similar to: Azure AD sync + Samba4 DC

For my script : https://github.com/sfonteneau/script_modify_password_googleapps_and_office365 Azure AD: https://github.com/sfonteneau/script_modify_password_googleapps_and_office365/blob/master/script/office/officepassword.py Another idea: AD refuses to change a password on a clear connection. It may be the same for the consultation of the hash? Have you set up lts or ldaps with ad ? The

On Thu, 2020-10-15 at 12:19 +0200, mj via samba wrote: > Hi, > > Reading the microsoft troubleshooting guide, it seems that password > hash > sync issues can be caused by: > > > The Active Directory account used by Azure AD Connect to > > communicate > > with on-premises Active Directory is not granted Replicate > > Directory > > Changes and

Microsoft says: "We synchronize the password hashes" Does a samba DC have similar password hashes as a (real) windows DC? Can we somehow allow the AD Connect to access that hash? It would be SO disappointing if we really need all kinds of extra tools to make this work. :-( And Simon, would you be willing to share a bit more on your https://github.com/Azure/azure-sdk-for-python

Hi, Reading the microsoft troubleshooting guide, it seems that password hash sync issues can be caused by: > The Active Directory account used by Azure AD Connect to communicate > with on-premises Active Directory is not granted Replicate Directory > Changes and Replicate Directory Changes All permissions, which are > required for password synchronization. How to verify existance or

On Sat, 2023-03-11 at 07:38 +0100, Ralph Boehme wrote: > On 3/11/23 04:33, Andrew Bartlett via samba wrote: > > On Fri, 2023-03-10 at 13:06 -0800, Ray Klassen via samba wrote: > > > I'm very interested in this. Can one of the devs elaborate on what has been > > > accomplished with this? Specifically, I'd like to know if the support is > > > bidirectional

Hi, We are (again) looking at syncing our samba AD to the azure AD cloud. I installed a win2016 server domain member server and set it up for syncing, including password hashes, so users can login azure/O365 using their on-prem passwords. We're using microsoft's latest tech: the new "Azure AD Connect cloud provisioning". We made sure to check "password hash sync".

Hi, Meanwhile we have discovered this bug report: https://bugzilla.samba.org/show_bug.cgi?id=10635 where Andrew is asking to test again with modern versions as a first step towards a solution. So I will start upgrading our DCs to latest in de coming period, to see if that helps anything. Strange also that the reporter of bug 10635 is seeing all kinds of error messages logged in azure, and

On Fri, 2023-03-10 at 13:06 -0800, Ray Klassen via samba wrote: > I'm very interested in this. Can one of the devs elaborate on what has been > accomplished with this? Specifically, I'd like to know if the support is > bidirectional -- can azure change passwords in samba ad? No, I just fixed the issue where it couldn't pull a password from Samba to Azure AD Azure AD Cloud

On 3/11/23 04:33, Andrew Bartlett via samba wrote: > On Fri, 2023-03-10 at 13:06 -0800, Ray Klassen via samba wrote: >> I'm very interested in this. Can one of the devs elaborate on what has been >> accomplished with this? Specifically, I'd like to know if the support is >> bidirectional -- can azure change passwords in samba ad? > > No, I just fixed the issue

hello all just to summarize this topic for anybody else. after some time spent with tshooting there seems is a sufficient workaround for this issue: disable "sync of password hashes" option within Azure AD connect tool. with disabling this option all three issues (CPU/Bandwidth utilization/replication logs) are gone! seems that for now the only working option for samba and Azure

That is a major bummer. :-( Would it work any better, if I promoted our windows 2012 server to a domain controller? Or would that have all kinds of other side-effects..? (we're currently running three dc's, all samba) One side-effect I can think of: GPO's, in a mixed samba/windows DC...? Any ideas what the requirements on the samba side would be, for samba to be able to

I'm very interested in this. Can one of the devs elaborate on what has been accomplished with this? Specifically, I'd like to know if the support is bidirectional -- can azure change passwords in samba ad?

Hi, Something else that might be interesting: Azure AD Connect cloud provisioning. https://docs.microsoft.com/en-us/azure/active-directory/cloud-provisioning/what-is-cloud-provisioning It's something new, that I guess could be relevant for someone checking out Azure Sync options. MJ On 7/10/20 10:03 PM, Georges Martin via samba wrote: > > >> Le 9 juil. 2020 ? 19:26,

Hi I tried it but it does not work. I then use: https://github.com/Azure/azure-sdk-for-python This allows to manage my windows azure accounts in a python script. I then create a script that sends the user's password when it changes. It is a system similar to that of "G Suite Password Sync" I use the "Check password script" option in samba. (Valid in the branch 4.5 of

Hi everyone, I like to connect azure ad to my samba4 installation via AD Azure Sync (with password passthrough authentication). Passthrough authentication and User synchronizations working with a Windows 2016 domain member server without any harm. But group membership synchronizations fails always because AD Azure Sync cannot parse the member attribute (reference-value-not-ldap-conformant).

Hi Michal, Thanks for updating, I can confirm your findings on our site. Pass-through auth works nicely here as well. However, when reading the ticket, we understand that Ralph B?hme claims that password-hashes should also work, after making the sync account MSOL_604447e... a member of "domain admins". (instead of keeping the default rights that are granted by the installer, which

just small update: - idfix tool (Directory Synchronization Error Remediation Tool / https://github.com/microsoft/idfix) shows just small issues like empty/missing displayName attrib in some of objects which I have corrected and no more issues present at all. - no errors from AAD connect event viewer: final log message is "Scheduler::SchedulerThreadMain : Completed configured scheduler

On 14/11/2016 0:43, Andrew Bartlett via samba wrote: > On Fri, 2016-11-11 at 11:42 +0100, mj via samba wrote: >> Hi, >> >> We setup the microsoft azure AD Connect on a windows 2012 server, to >> start using (testing) office 365 in the future. We're running a >> samba >> 4.4.4 AD. >> >> This all worked, in the portal.office.com admin section we

On Fri, 2016-11-11 at 11:42 +0100, mj via samba wrote: > Hi, > > We setup the microsoft azure AD Connect on a windows 2012 server, to  > start using (testing) office 365 in the future. We're running a > samba  > 4.4.4 AD. > > This all worked, in the portal.office.com admin section we can see > that: > > > > > Company Name  COMPANY > > Domains

On 09.07.20 18:59, Bernhard Dick via samba wrote: > Hi, > > Am 02.07.2020 um 17:23 schrieb Martin Hauptmann via samba: >> Sorry if I didn't find the right manual. >> >> I would like to set up a new Domain Controller and connect it to an >> existing Office 365 with Exchange in a way, AD-Users of a certain >> group can login and not having to login to