samba - Dec 2002 - Samba/LDAP Authentication and SSL Conflicts

I'm having a problem with Samba/LDAP authentication for Windows boxen
from my Samba PDC.  I've diagnosed as much as I can and fiddled with the
relevant settings I know of, but I'm not making any progress.  

I'm running stock Red Hat 8.0 with LDAP (OpenLdap 2.0.25) authentication
(fully tested and working).  I have Samba (ver. 2.2.5) set up as PDC,
which works flawlessly (all shares, roaming profiles, etc.) when using
smbpasswd for authentication.

However, when I rebuild Samba for LDAP authentication (edit samba.spec
to include the --with-ldap option, then rpmbuild -ba samba.spec and
reinstall the RPMs), I observe the following problem.

1) In my smb.conf, the "ldap ssl" option is unspecified, which should
default to "on".

2) Logon from Windows2000 (from a machine already joined to the domain)
is successful - LDAP authenticates the login.

3) However, shares are not visible (e.g. [profiles] and [homes]) because
Samba (on the PDC, which is also the share server) can't connect to the
LDAP server daemon.  Samba can't authenticate the share access request.

4) Set the option "ldap ssl = no" in smb.conf.  Restart Samba, but
KEEP
THE WINDOWS SESSION LOGGED IN (login authentication complete).

5) Share access (on the Windows box) is now granted - Samba can connect
to the LDAP server and authenticate.  The [homes] share is successfully
shared with the already-logged-in Windows2000 session.

6) Logout of the Windows session.  Remember that the Samba option "ldap
ssl = no" is still set.

7) Logon to the Windows session is now broken.  The Windows box can't
access the LDAP authentication server, presumably because I turned off
SSL.

My diagnosis is that Win2kPro uses SSL for secure login but not for
share accesses?  Does this make any sense?  Seems like Samba is polling
different ports for the LDAP, and gets a response one way, but not the
other.

I've tried altering the SSL settings in ldap.conf, but turning these on
makes my Unix side logins fail (I'm not using the SSL capable libraries,
I think, and this conflicts with PAM, or something like that).

I have Samba logs for the events described above, but they're difficult
to export.  Hopefully the diagnosis above is enough, but if anyone has
an idea and the logs would help, I can try to post them as well.

The assorted HOWTOs and websites describing Samba/LDAP are a bit sketchy
on this point (i.e. the interaction of Windows/Samba/LDAP/SSL), and
don't directly address SSL's role in Windows authentication.  I just
can't decipher what it is that I'm missing.

Anybody got an idea for what I can try next?

Thanks in advance,

- Bill
-- 
Bill Alexander <bill.alexander@mrcmry.com>
Mission Research Corporation

My solution: 

That part about the Samba authentication was the most confusing bit, as
others suggested: I completely agree with the replies I received that
the SSL shouldn't have had anything to do with it.  And, it turns out,
it didn't.

The machine in question had cached my account's authenticator.  When it
failed to contact the LDAP server (due to the SSL problem), it relied on
its own cache.  I incorrectly assumed I was authenticating - a deeper
study of my logs revealed that SSL was completely unrelated.  I didn't
even think of this until one of my users tried to authenticate and it
didn't work.

My problem with the machine not authenticating had to do with the secret
salt in /etc/samba/secrets.tdb - the new LDAP machine's account password
hash was different.  Very frustrating, but I wiped out the old one,
rejoined the machine to the domain, and voilla - it's fixed.

Thanks again for the responses.

- Bill


On Thu, 2002-12-05 at 13:55, Bill Alexander wrote:
> I'm having a problem with Samba/LDAP authentication for Windows boxen
> from my Samba PDC.  I've diagnosed as much as I can and fiddled with
the
> relevant settings I know of, but I'm not making any progress.  
> 
REMAINDER DELETED

Bill Alexander <bill.alexander@mrcmry.com>
Mission Research Corporation