thr3ads.net - samba - [Samba] Samba and ldap groups [Apr 2003]

If this information is useful, please help other people find it:
Share via:

Kristyan Osborne

2003-Apr-08 14:31 UTC

[Samba] Samba and ldap groups

Hi,

I have just put Samba3alpha23 on my Suse 8.1 box and and implement the new goup
structure in LDAP.

All works fine expect when you log in a a user other than root on the windows
box. The error is :

[2003/04/08 13:30:19, 0] passdb/pdb_ldap.c:ldapsam_search_one_group(2198)
  ldapsam_search_one_group: Problem during the LDAP search: LDAP error: 
(Insufficient access)ldapsam_open: cannot access LDAP when not root..
[2003/04/08 13:30:19, 0] passdb/pdb_ldap.c:ldapsam_retry_open(509)
  Connection to LDAP Server failed for the 1 try!
[2003/04/08 13:30:19, 0] passdb/pdb_ldap.c:ldapsam_setsamgrent(2567)
  LDAP search failed: Insufficient access
[2003/04/08 13:30:19, 0] passdb/pdb_ldap.c:ldapsam_enum_group_mapping(2629)
  Unable to open passdb

How should I set samba up so that normal users can access the LDAP directory and
not have to be root???

Cheers

---------
Kristyan Osborne - IT Technician
Longhill High School
01273 391672

Maarten Buiter

2003-Apr-08 15:06 UTC

head link

[Samba] Samba and ldap groups

Hi Kristyan,

This might have something to do with your Access Control Lists for your
LDAP directory. Most likely you have installed your LDAP directory so
that only root can query it.

If you are using OpenLDAP, you can edit (or create) your ACLs in the
slapd.conf file. The OpenLDAP Administrator Guide Provides a few
simple examples.

If this is not the case, please provide some more information!

Success,

Maarten Buiter



Kristyan Osborne wrote:
>Hi,
>
>I have just put Samba3alpha23 on my Suse 8.1 box and and implement the new
goup structure in LDAP.
>
>All works fine expect when you log in a a user other than root on the
windows box. The error is :
>
>[2003/04/08 13:30:19, 0] passdb/pdb_ldap.c:ldapsam_search_one_group(2198)
>  ldapsam_search_one_group: Problem during the LDAP search: LDAP error: 
(Insufficient access)ldapsam_open: cannot access LDAP when not root..
>[2003/04/08 13:30:19, 0] passdb/pdb_ldap.c:ldapsam_retry_open(509)
>  Connection to LDAP Server failed for the 1 try!
>[2003/04/08 13:30:19, 0] passdb/pdb_ldap.c:ldapsam_setsamgrent(2567)
>  LDAP search failed: Insufficient access
>[2003/04/08 13:30:19, 0] passdb/pdb_ldap.c:ldapsam_enum_group_mapping(2629)
>  Unable to open passdb
>
>How should I set samba up so that normal users can access the LDAP directory
and not have to be root???
>
>Cheers
>
>---------
>Kristyan Osborne - IT Technician
>Longhill High School
>01273 391672
>  
>

Kristyan Osborne

2003-Apr-08 15:36 UTC

head link

[Samba] Samba and ldap groups

Hi,

Ive just tried to allow everyone access to everything by putting the following
in slapd.conf:
        
Allow read by all
Allow write by all
defaultaccess write


Still no joy :-(

Any ideas??

Cheers

Kris


-----Original Message-----
From:	Maarten Buiter [mailto:maarten.buiter@fredhopper.com]
Sent:	Tue 08/04/2003 16:06
To:	samba@lists.samba.org
Cc:	
Subject:	Re: [Samba] Samba and ldap groups

Hi Kristyan,

This might have something to do with your Access Control Lists for your
LDAP directory. Most likely you have installed your LDAP directory so
that only root can query it.

If you are using OpenLDAP, you can edit (or create) your ACLs in the
slapd.conf file. The OpenLDAP Administrator Guide Provides a few
simple examples.

If this is not the case, please provide some more information!

Success,

Maarten Buiter



Kristyan Osborne wrote:
>Hi,
>
>I have just put Samba3alpha23 on my Suse 8.1 box and and implement the new
goup structure in LDAP.
>
>All works fine expect when you log in a a user other than root on the
windows box. The error is :
>
>[2003/04/08 13:30:19, 0] passdb/pdb_ldap.c:ldapsam_search_one_group(2198)
>  ldapsam_search_one_group: Problem during the LDAP search: LDAP error: 
(Insufficient access)ldapsam_open: cannot access LDAP when not root..
>[2003/04/08 13:30:19, 0] passdb/pdb_ldap.c:ldapsam_retry_open(509)
>  Connection to LDAP Server failed for the 1 try!
>[2003/04/08 13:30:19, 0] passdb/pdb_ldap.c:ldapsam_setsamgrent(2567)
>  LDAP search failed: Insufficient access
>[2003/04/08 13:30:19, 0] passdb/pdb_ldap.c:ldapsam_enum_group_mapping(2629)
>  Unable to open passdb
>
>How should I set samba up so that normal users can access the LDAP directory
and not have to be root???
>
>Cheers
>
>---------
>Kristyan Osborne - IT Technician
>Longhill High School
>01273 391672
>  
>


-- 
To unsubscribe from this list go to the following URL and read the
instructions:  http://lists.samba.org/mailman/listinfo/samba

Kristyan Osborne

2003-Apr-08 18:22 UTC

head link

[Samba] Samba and ldap groups

Hi,
 
Do you think you could send your slapd.conf file and your smb.conf file to me so
I can see how your set up differes from mine.
 
Cheers
 
----------
Kristyan Osborne - IT Technician
Longhill High School
01273 391672

	-----Original Message----- 
	From: Bradley W. Langhorst [mailto:brad@langhorst.com] 
	Sent: Tue 08/04/2003 19:12 
	To: Uwe Laverenz 
	Cc: samba@lists.samba.org 
	Subject: Re: [Samba] Samba and ldap groups
	
	

	On Tue, 2003-04-08 at 11:50, Uwe Laverenz wrote:
	> Maarten Buiter schrieb:
	>
	> > This might have something to do with your Access Control Lists for
your
	> > LDAP directory. Most likely you have installed your LDAP directory so
	> > that only root can query it.
	>
	> Nope, I have the same problem here with 3.0alpha23. It worked with the
	> same LDAP-dir in previous tests with 3.0alpha21. The new samba.schema
	> with GroupMapping is installed, of course.
	did you run the required command to import your groups to the ldap db?
	
	pdbedit -i tdbsam -e ldapsam -g
	
	
	I found group mapping to work without a problem in my limited test.
	
	> I intended to use 3.0 in a production environment, but I think it's
not
	> ready yet.
	i'm using a22 in production now - there are some problems with printing
	that I did not have with a21.  I found a23 and head from yesterday to be
	unusable due to serious printing problems.
	
	It is possible to use the samba.schema from a23 with a22
	 - no problems after 1 day of use.
	
	brad
	
	
	
	--
	Bradley W. Langhorst <brad@langhorst.com>
	
	--
	To unsubscribe from this list go to the following URL and read the
	instructions:  http://lists.samba.org/mailman/listinfo/samba

Kristyan Osborne

2003-Apr-09 07:44 UTC

head link

[Samba] Samba and Ldap Groups

Hi,
 
Still no luck, I have given access to everything in the LDAP directory to
everyone and I still get the same error message. Do I need to specify
somewhere/somehow if normal users and access the LDAP directory??
 >[2003/04/08 13:30:19, 0] passdb/pdb_ldap.c:ldapsam_search_one_group(2198)
>  ldapsam_search_one_group: Problem during the LDAP search: LDAP error: 
(Insufficient access)ldapsam_open: cannot access LDAP when not root..
>[2003/04/08 13:30:19, 0] passdb/pdb_ldap.c:ldapsam_retry_open(509)
>  Connection to LDAP Server failed for the 1 try!
>[2003/04/08 13:30:19, 0] passdb/pdb_ldap.c:ldapsam_setsamgrent(2567)
>  LDAP search failed: Insufficient access
>[2003/04/08 13:30:19, 0] passdb/pdb_ldap.c:ldapsam_enum_group_mapping(2629)
>  Unable to open passdb 
Cheers
 
Kristyan Osborne

John H Terpstra

2003-Apr-09 08:26 UTC

head link

[Samba] Samba and Ldap Groups

On Wed, 9 Apr 2003, Kristyan Osborne wrote:
> Hi,
>  Still no luck, I have given access to everything in the LDAP directory
> to everyone and I still get the same error message. Do I need to specify
> somewhere/somehow if normal users and access the LDAP directory??
Check for how to set up LDAP ACLs in your slapd.conf file. Also, watch
carefully how you set up the admin access through smb.conf and smbpasswd.

Some of this will be better documented for Samba-3 - still being worked
on. If you can spare the cycles, check out the current
Samba-HOWTO-Collection.pdf in the HEAD branch and give me any materials or
notes you have that you think might help others.

- John T.
>
> >[2003/04/08 13:30:19, 0]
passdb/pdb_ldap.c:ldapsam_search_one_group(2198)
> >  ldapsam_search_one_group: Problem during the LDAP search: LDAP error:
> >(Insufficient access)ldapsam_open: cannot access LDAP when not root..
> >[2003/04/08 13:30:19, 0] passdb/pdb_ldap.c:ldapsam_retry_open(509)
> >  Connection to LDAP Server failed for the 1 try!
> >[2003/04/08 13:30:19, 0] passdb/pdb_ldap.c:ldapsam_setsamgrent(2567)
> >  LDAP search failed: Insufficient access
> >[2003/04/08 13:30:19, 0]
passdb/pdb_ldap.c:ldapsam_enum_group_mapping(2629)
> >  Unable to open passdb
>
> Cheers
>
> Kristyan Osborne
>
-- 
John H Terpstra
Email: jht@samba.org
-------------- next part --------------
-- 
To unsubscribe from this list go to the following URL and read the
instructions:  http://lists.samba.org/mailman/listinfo/samba

Kristyan Osborne

2003-Apr-09 15:27 UTC

head link

[Samba] Samba and Ldap Groups

Hi,
 
running the command:
ldapsearch -h 10.108.3.6 -x -b
'dc=longhill,dc=brighton-hove,dc=sch,dc=uk' -s sub
'(objectclass=*)' uid
 
returns all the entries in the ldap directory when run by root or any other
user.
 
This leads me to believe that there is nothing wrong with the LDAP side.
I have attached my slapd.conf and smb.conf files so people can have a look and
see what they think.
 
Cheers
 
Kristyan Osborne

	-----Original Message----- 
	From: Bradley W. Langhorst [mailto:brad@langhorst.com] 
	Sent: Wed 09/04/2003 14:54 
	To: Kristyan Osborne 
	Cc: samba@lists.samba.org 
	Subject: Re: [Samba] Samba and Ldap Groups
	
	

	On Wed, 2003-04-09 at 03:44, Kristyan Osborne wrote:
	> Hi,
	> 
	> Still no luck, I have given access to everything in the LDAP directory to
everyone and I still get the same error message. Do I need to specify
somewhere/somehow if normal users and access the LDAP directory??
	> 
	> >[2003/04/08 13:30:19, 0]
passdb/pdb_ldap.c:ldapsam_search_one_group(2198)
	> >  ldapsam_search_one_group: Problem during the LDAP search: LDAP
error:  (Insufficient access)ldapsam_open: cannot access LDAP when not root..
	> >[2003/04/08 13:30:19, 0] passdb/pdb_ldap.c:ldapsam_retry_open(509)
	> >  Connection to LDAP Server failed for the 1 try!
	> >[2003/04/08 13:30:19, 0] passdb/pdb_ldap.c:ldapsam_setsamgrent(2567)
	> >  LDAP search failed: Insufficient access
	> >[2003/04/08 13:30:19, 0]
passdb/pdb_ldap.c:ldapsam_enum_group_mapping(2629)
	> >  Unable to open passdb
	> 
	
	start debugging ldap using the command line tools (not samba)
	does ldapsearch -x work?
	
	post relevant sections of your smb.conf file and your slapd.conf file
	maybe I'll see an error.
	
	did you set the ldap admin password in samba
	smbpasswd -w i think
	
	brad
	--
	Bradley W. Langhorst <brad@langhorst.com>
	
	

-------------- next part --------------
# $OpenLDAP: pkg/ldap/servers/slapd/slapd.conf,v 1.8.8.7 2001/09/27 20:00:31
kurt Exp $
#
# See slapd.conf(5) for details on configuration options.
# This file should NOT be world readable.
#
include		/usr/local/etc/openldap/schema/core.schema
include		/usr/local/etc/openldap/schema/cosine.schema
include		/usr/local/etc/openldap/schema/nis.schema
include		/usr/local/etc/openldap/schema/inetorgperson.schema
include		/usr/local/etc/openldap/schema/samba.schema
include		/usr/local/etc/openldap/schema/reg.schema

# Define global ACLs to disable default read access.

# Do not enable referrals until AFTER you have a working directory
# service AND an understanding of referrals.
#referral	ldap://root.openldap.org

pidfile		/usr/local/var/slapd.pid
argsfile	/usr/local/var/slapd.args

password-hash	{CRYPT}

# Load dynamic backend modules:
# modulepath	/usr/local/libexec/openldap
# moduleload	back_ldap.la
# moduleload	back_ldbm.la
# moduleload	back_passwd.la
# moduleload	back_shell.la

#
# Sample Access Control
#	Allow read access of root DSE
#	Allow self write access
#	Allow authenticated users read access
#	Allow anonymous users to authenticate
#
#access to * by * write
#access to dn="" by * read
#access to dn="" by * write
#access to *
#	by self write
#	by users read
#	by anonymous auth
#
# if no access controls are present, the default is:
#	Allow read by all
#	Allow write by all
#
# rootdn can always write!

#defaultaccess write

access to attribute=userPassword,lmPassword,ntPassword
	by peername="IP=127\.0\.0\.1"
dn="cn=root,dc=longhill,dc=brighton-hove,dc=sch,dc=uk" write
	by peername="IP=127\.0\.0\.1" anonymous auth
	by peername="IP=10\.108\.10\.149" anonymous auth
	by peername="IP=10\.108\.10\.149"
dn="cn=root,dc=longhill,dc=brighton-hove,dc=sch,dc=uk" write
	by ssf=112 dn="cn=root,dc=longhill,dc=brighton-hove,dc=sch,dc=uk"
write
	by ssf=112 anonymous auth
	by self write
	by * none

access to *
	by peername="IP=127\.0\.0\.1"
dn="cn=root,dc=longhill,dc=brighton-hove,dc=sch,dc=uk" write
	by peername="IP=10\.108\.10\.149"
dn="cn=root,dc=longhill,dc=brighton-hove,dc=sch,dc=uk" write
	by ssf=112 dn="cn=root,dc=longhill,dc=brighton-hove,dc=sch,dc=uk"
write
	by * read

#######################################################################
# ldbm database definitions
#######################################################################

database	ldbm
suffix		"dc=longhill,dc=brighton-hove,dc=sch,dc=uk"
suffix		"o=Longhill High School,c=UK"
rootdn		"cn=root,dc=longhill,dc=brighton-hove,dc=sch,dc=uk"
#rootdn		"cn=Manager,o=My Organization Name,c=US"
# Cleartext passwords, especially for the rootdn, should
# be avoid.  See slappasswd(8) and slapd.conf(5) for details.
# Use of strong authentication encouraged.
rootpw		secret
# The database directory MUST exist prior to running slapd AND 
# should only be accessible by the slapd/tools. Mode 700 recommended.
directory	/usr/local/var/openldap-ldbm
# Indices to maintain
index	primaryGroupID  eq
index	rid		eq
index	uid		eq
index	uidNumber	eq
index	gidNumber	eq
index	cn		eq
index	objectClass	eq
index	default		eq

sizelimit 5000

# replica biT
#updatedn "cn=root,dc=longhill,dc=brighton-hove,dc=sch,dc=uk"
#updateref ldap://ds1
-------------- next part --------------
#======================= Global Settings
====================================[global]
	netbios name = MCTPDC
	server string = Longhill Home Directories (%v,%h)
	workgroup = test
	socket options = TCP_NODELAY SO_SNDBUF=16384 SO_RCVBUF=4096
	name resolve order = lmhosts host bcast
	os level = 65
	domain master = yes 
	domain logons = yes
	local master = yes
	preferred master = yes
        guest ok = yes

	#NO LONGER NEEDED
	#logon script = %G.BAT

	#TIME SERVER STUFF
	time server = yes
	time offset = 60
	#Uncomment the following line for BST
	#time offset = 0

	security = user
	password level = 3
	guest account = nobody
	read size = 16384
	max xmit = 65520
	load printers = no
	printing = bsd
	printcap name = /etc/printcap
	debug level = 1
	log file = /usr/local/samba/var/log.%m
	max log size = 200
	deadtime = 1
	hosts allow = 10.108. 127.
	encrypt passwords = yes

	#NO LONGER SUPPORTED
	#domain admin group = @domadm
	#domain admin group = @users
 	;domain groups = @users @author @students

	#NO LONGER NEEDED
	#logon drive = w:
	#logon path = \\%L\Profiles
	#logon home = \\%L\%U	
	#unix password sync = yes 
	#passwd program = /usr/local/sbin/passsync -username=%u
	#passwd chat = "*Old*Password:*" %o\n "*New*Password:*"
%n\n "*Password*changed*"
	#passwd chat debug = yes
	#log level = 101


	#NT Stuff
	nt pipe support = yes
	#Uncomment for pre alpha 19
	#use spnego = no
	preserve case = yes
        case sensitive = no
        allow trusted domains = yes

	#Automation of additional machines to domain
	#NO LONGER SUPPORTED
	#add user script = /usr/local/samba/bin/addmachine.pl -name=%m

	add machine script = /usr/local/sbin/smbldap-useradd.pl -w %m

	#LDAP Stuff
	ldap server = 10.108.3.6
	passdb backend = ldapsam:ldap://pc406.longhill.brighton-hove.sch.uk/
	ldap admin dn = "cn=root,dc=longhill,dc=brighton-hove,dc=sch,dc=uk"
	ldap ssl = no
	#ldap filter = "ou=Groups,dc=longhill,dc=brighton-hove,dc=sch,dc=uk"
	#Uncomment for pre alpha 19
	ldap suffix = "dc=longhill,dc=brighton-hove,dc=sch,dc=uk"
	ldap user suffix =
"ou=Users,dc=longhill,dc=brighton-hove,dc=sch,dc=uk"
	ldap machine suffix =
"ou=Computers,dc=longhill,dc=brighton-hove,dc=sch,dc=uk"
	#ldap passwd sync = Only
	ldap trust ids =yes

#============================ Share Definitions
=============================[netlogon]
   comment = Network Logon
   path = /usr/local/samba/lib/netlogon
   browseable = yes
   guest ok = yes
   writeable = yes
   locking = no
   public = no
   admin users = kris
   #root preexec = /usr/local/samba/bin/chkprofile %u %G %H
   #root preexec = /usr/local/samba/bin/test %H
   veto files = /*.eml/*.nwc/*.nws/riched20.dll/
   delete veto files = true

 [homes]
   comment = Home Directories
   browseable = no
   valid users = %S
   invalid users = root
   hide dot files = yes
   writable = yes
   dont descend = profile
   veto files = /*.eml/*.nwc/*.nws/riched20.dll/
   delete veto files = true

 [admin]
   comment = Admin Staff
   browseable = yes
   path = /home/shares/admin
   valid users = +admin,+smt,+finance,james
   create mask = 0770
   directory mask = 0770
   force group = admin
   writeable = no
   write list = +admin,+finance,james
   veto files = /*.eml/*.nwc/*.nws/riched20.dll/
   delete veto files = true

 [finance]
   comment = Finance Staff
   browseable = yes
   path = /home/shares/finance
   valid users = +finance,jimmy
   create mask = 0770
   directory mask = 0770
   force group = finance
   writeable = yes
   veto files = /*.eml/*.nwc/*.nws/riched20.dll/
   delete veto files = true

 [premises]
   comment = Finance-Premises
   browseable = yes
   path = /home/shares/premises
   valid users = ianbolin,+finance,kris,jimmy
   create mask = 0770
   directory mask = 0770
   force group = staff
   writeable = yes
   veto files = /*.eml/*.nwc/*.nws/riched20.dll/
   delete veto files = true

 [NRA]
   comment = Record of Achievement
   browseable = yes 
   path = /home/shares/NRA
   create mask = 0775
   valid users = +students,+staff
   force group = students
   guest ok = no
   writeable = yes
   veto files = /*.eml/*.nwc/*.nws/riched20.dll/
   delete veto files = true

# [SIMS]
#   comment = SIMS
#   browseable = yes
#   path = /SIMS
#   create mask = 0770
#   directory mask = 0770
#   valid users = +staff
#   force group = staff
#   guest ok = no
#   writeable = yes
#   veto files = /*.eml/*.nwc/*.nws/riched20.dll/
#   delete veto files = true
#   write list = +staff

#  [Profiles]
#    browseable = no
#    path = /home/staff/james/profile
#    create mask = 0777
#    locking = no
#    guest ok = no
#    writeable = yes
#    nt acl support = yes
#    veto files = /*.eml/*.nwc/*.nws/riched20.dll/
#    delete veto files = true

#  [everyone]
#    comment = Everyone
#    browsable = yes
#    writable = yes
#    path = /home
#    valid users = kris,alex,james
#    admin users = kris,alex,james
#    force user = root
#    veto files = /*.eml/*.nwc/*.nws/riched20.dll/
#    delete veto files = true

  [LHSregShell]
    comment = LHSregShell
    browsable = yes
    path = /usr/local/samba/lib/LHSregShell
    admin users = kris
    writable = yes   
    create mask = 755
    veto files = /*.eml/*.nwc/*.nws/riched20.dll/
    delete veto files = true

   [netbench]
     path = /netbench
     read only = no
     guest ok = yes
     create mask = 777

Seemingly Similar Threads

Search for more apparently analagous threads

samba - Apr 2003 - Samba and ldap groups

[Samba] Samba and ldap groups

[Samba] Samba and ldap groups

[Samba] Samba and ldap groups

[Samba] Samba and ldap groups

[Samba] Samba and Ldap Groups

[Samba] Samba and Ldap Groups

[Samba] Samba and Ldap Groups

Seemingly Similar Threads