0

I have set up a Samba 4 Active Directory domain controller in AWS EC2 for my small business. I am trying to configure AWS Workmail to use this directory. I have followed Amazon's instructions here to set up an AD Connector instance linked to my Samba 4 installation. The AWS Directory Service console shows the connector's status as "Active," and I was able to set up a Workmail organization using that directory. However, when any of the management dashboards for that organization, an error banner is displayed that reads:

The connection to your directory cannot be established, error message
reported by Directory:
Authentication failed. Request id: 22b5a534-e08c-4e1a-9b5e-396f8922ebe8.
You can verify that your settings are correct using AWS Directory Service 
Documentation. Contact AWS Support if the issue remains.

In the Samba server's logs, I find the following:

ldb_wrap open of secrets.ldb
Kerberos: TGS-REQ awsadconnector@CORP.MYBUSINESS.COM from 
ipv4:172.30.5.246:56436 for ldap/addc01.corp.mybusiness.com@CORP.MYBUSINESS.COM
Kerberos: TGS-REQ authtime: 2019-10-20T23:06:00 starttime: 2019-10-20T23:06:00 endtime: 2019-10-21T09:06:00 renew till: unset
Terminating connection - 'kdc_tcp_call_loop: tstream_read_pdu_blob_recv() - NT_STATUS_CONNECTION_DISCONNECTED'
single_terminate: reason[kdc_tcp_call_loop: tstream_read_pdu_blob_recv() - NT_STATUS_CONNECTION_DISCONNECTED]
Starting GENSEC mechanism gssapi_krb5_sasl
gensec_gssapi: NO credentials were delegated
SASL/GSSAPI Connection from client will have no cryptographic protection
Terminating connection - 'ldapsrv_call_loop: tstream_read_pdu_blob_recv() - NT_STATUS_CONNECTION_DISCONNECTED'
single_terminate: reason[ldapsrv_call_loop: tstream_read_pdu_blob_recv() - NT_STATUS_CONNECTION_DISCONNECTED]
dreplsrv_notify_schedule(5) scheduled for: Sun Oct 20 23:06:09 2019 UTC
dreplsrv_notify_schedule(5) scheduled for: Sun Oct 20 23:06:14 2019 UTC

Can anyone tell me what is causing this problem, and suggest a solution? Has anyone succeeded in getting AWS AD Connector to interoperate with Samba 4?

migrated from superuser.com Oct 21 at 11:35

This question came from our site for computer enthusiasts and power users.

  • I was able to get past the above problem by adding this line to smb.conf: ldap server require strong auth = no I am now getting a new error on the AWS WorkMail dashboard for the organization: undefined: Unable to execute HTTP request: Read timed out (Service: null; Status Code: 0; Error Code: null; Request ID: null) This generated 548 lines of log messages, which I am now going through to figure out what is relevant. At the moment, I am focusing on this line: ldapsrv_do_call: Critical extension 2.16.840.1.113730.3.4.9 is not known to this server – Dan Menes Oct 22 at 9:21
  • This OID refers to the "Virtual List View" extension, which apparently was added to Samba in version 4.5. I am now running version 4.3.11, so the next task is to migrate to a newer Samba version. – Dan Menes Oct 22 at 9:34
0

The authentication error issue was fixed by adding

 ldap server require strong auth = no

to /etc/smb.conf. This fix, however, revealed another problem. The version of Samba that I was running did not support Virtual List Views. That issue caused the following message to appear in logs:

 ldapsrv_do_call: Critical extension 2.16.840.1.113730.3.4.9 is not known to this server

To address this, I installed a more recent version of Samba (4.6.7). This version, it turned out, required one more change: this version of Samba appeared to be using a wider range of values for RPC endpoints. I opened ports 1024-65535 for TCP traffic in the Amazon security group.

With all of these changes, I am now able to see my Samba users in Amazon WorkMail

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.