roudoudou
2007-Jul-14 22:36 UTC
[Samba] strange behaviour of the "ldap passwd sync" option
Hi, i'm trying to set up a samba (samba 3.0.25a) PDC with the ldapsam backend on FreeBSD (FreeBSD 6.2) and i have some trouble with the "ldap passwd sync" option. I must say here that my goal is to use the ldap smbk5pwd overlay in order to keep in sync the unix and samba password when the user change his password from a unix workstation either via ldappaswd or passwd (configuration file below) Here is what i've observed so far: * if i set in smb.conf, "ldap passwd sync = Only": when a user try to modify his password with smbpasswd, then despite the message success of the operation, one can see that the userPassword field of this user in the ldap server wasn't modified (the sambaLMPassword and sambaNTPassword wasn't modified neither but that's consistent with the man page). In fact wireshark didn't show any trace of a LDAP Password Modify extended operation sent to the ldap server * If i set in smb.conf, "ldap passwd sync = Yes": everything works. Wireshark shows an "Password Modify Request and Response" (oid=1.3.6.1.4.1.4203.1.11.1) exchanged between the client and the ldap server but oddly no ldapModifyRequest. The slapd logs ("loglevel 4" was set in slapd.conf) shows the functions calls below: ----- Jul 14 22:36:32 dell076 slapd[76792]: bdb_modify_internal: replace userPassword Jul 14 22:36:32 dell076 slapd[76792]: bdb_modify_internal: replace sambaPwdLastSet Jul 14 22:36:32 dell076 slapd[76792]: bdb_modify_internal: replace sambaLMPassword Jul 14 22:36:32 dell076 slapd[76792]: bdb_modify_internal: replace sambaNTPassword Jul 14 22:36:32 dell076 slapd[76792]: bdb_modify_internal: replace entryCSN Jul 14 22:36:32 dell076 slapd[76792]: bdb_modify_internal: replace modifiersName Jul 14 22:36:32 dell076 slapd[76792]: bdb_modify_internal: replace modifyTimestamp ----- * if i set in smb.conf, "ldap passwd sync = No": then the samba*Password attribute are modified when calling smbpasswd whereas the userPassword attribute is left unchanged. Wireshark shows an exchange of LDAP modifyRequest/Response between the client and the ldap server. The slapd logs recorded the function calls below: ---- Jul 15 00:07:32 dell076 slapd[76865]: bdb_modify_internal: delete sambaLMPassword Jul 15 00:07:32 dell076 slapd[76865]: bdb_modify_internal: add sambaLMPassword Jul 15 00:07:32 dell076 slapd[76865]: bdb_modify_internal: delete sambaNTPassword Jul 15 00:07:32 dell076 slapd[76865]: bdb_modify_internal: add sambaNTPassword Jul 15 00:07:32 dell076 slapd[76865]: bdb_modify_internal: delete sambaPwdLastSet Jul 15 00:07:32 dell076 slapd[76865]: bdb_modify_internal: add sambaPwdLastSet Jul 15 00:07:32 dell076 slapd[76865]: bdb_modify_internal: replace entryCSN Jul 15 00:07:32 dell076 slapd[76865]: bdb_modify_internal: replace modifiersName Jul 15 00:07:32 dell076 slapd[76865]: bdb_modify_internal: replace modifyTimestamp ----- So i was just wondering if: * "ldap passwd sync = Only" option is deprecated ? * it was harmless to specify "ldap passwd sync = Yes" in smb.conf when one use the ldap smbk5pwd overlay to keep in sync the unix/windows password ? Thanks :-)