CentOS - Sep 2016 - CentOS 6.8 and samba

> You might want to take a look at "Integrating Red Hat Enterprise Linux
6 with Active Directory". It's the best document I've seen on this
topic. I found that Samba/Kerberos/Winbind is the most complete solution for
attaching a Samba fileserver in my AD environment.
https://access.redhat.com/sites/default/files/attachments/rhel-ad-integration-deployment-guidelines-v1.5.pdf
 
I already figured it out earlier this afternoon and have a working setup. Will
review the above.

[your setup instructions]

Here, I'm not modifying any of the hosts/resolv.conf/nsswitch.conf files.
This is not an integration exercise, only a samba fileserver with AD auth.
> If you are editing a smb.conf file of a previously existing Samba
fileserver, do not change the range value in the "idmap config * : range
=" parameter
winbindd(8) mentions "netlogon proxy only mode", so I commented out
all the range settings (after first verifying that it worked with them).
> 3. Start the smb and winbind services:
I find it will not work without nmb.
> 6. Verify the bind to AD is valid:
> a. net ads info
> b. net ads testjoin
Brilliant, I didn't know these commands.
> 7. Create a Kerberos /etc/krb5.keytab file:
> net ads keytab create -U username
> 8. Verify the contents of the Kerberos keytab file:
> klist -ke
This is a step I was missing. What is the purpose of the keytab? Can it help
with the default ticket FILE:/tmp/krb5cc_0 expiration?

I'm also facing this problem, although everything seems to work fine.
I've tested with smbclient and a Windows client.

# net ads testjoin
gss_init_sec_context failed with [Unspecified GSS failure.  Minor code may
provide more information: No credentials cache found]
Join is OK
#

> > net ads keytab create -U username
> > 8. Verify the contents of the Kerberos keytab file:
> > klist -ke
> 
> This is a step I was missing. What is the purpose of the keytab? Can it
help
> with the default ticket FILE:/tmp/krb5cc_0 expiration?
A Kerberos keytab contains Kerberos principals and encrypted keys which can be
used to authenticate without entering a password. That should address your
ticket expiration issue.
> I'm also facing this problem, although everything seems to work fine.
I've
> tested with smbclient and a Windows client.
> 
> # net ads testjoin
> gss_init_sec_context failed with [Unspecified GSS failure.  Minor code may
> provide more information: No credentials cache found] Join is OK #
Not sure what would cause that error message, nor have I experienced it. Looks
like other people have seen it:
https://www.google.com/?gws_rd=ssl#q=gss_init_sec_context+failed+with+%5BUnspecified+GSS+failure.++Minor+code+may+provide+more+information:+No+credentials+cache+found

> Not sure what would cause that error message, nor have I experienced it.
Looks like other people have seen it:
>
https://www.google.com/?gws_rd=ssl#q=gss_init_sec_context+failed+with+%5BUnspecified+GSS+failure.++Minor+code+may+provide+more+information:+No+credentials+cache+found
I found no way to get rid of this, although everything seems to work fine.

Red Hat need to push out an update to samba4 and fix bug 10604. It's highly
irritating, and the workaround
https://bugzilla.samba.org/show_bug.cgi?id=10604#c30 doesn't. The patch from
https://bugzilla.samba.org/show_bug.cgi?id=10604#c17 does.