samba - Aug 2014 - Joining Domain

I have successfully compiled and installed Samba 4.1.11 from source on
OpenIndiana 151a8.

I tested the server by creating a folder and adding a local samba user
(smbpasswd -a) and mapping a drive from my Windows machine which successded. I
was able to access the test file in the folder as well as edit and save it.

Now I am trying to join my samba server to my domain but it is failing and the
error messages are not helping much and google's responses aren't really
helping.

Can anybody on the list help? When I try and join the domain I get the following
error message:

./net ads join -U krugersa
Enter krugersa's password:
ads_setup_sasl_wrapping() failed: NT_STATUS_NOT_SUPPORTED
kinit succeeded but ads_sasl_spnego_krb5_bind failed: NT_STATUS_NOT_SUPPORTED
Failed to join domain: failed to connect to AD: NT_STATUS_NOT_SUPPORTED


What causes samba to output this particular error message?
"NT_STATUS_NOT_SUPPORTED" is very general...

A copy of my smb.conf file:

[global]
        workgroup = DOMAIN
        realm = AD.DOMAIN.COM
        server string = Samba
        security = ADS
        log file = /var/samba/log/log.%m
        max log size = 50000
        client ldap sasl wrapping = sign
        load printers = No
        local master = No
        domain master = No
        dns proxy = No
        winbind separator = +
        winbind enum users = Yes
        winbind enum groups = Yes
        winbind use default domain = Yes
        idmap config * : range = 20000-800000
        idmap config * : backend = tdb

[homes]
        comment = Home Directories
        read only = No
        browseable = No

[printers]
        comment = All Printers
        path = /var/spool/samba
        printable = Yes
        print ok = Yes
        browseable = No

[testperm]
        path = /testperm
        valid users = @DOMAIN+Admins
        read only = No
        create mask = 0770
        directory mask = 0770

On 27/08/14 10:21, Andre Kruger wrote:
> I have successfully compiled and installed Samba 4.1.11 from source on
OpenIndiana 151a8.
>
> I tested the server by creating a folder and adding a local samba user
(smbpasswd -a) and mapping a drive from my Windows machine which successded. I
was able to access the test file in the folder as well as edit and save it.
>
> Now I am trying to join my samba server to my domain but it is failing and
the error messages are not helping much and google's responses aren't
really helping.
>
> Can anybody on the list help? When I try and join the domain I get the
following error message:
>
> ./net ads join -U krugersa
> Enter krugersa's password:
Does 'krugersa' have the required permissions to join to the domain ? 
have you tried with 'Administrator' ?
> ads_setup_sasl_wrapping() failed: NT_STATUS_NOT_SUPPORTED
> kinit succeeded but ads_sasl_spnego_krb5_bind failed:
NT_STATUS_NOT_SUPPORTED
> Failed to join domain: failed to connect to AD: NT_STATUS_NOT_SUPPORTED
>
>
> What causes samba to output this particular error message?
"NT_STATUS_NOT_SUPPORTED" is very general...
>
> A copy of my smb.conf file:
>
> [global]
>          workgroup = DOMAIN
>          realm = AD.DOMAIN.COM
>          server string = Samba
>          security = ADS
>          log file = /var/samba/log/log.%m
>          max log size = 50000
>          client ldap sasl wrapping = sign
>          load printers = No
>          local master = No
>          domain master = No
>          dns proxy = No
>          winbind separator = +
>          winbind enum users = Yes
>          winbind enum groups = Yes
>          winbind use default domain = Yes
>          idmap config * : range = 20000-800000
>          idmap config * : backend = tdb
You appear to have a portion missing:

         idmap config DOMAIN : backend  = ad
         idmap config DOMAIN : range = 10000-999999
         idmap config DOMAIN : schema_mode = rfc2307

Adjust the range to suit your setup, if your AD users do not have 
uidNumber's change 'ad' to 'rid'

Rowland
>
> [homes]
>          comment = Home Directories
>          read only = No
>          browseable = No
>
> [printers]
>          comment = All Printers
>          path = /var/spool/samba
>          printable = Yes
>          print ok = Yes
>          browseable = No
>
> [testperm]
>          path = /testperm
>          valid users = @DOMAIN+Admins
>          read only = No
>          create mask = 0770
>          directory mask = 0770