samba - May 2006 - Domain Logins across VPN

I've been trying to get this to work for a few days now. I read that
domain requests are sent via broadcast, and to use WINS to get around it.

Well, I've enabled the WINS server on my Samba PDC, and told the BDC's
on
each VPN segment that the PDC is a WINS server. WINS resolution works
apparently, I can sit on a VPN'd network segment and ping machines across
the VPN via their NETBIOS name, but I can't log into the domain. Windows
tells me it can't find the domain. Is there something I'm missing?

rob@desynched.net wrote:
> I've been trying to get this to work for a few days now. I read that
> domain requests are sent via broadcast, and to use WINS to get around it.
> 
> Well, I've enabled the WINS server on my Samba PDC, and told the
BDC's on
> each VPN segment that the PDC is a WINS server. WINS resolution works
> apparently, I can sit on a VPN'd network segment and ping machines
across
> the VPN via their NETBIOS name, but I can't log into the domain.
Windows
> tells me it can't find the domain. Is there something I'm missing?
sorry rob, i forgot to reply-to-all the first time.

do you have

domain master = no
domain logons = yes

that set up works for me. and i also use

local master = yes

though i don't think the local master is required for bdc functionality.

-- 
Anthony
http://messinet.com
http://messinet.com/~amessina/gallery
8F89 5E72 8DF0 BCF0 10BE 9967 92DC 35DC B001 4A4E

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 189 bytes
Desc: OpenPGP digital signature
Url :
http://lists.samba.org/archive/samba/attachments/20060524/8e08d7c0/signature.bin

----- Original Message -----
From: "Duncan Brannen" <dbb@st-andrews.ac.uk>
Cc: <samba@lists.samba.org>
Sent: Friday, May 26, 2006 4:12 AM
Subject: Re: [Samba] Domain Logins across VPN

>> This configuration works. If I change passdb to 127.0.0.1 instead of
>> the Master LDAP's IP, this pops up in samba.smbd:
>>
>> [2006/05/24 14:53:30, 1] lib/smbldap_util.c:add_new_domain_info(198)
>>  failed to add domain dn>>
sambaDomainName=ATWORK,dc=atworkpersonnel,dc=com with: Server is
>> unwilling to perform
>>        shadow context; no update referral
>> [2006/05/24 14:53:30, 0]
>> lib/smbldap_util.c:smbldap_search_domain_info(258)
>>  Adding domain info for ATWORK failed with NT_STATUS_UNSUCCESSFUL
>>
>>
>> That's the only error I see popping up. Ideas?
>
> Has the entry dn= sambaDomainName=ATWORK,dc=atworkpersonnel,dc=com
> replicated across to your slave
> ldap server successfully?
>
> Check your ldap logs on the slave, I think samba does a lookup for the
> domain and adds it if it doesn't exist, otherwise
> is the updateref set in your slaves slapd.conf file?  If the slave ldap
> server is telling samba it doesn't accept changes but
> not telling it where to send changes ( no update referral) you might get
> this problem.
>
> Hope this helps
>
>       Duncan
Hi Duncan,
I'm not using slurpd for replication; I'm using syncrepl. The database
exists and is updated fine (if I add a user on the master, it exists on the
slave, etc).

I'm using the smbldap tools for samba, and on the slave machines, they
generate an error any time I try to use them (unless I point them at the
Master LDAP).

for example, if I try this:
smbldap-useradd -a testuser

it returns:
Error: shadow context; no update referral at
/usr/local/sbin//smbldap_tools.pm line 1005.


I believe this has something to do with the issue.

--
Rob