
admin users = adminuser
read list = adminuser
write list = adminuser
read only = No

I also set the krb5.conf file to look like this:

[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log

[libdefaults]
default_realm = test.mycompany.com
dns_lookup_realm = false
dns_lookup_kdc = false
ticket_lifetime = 24h
forwardable = yes

[realms]
TEST.MYCOMPANY.COM = {
 kdc = dc.test.mycompany.com
 admin_server = dc.test.mycompany.com
 default_domain = test.mycompany.com
}

[domain_realm]
dc.test.mycompany.com = test.mycompany.com
.dc.test.mycompany.com = test.mycompany.com

[appdefaults]
pam = {
 debug = false
 ticket_lifetime = 36000
 renew_lifetime = 36000
 forwardable = true
 krb4_convert = false
}

I realize that there might be an issue with EXAMPLE.COM in there, however if I change it to TEST.MYCOMPANY.COM then it fails to join the domain with a preauthentication failure. As of 9/1/09, this is no longer the case.

Answer 1

From the linux box try:

$ kinit your_username

And enter your password. Then enter:

$ klist

And see if you have a valid kerberos ticket.

In my krb5.conf file I do not have any port numbers in my realms section. Additionally, in the domain_realm section I have something like this:

MY-DC1.COMPANY.COM = COMPANY.COM
.MY-DC1.COMPANY.COM = COMPANY.COM

Try changing the left side of those lines to point directly to the domain controller you're going to authenticate to.

Answer 2

Sorry for the late reply but maybe I can help someone with the DNS problem once he/she has it. I resolved the DNS problem by adding a mapping to the Fully Qualified DomainName to the address of the Domain Controller such as so:

Domain: herazio.com DC: HER-PDC

/etc/hosts file: HER-PDC.herazio.com 192.50.2.2

This resolved the DNS issue for me luckily.

Regards hope it was useful.

Answer 3

I would expect that the DNS update failure is your clue here - Windows/Linux (or Unix) interoperability is by no means as seamless as it's sometimes advertised to be. Make sure that your other machines can resolve name-to-IP and IP-to-name for the new box, and if not, add the appropriate DNS records. Then try it and see what happens.

Also worth checking out the IP configuration for the new box to ensure that it's got the correct settings there.