FreeIPA - Revision history

Leo: /* Configure the Samba server */

2026-04-07T06:00:20Z

Configure the Samba server

← Older revision		Revision as of 06:00, 7 April 2026
Line 216:		Line 216:
	kerberos method = dedicated keytab		kerberos method = dedicated keytab
	\| lang = text		\| lang = text
	}}If you get: <code>NT_STATUS_BAD_TOKEN_TYPE</code>, you need to disable MS-~~POC~~ in the FreeIPA settings or disable it specifically for this cifs service account.		}}If you get: <code>NT_STATUS_BAD_TOKEN_TYPE</code>, you need to disable MS-PAC in the FreeIPA settings or disable it specifically for this cifs service account.

	The ipasam passdb provider is available from the <code>ipa-server-trust-ad</code> package. However, this package also pulls in a ton of other IPA dependencies which aren't needed if you just want to run Samba that talks to IPA and not the entire FreeIPA server. If you just want the provider to work on a bare minimal samba server, you can simply just copy (or extract from the <code>ipa-server-trust-ad</code> package) the <code>ipasam.so</code> file to <code>/usr/lib64/samba/pdb/ipasam.so</code> with this set of commands:		The ipasam passdb provider is available from the <code>ipa-server-trust-ad</code> package. However, this package also pulls in a ton of other IPA dependencies which aren't needed if you just want to run Samba that talks to IPA and not the entire FreeIPA server. If you just want the provider to work on a bare minimal samba server, you can simply just copy (or extract from the <code>ipa-server-trust-ad</code> package) the <code>ipasam.so</code> file to <code>/usr/lib64/samba/pdb/ipasam.so</code> with this set of commands:

Leo: FreeIPA 4.12 upgrade failure

2025-06-10T04:15:24Z

FreeIPA 4.12 upgrade failure

← Older revision		Revision as of 04:15, 10 June 2025
Line 469:		Line 469:

	Alternatively, use Podman (except that I can't because I use docker-compose for all my setups).		Alternatively, use Podman (except that I can't because I use docker-compose for all my setups).

			=== Failed to authenticate to CA REST API ===
			After suffering a brief power outage, my FreeIPA stack stopped working. A contributing factor might have been my auto-update mechanism which pulled in the most recent version of the freeipa/freeipa:rocky-9 container image. Looking at the container logs, I see that the container beings to shutdown after the upgrade command fails. Looking at the <code>/var/log/ipaupgrade.log</code> log file, I see the following error:
			{{Highlight
			\| code = 2025-06-10T03:54:37Z DEBUG The ipa-server-upgrade command failed, exception: RemoteRetrieveError: Failed to authenticate to CA REST API
			2025-06-10T03:54:37Z ERROR Unexpected error - see /var/log/ipaupgrade.log for details:
			RemoteRetrieveError: Failed to authenticate to CA REST API
			\| lang = terminal
			}}
			My first step was to try downgrading. The second oldest container image was FreeIPA 4.11 and attempting to downgrade to this version didn't work as the data I had already had migrated to 4.12.

			Some searching turned up a [https://access.redhat.com/solutions/7122683 Red Hat knowledgebase article] which states that this is a bug with ipa-server 4.12.2-14. The fix is to change the following files:

			* Add <code>/etc/pki/pki-tomcat/Catalina/localhost/rewrite.config</code> (copy it from <code>/usr/share/pki/server/conf/Catalina/localhost/rewrite.config</code>)
			* Edit <code>/etc/pki/pki-tomcat/server.xml</code> to include before the closing <code></Host></code> tag near the bottom of the file: {{Highlight
			\| code = <Valve className="org.apache.catalina.valves.rewrite.RewriteValve"/>
			\| lang = text
			}}

			Because both files are in <code>/etc</code>, these two files should be in the data volume that's mounted into the FreeIPA container. Edit both files from the data volume and then try restarting the container. It should start properly.

			Enterprise software? FreeIPA feels like it was put together with duct tape.

	== See also ==		== See also ==

Leo: /* Configure the Samba server */

2024-01-14T07:40:09Z

Configure the Samba server

← Older revision		Revision as of 07:40, 14 January 2024
Line 218:		Line 218:
	}}If you get: <code>NT_STATUS_BAD_TOKEN_TYPE</code>, you need to disable MS-POC in the FreeIPA settings or disable it specifically for this cifs service account.		}}If you get: <code>NT_STATUS_BAD_TOKEN_TYPE</code>, you need to disable MS-POC in the FreeIPA settings or disable it specifically for this cifs service account.

	The ipasam passdb provider is available from the <code>ipa-server-trust-ad</code> package. However, this package also pulls in a ton of other IPA dependencies which aren't needed. If you just want the provider to work on a bare minimal samba server, you can simply just copy (or extract from the <code>ipa-server-trust-ad</code> package) the <code>ipasam.so</code> file to <code>/usr/lib64/samba/pdb/ipasam.so</code>.		The ipasam passdb provider is available from the <code>ipa-server-trust-ad</code> package. However, this package also pulls in a ton of other IPA dependencies which aren't needed if you just want to run Samba that talks to IPA and not the entire FreeIPA server. If you just want the provider to work on a bare minimal samba server, you can simply just copy (or extract from the <code>ipa-server-trust-ad</code> package) the <code>ipasam.so</code> file to <code>/usr/lib64/samba/pdb/ipasam.so</code> with this set of commands:

			{{Highlight
			\| code = # yum download ipa-server-trust-ad
			# mkdir x && cd x
			# rpm2cpio ../ipa-server-trust-ad*rpm {{!}} cpio -id ./usr/lib64/samba/pdb/ipasam.so
			# cp ./usr/lib64/samba/pdb/ipasam.so /usr/lib64/samba/pdb/ipasam.so
			\| lang = terminal
			}}

	=== Method 3: Kerberos ===		=== Method 3: Kerberos ===

Leo at 21:00, 5 March 2023

2023-03-05T21:00:44Z

@@ Line 5: / Line 5: @@
 There is an official Docker container that has a complete FreeIPA installation. This container uses systemd to start up FreeIPA along with the other related services such as OpenLDAP, Bind, and Kerberos. See more at: https://github.com/freeipa/freeipa-container
-Use the following docker-compose.yml stack to quickly get started with FreeIPA:
+If you are using Docker, you '''must disable cgroup v2''' (this is enabled by default on RHEL9 and above). More about this in the Troubleshooting section below.
 {{Highlight
 | code = version: '3.3'
@@ Line 442: / Line 444: @@
 }}
 The quick work-around would be to add the DNS entry manually and try again.
 == See also ==

Leo at 18:23, 24 January 2023

2023-01-24T18:23:09Z

@@ Line 421: / Line 421: @@
 }}
 Once the hostname is fixed, try the command again.
 == See also ==

Leo at 17:54, 24 January 2023

2023-01-24T17:54:11Z

@@ Line 394: / Line 394: @@
 }}
 For this instance, this was caused when I accidentally removed <code>/etc/dirsrv/ds.keytab.</code>
 == See also ==

Leo: /* Method 2: ipasam */

2023-01-24T17:50:57Z

Method 2: ipasam

← Older revision		Revision as of 17:50, 24 January 2023
Line 167:		Line 167:
	\| lang = terminal		\| lang = terminal
	}}		}}
	Ensure that your hostname is set to the FQDN of the hostname otherwise this process will fail. If you are using an external DNS server, ensure that the additional service records are present.		Ensure that your hostname is set to the FQDN of the hostname otherwise this process will fail. If you are using an external DNS server, ensure that the additional service records are present. If you are using a Docker container, set the hostname to the full FQDN (eg. ipa.example.com, rather than just 'ipa').

	Next, create a new user and then change the user's password. This should populate the <code>ipaNTPassword</code> attribute. {{Highlight		Next, create a new user and then change the user's password. This should populate the <code>ipaNTPassword</code> attribute. {{Highlight

Leo: /* Troubleshooting */

2023-01-24T06:55:46Z

Troubleshooting

← Older revision		Revision as of 06:55, 24 January 2023
Line 331:		Line 331:
	}}		}}

			=== File permission issues ===
			I ran into issues starting FreeIPA in a Docker container. Symptoms include the following issues in the subsections below.

			==== Bind / named doesn't start: ====
			{{Highlight
			\| code = ipa named-pkcs11[5407]: LDAP error: Invalid credentials: bind to LDAP server failed
			ipa named-pkcs11[5407]: couldn't establish connection in LDAP connection pool: permission denied
			ipa named-pkcs11[5407]: dynamic database 'ipa' configuration failed: permission denied
			ipa named-pkcs11[5407]: loading configuration: permission denied
			ipa named-pkcs11[5407]: exiting (due to fatal error)
			\| lang = text
			}}
			Ignore this for now. You have other issues, likely.

			==== Samba doesn't start: Error: Invalid credentials ====
			When trying to start smb, I get the following:
			{{Highlight
			\| code = [2023/01/24 05:17:46.170883, 0, pid=5124] ipa_sam.c:4945(bind_callback)
			bind_callback: cannot perform interactive SASL bind with GSSAPI. LDAP security error is 49
			[2023/01/24 05:17:46.171155, 0, pid=5124] ../../source3/lib/smbldap.c:1059(smbldap_connect_system)
			failed to bind to server ldapi://%2fvar%2frun%2fslapd-HOME-STEAMR-COM.socket with dn="[Anonymous bind]" Error: Invalid credentials
			(unknown)
			[2023/01/24 05:17:46.171419, 1, pid=5124] ../../source3/lib/smbldap.c:1272(get_cached_ldap_connect)
			Connection to LDAP server failed for the 1 try!
			\| lang = terminal
			}}
			The fix was to stop FreeIPA with <code>ipactl stop</code>, then <code>rm /run/samba/krb5cc_samba</code>, and restarting FreeIPA with <code>ipactl start</code>. If the error recurrs after restarting FreeIPA, then you have other issues that's preventing Samba from starting.

			==== Tomcat doesn't start: status=5/NOTINSTALLED ====
			When trying to start Tomcat, you get a 5 exit code, as reported by systemd:
			{{Highlight
			\| code = pki-tomcatd@pki-tomcat.service: Control process exited, code=exited, status=5/NOTINSTALLED
			pki-tomcatd@pki-tomcat.service: Failed with result 'exit-code'.
			Failed to start PKI Tomcat Server pki-tomcat.
			\| lang = terminal
			}}
			The exit code 5 being 'NOTINSTALLED' is a red herring. You likely have permission issues that's preventing the user running tomcat (pkiuser) from accessing some certs or configs. Go through your Docker volumes and chown anything directory called 'pki' to the pkiuser.
			{{Highlight
			\| code = # chown -R 17:17 etc/pki etc/sysconfig/pki var/lib/pki var/lib/ipa/pki-ca
			\| lang = terminal
			}}

			==== Tomcat still doesn't start: start-post operation timed out. Terminating. ====
			Tomcat doesn't start as it times out.
			{{Highlight
			\| code = pki-tomcatd@pki-tomcat.service: start-post operation timed out. Terminating.
			pki-tomcatd@pki-tomcat.service: Control process exited, code=killed, status=15/TERM
			pki-tomcatd@pki-tomcat.service: Failed with result 'timeout'.
			\| lang = terminal
			}}
			There's likely still something tomcat can't write to.

			It seemed to get better when made the ownerships for /data/var/lib/pki/pki-tomcat/logs/ and /var/log/pki/pki-tomcat to pkiuser.

			To help troubleshoot, su as pkiuser and try running tomcat as per the service file and see if you get any stack traces.

			==== IPA Web GUI reports "Your session has expired. Please re-login" ====
			Review the logs for dirsrv and see if there are any errors.
			{{Highlight
			\| code = # tail -f /var/log/dirsrv/slapd-*/access
			\| lang = terminal
			}}
			For this instance, this was caused when I accidentally removed <code>/etc/dirsrv/ds.keytab.</code>

	== See also ==		== See also ==

Leo: Added categories and navbar

2022-03-14T04:03:49Z

Added categories and navbar

← Older revision		Revision as of 04:03, 14 March 2022
Line 338:		Line 338:
	* https://www.freeipa.org/page/Howto/Integrating_a_Samba_File_Server_With_IPA - Samba integration using kerberos (not ipasam)		* https://www.freeipa.org/page/Howto/Integrating_a_Samba_File_Server_With_IPA - Samba integration using kerberos (not ipasam)
	* https://freeipa-users.redhat.narkive.com/ez2uKpFS/authenticate-samba-3-or-4-with-freeipa		* https://freeipa-users.redhat.narkive.com/ez2uKpFS/authenticate-samba-3-or-4-with-freeipa


			{{Navbox Linux}}
			[[Category:Linux]]
			[[Category:Networking]]

Leo at 03:45, 14 March 2022

2022-03-14T03:45:06Z

← Older revision		Revision as of 03:45, 14 March 2022
Line 67:		Line 67:

	== Samba integration ==		== Samba integration ==
	There are 3 methods to using FreeIPA with Samba.		There are 3 methods to using FreeIPA with Samba. I eventually settled on method #2.

	# Configure Samba to use FreeIPA as a simple LDAP server, using '''ldapsam''' as the passdb backend. This requires a schema change to include the sambaSAMAccount and sambaGroupMapping, and sambaSID object classes. There is a DNA plugin that can be used to update these fields.		# Configure Samba to use FreeIPA as a simple LDAP server, using '''ldapsam''' as the passdb backend. This requires a schema change to include the sambaSAMAccount and sambaGroupMapping, and sambaSID object classes. There is a DNA (distributed numeric assignment) plugin that can be used to update these fields.
	# Configure Samba to use FreeIPA using '''ipasam''' as the passdb backend. This requires ipasam.so on the samba servers.		# Configure Samba to use FreeIPA using '''ipasam''' as the passdb backend. This requires the <code>ipasam.so</code> module installed on the samba servers.
	# Configure Samba to use '''Kerberos'''. Does not seem to allow users to use password authentication.		# Configure Samba to use '''Kerberos'''. Does not seem to allow users to use password authentication.

	=== Method 1: ldapsam ===		=== Method 1: ldapsam ===
			{{Warning\|I didn't get this to work\|I wasn't able to fully get this method to work. If you are using OpenLDAP only, this way of integrating Samba does work. The issue I had was getting the DNA plugin to work as advertised.

			I eventually settled on the ipasam method in the section below.}}
	To use ldapsam, we need to make some changes to the FreeIPA LDAP server by adding sambaSAMAccount and sambaGroupMapping as a default user object class and group object class.		To use ldapsam, we need to make some changes to the FreeIPA LDAP server by adding sambaSAMAccount and sambaGroupMapping as a default user object class and group object class.

Line 166:		Line 169:
	Ensure that your hostname is set to the FQDN of the hostname otherwise this process will fail. If you are using an external DNS server, ensure that the additional service records are present.		Ensure that your hostname is set to the FQDN of the hostname otherwise this process will fail. If you are using an external DNS server, ensure that the additional service records are present.

	Next, create a new user and then change the user's password. This should populate the ipaNTPassword attribute.{{Highlight		Next, create a new user and then change the user's password. This should populate the <code>ipaNTPassword</code> attribute. {{Highlight
	\| code = # ipa user-add leo --first=Leo --last=Leung		\| code = # ipa user-add leo --first=Leo --last=Leung
	# ipa group-add-member smbgrp --users=leo		# ipa group-add-member smbgrp --users=leo
Line 211:		Line 214:
	kerberos method = dedicated keytab		kerberos method = dedicated keytab
	\| lang = text		\| lang = text
	}}~~Now, I~~ get: <code>NT_STATUS_BAD_TOKEN_TYPE</code>~~. Disable~~ MS-POC in the FreeIPA settings or disable it specifically for this cifs service account.		}}If you get: <code>NT_STATUS_BAD_TOKEN_TYPE</code>, you need to disable MS-POC in the FreeIPA settings or disable it specifically for this cifs service account.

			The ipasam passdb provider is available from the <code>ipa-server-trust-ad</code> package. However, this package also pulls in a ton of other IPA dependencies which aren't needed. If you just want the provider to work on a bare minimal samba server, you can simply just copy (or extract from the <code>ipa-server-trust-ad</code> package) the <code>ipasam.so</code> file to <code>/usr/lib64/samba/pdb/ipasam.so</code>.

	=== Method 3: Kerberos ===		=== Method 3: Kerberos ===

	~~Once this is done, try changing an account password. You should see the <code>ipaNTHash</code> field get populated.~~ This is ~~important as~~ the ~~samba~~ ipasam ~~module~~ will ~~use this.~~		This method is similar to the ipasam method above and you will need to set up the server in the same way. However, the way you configure Samba is different.

	~~Get~~ the ~~SID of your samba~~ server ~~with net getlocalsid. Run~~ the ~~following on your FreeIPA server (using kerberos tickets generated by first running <code>kinit admin</code>).~~

	~~The <code>freeipa-client-samba</code> tool will configure samba to use your FreeIPA service using kerberos~~. ~~Users accessing shares would need to do so from a computer that is also on this FreeIPA domain and capable of using kerberos authentication.~~

	~~To use password authentication~~, you ~~will need to~~ configure Samba to use FreeIPA's LDAP server as a passdb backend, similar to how you would do it with plain old LDAP. The nice thing with using FreeIPA is that you can configure it to update the LM and NT password hashes whenever the password is ~~changed~~.

	==== On the Samba server ====		==== On the Samba server ====
Line 273:		Line 272:

	=== Debug samba issues ===		=== Debug samba issues ===
	Use smbclient to help debug issues. <code>smbclient -d 10 -U leo //dnas/home</code>		Use <code>smbclient</code> to help debug issues. This utility is provided by the <code>samba-client</code> package. You can then test authentication by running: <code>smbclient -d 10 -U leo //dnas/home</code>

	== Tasks ==		== Tasks ==