Hello all,

I'm following the howto http://wiki.freeradius.org/FreeRADIUS_Active_Directory_Integration_HOWTO to integrate FreeRadius with Microsoft's AD. However, I'm experiencing some troubles.

My disto is Debian 4. I had to install some packages, like krb5-kdc, krb5-user and krb5-config, to have the file /etc/krb5.conf (It wasn't there in the first place).

When I want to do a net join, I get a message saying that I have errors in my krb5.conf file. I removed the lines "dns_lookup_realm = false" and "dns_lookup_kdc = false" and then it worked.

At least I think it did. I got the message: joined "PROJECT" to realm "PROJECT.LOCAL".

When I then wanted to test this using wbinfo, I get the error code "NT_STATUS_NO_SUCH_USER" (should be normal according to the howto) and another one: "NT_STATUS_ACCESS_DENIED" Could not authenticate user myuser with challenge/response. A try with ntlm_auth is also negative "NT_STATUS_NO_SUCH_USER".

Can somebody please help me with my problem? Am I overlooking something or what am I doing wrong?

Thanks a million,

Rutger

Here are the 2 config files:

smb.conf

[global]

## Browsing/Identification ###

   workgroup = project
   server string = %h server
   dns proxy = no

#### Debugging/Accounting ####

   log file = /var/log/samba/log.%m
   max log size = 1000
   syslog = 0
   panic action = /usr/share/samba/panic-action %d

####### Authentication #######

# "security = user" is always a good idea. This will require a Unix account
# in this server for every user accessing the server. See
# /usr/share/doc/samba-doc/htmldocs/Samba3-HOWTO/ServerType.html
# in the samba-doc package for details.
security = ads

# You may wish to use password encryption. See the section on
# 'encrypt passwords' in the smb.conf(5) manpage before enabling.
encrypt passwords = true

# If you are using encrypted passwords, Samba will need to know what
# password database type you are using.
passdb backend = tdbsam

obey pam restrictions = yes

; guest account = nobody
invalid users = root

passwd program = /usr/bin/passwd %u
passwd chat = *Enter\snew\sUNIX\spassword:* %n\n *Retype\snew\sUNIX\spassword:* %n\n *password\supdated\ssuccessfully* .

# This boolean controls whether PAM will be used for password changes
# when requested by an SMB client instead of the program listed in
# 'passwd program'. The default is 'no'.
; pam password change = no

############ Misc ############

# Most people will find that this option gives better performance.
# See smb.conf(5) and /usr/share/doc/samba-doc/htmldocs/Samba3-HOWTO/speed.html
# for details
# You may want to add the following on a Linux system:
# SO_RCVBUF=8192 SO_SNDBUF=8192
socket options = TCP_NODELAY

# Some defaults for winbind (make sure you're not using the ranges
# for something else.)
   idmap uid = 10000-20000
   idmap gid = 10000-20000
   template shell = /bin/bash
   winbind use default domain = no
   password server = project-ad.project.local
   realm = project.local

#======================= Share Definitions =======================

[homes]
comment = Home Directories
browseable = no

# By default, the home directories are exported read-only. Change next
# parameter to 'yes' if you want to be able to write to them.
writable = yes

# File creation mask is set to 0700 for security reasons. If you want to
# create files with group=rw permissions, set next parameter to 0775.
create mask = 0700

# Directory creation mask is set to 0700 for security reasons. If you want to
# create dirs. with group=rw permissions, set next parameter to 0775.
directory mask = 0700

# Restrict access to home directories
# to the one of the authenticated user
# This might need tweaking when using external authentication schemes
valid users = %S

# Un-comment the following and create the netlogon directory for Domain Logons
# (you need to configure Samba to act as a domain controller too.)
;[netlogon]
;   comment = Network Logon Service
;   path = /home/samba/netlogon
;   guest ok = yes
;   writable = no
;   share modes = no

krb5.conf

[logging]
default = FILE:/war/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log

[libdefaults]
default_realm = PROJECT.LOCAL
# dns_lookup realm = false
# dns_lookup_kdc = false

# The following krb5.conf variables are only for MIT Kerberos.
krb4_config = /etc/krb.conf
krb4_realms = /etc/krb.realms
kdc_timesync = 1
ccache_type = 4
forwardable = true
proxiable = true

# The following libdefaults parameters are only for Heimdal Kerberos.
v4_instance_resolve = false
v4_name_convert = {
  host = {
   rcmd = host
   ftp = ftp
  }
  plain = {
   something = something-else
  }
}
fcc-mit-ticketflags = true

[realms]

PROJECT.LOCAL = {
  kdc = project-ad.project.local:88
  admin_server = project-ad.project.local
  default_domain = project.local
}

[domain_realm]
.project.local = PROJECT.LOCAL
project.local = PROJECT.LOCAL
[kdc]
profile = /var/kerberos/krb5kdc/kdc.conf

[appdefaults]
pam = {
debug = false
ticket_lifetime = 36000
renew_lifetime = 36000
forwardable = true
krb4_convert = false
}

[login]
krb4_convert = true
krb4_get_tickets = false