Home / server / Questions / 110199
In Process
nickd
Asked: 2010-02-07 03:27:24 +0800 CST

Using Active Directory authentication with Samba on Ubuntu 9.10 server 64bit

  • 772

I have an Ubuntu server joined to our office Active Directory domain (Windows 2008) and it all seems happy. I can ssh to the server using my AD credentials and home directories get created and all is fine.

I want to share a directory out from the server and use AD authentication (security = ads) using Samba.

Following the docs, I got to the situation where I can see the share externally, but my AD credentials do not allow me to connect.

Using the same credentials from the server itself works using mount.cifs -- i.e. I can mount \\localhost\share using domain\me

I cannot get it to work from my desktop using my AD credentials, but I can connect using a set of Unix credentials so it seems that Samba can't resolve my AD details, but that confuses me as I can use AD credentials using mount.cifs as stated above.

Is there something about the way Windows provides the credentials that Samba doesn't understand?

Bonus question:

I haven't set up Subversion on the server yet, but when I do will I be able to use AD credentials to authenticate on HTTP access via Apache?

ubuntu active-directory samba

2 Answers

  1. The first thing you should do is check your Samba logs, and if need be turn up the log level: http://oreilly.com/catalog/samba/chapter/book/ch04_08.html

    Samba is fairly verbose and helpful when it comes to explaining why a connection was not permitted. You'll no doubt find some very good hints as to what your problem is in the logs. e.g. Find the original error message and do a Google search.

    • 2

  2. When connecting from a windows machine to a share like that you need to specify the domain:

    domain\user

    This is only necessary when the windows machine is not joined to the domain.

    With regards to you second question, the answer is yes. Example config: 

    <Location /svn>
DAV svn
SVNParentPath /path/to/svn
AuthType Basic
AuthName "SVN"
AuthBasicProvider ldap
AuthLDAPBindDN "CN=BINDUSER,CN=Users,DC=domain,DC=com"
AuthLDAPBindPassword BINDPASSWORD
AuthLDAPURL "ldap://ldap.server.hostname:389/OU=Users,DC=company,DC=com?sAMAccountName?sub?(objectClass=*)"
AuthzLDAPAuthoritative off
Require valid-user

    It's important to note that AD will not allow anonymous binds so you'll need to create a user to bind with. Something like svnauth, and replace BINDUSER/BINDPASSORD above.

    • 1