Hi,
I configured a SaMBa PDC and a BDC with a master and a slave OpenLDAP. I set
up TLS, because I wanted secure syncrepl. Slapd runs with -h ldap://
127.0.0.1/ ldaps.///.
I successfully joined an XP client to the servers' domain, I see shares (but
I havent logged in as a domain user, because I have to create a default
profile first).
My problem is in the log.winbindd-idmap log file:
[2009/07/15 09:24:23, 1] winbindd/idmap.c:idmap_init(385)
Initializing idmap domains
[2009/07/15 09:24:23, 0] winbindd/idmap.c:idmap_init(396)
idmap_init: Ignoring domain MYDOMAIN
[2009/07/15 09:24:23, 0] winbindd/idmap.c:idmap_init(549)
ERROR: Could not get methods for backend ldapsam
[2009/07/15 09:24:23, 0] winbindd/idmap.c:idmap_init(801)
Aborting IDMAP Initialization ...
smb.conf:
netbios name = SRV3
dos charset = CP852
unix charset = UTF8
workgroup = MYDOMAIN
interfaces = 127.0.0.0/8, eth0
bind interfaces only = Yes
passdb backend = ldapsam:"ldap://127.0.0.1:389"
passwd program = /usr/bin/passwd %u
passwd chat = *Enter\snew\s*\spassword:* %n\n
*Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .
username map = /etc/samba/username.map
unix password sync = Yes
log level = 1 idmap:10
syslog = 0
log file = /var/log/samba/log.%m
max log size = 1000
smb ports = 139
name resolve order = wins host bcast
time server = Yes
.
.
.
domain logons = Yes
preferred master = Yes
wins support = Yes
ldap admin dn = cn=adm,dc=mydomain,dc=site
ldap group suffix = ou=Groups
ldap idmap suffix = ou=Idmap
ldap machine suffix = ou=People
ldap passwd sync = Yes
ldap suffix = dc=mydomain,dc=site
ldap user suffix = ou=People
eventlog list = Security, Application, Syslog
usershare max shares = 0
usershare path = /home/samba/usershares
panic action = /usr/share/samba/panic-action %d
idmap backend = ldapsam:ldap://127.0.0.1:389
idmap uid = 10000-20000
idmap gid = 10000-20000
map acl inherit = Yes
veto oplock files = /*.pdf/*.pst/
/etc/ldap/ldap.conf:
host 127.0.0.1
base dc=mydomain,dc=site
logdir /var/lib/ldap/log
TLS_REQCERT hard
TLS_CACERT /etc/ssl/certs/cacert.pem
slapd.conf:
#######################################################################
# Global Directives:
# Schema and objectClass definitions
include /etc/ldap/schema/core.schema
include /etc/ldap/schema/cosine.schema
include /etc/ldap/schema/nis.schema
include /etc/ldap/schema/inetorgperson.schema
include /etc/ldap/schema/samba3.schema
pidfile /var/run/slapd/slapd.pid
argsfile /var/run/slapd/slapd.args
loglevel conns stats filter
idletimeout 30
modulepath /usr/lib/ldap
moduleload back_hdb
moduleload syncprov
sizelimit unlimited
tool-threads 1
TLSCertificateFile /etc/ssl/certs/srv3cert.pem
TLSCertificateKeyFile /etc/ssl/private/srv3key.pem
TLSCACertificateFile /etc/ssl/certs/cacert.pem
TLSVerifyClient never
#######################################################################
# Specific Backend Directives for hdb:
# Backend specific directives apply to this backend until another
# 'backend' directive occurs
backend hdb
database hdb
suffix "dc=mydomain,dc=site"
rootdn "cn=adm,dc=mydomain,dc=site"
rootpw {SSHA}.......
directory "/var/lib/ldap"
dbconfig set_cachesize 0 100000000 1
dbconfig set_lk_max_objects 1500
dbconfig set_lk_max_locks 1500
dbconfig set_lk_max_lockers 1500
dbconfig set_lg_regionmax 262144
dbconfig set_lg_bsize 524288
dbconfig set_lg_dir /var/lib/ldap/log
dbconfig set_flags DB_LOG_AUTOREMOVE
index objectClass eq
index cn pres,sub,eq
index sn pres,sub,eq
index uid pres,sub,eq
index displayName pres,sub,eq
index uidNumber eq
index gidNumber eq
index memberUID eq
index sambaSID eq
index sambaPrimaryGroupSID eq
index sambaDomainName eq
index default sub
index sambaSIDList eq
index sambaGroupType eq
index entryCSN,entryUUID eq
lastmod on
checkpoint 512 30
access to *
by dn.exact="cn=replicator,dc=mydomain,dc=site" tls_ssf=128 read
by * break
access to
attrs=userPassword,sambaNTPassword,sambaLMPassword,sambaPwdLastSet,sambaPwdCanChange
by dn="cn=admin,dc=mydomain,dc=site" write
by dn="cn=replicator,dc=mydomain,dc=site" read
by anonymous auth
by self write
by * none
access to dn.base="" by * read
access to *
by dn="cn=admin,dc=mydomain,dc=site" write
by dn="cn=replicator,dc=mydomain,dc=site" read
by self write
by * read
overlay syncprov
syncprov-checkpoint 100 10
syncprov-sessionlog 100
libnss-ldap.conf:
host 127.0.0.1
base dc=mydomain,dc=site
timelimit 50
bind_timelimit 50
bind_policy hard
idle_timelimit 3600
nss_base_passwd ou=People,dc=mydomain,dc=site?one
nss_base_shadow ou=People,dc=mydomain,dc=site?one
nss_base_group ou=Groups,dc=mydomain,dc=site?one
logdir /var/lib/ldap/log
ldap_version 3
rootbinddn cn=adm,dc=mydomain,dc=site
port 389
pam_password exop
ssl off
Thanks,
Tamas.
