I am trying to set up a file server with Active Directory authentication using Samba and Winbind.

Domain controller is Windows 2000 SP4 (don't judge).
File server is Debian 7.7 (latest stable). This is a fresh install with only some recommended by various guides libraries and dependancies installed. Samba was built from source with following parameters:

./configure --with-acl-support --with-ads --with-shared-modules=idmap_ad --disable-cups --disable-iprint


root@this-server:~# samba --version
Version 4.1.13
root@this-server:~# winbindd --version
Version 3.6.6
root@this-server:~# klist -V
Kerberos 5 version 1.10.1

kinit Administrator, net ads join -k, net ads testjoin, getent passwd, getent group, wbinfo -u, wbinfo -g, id DomainUser, chown DomainUser:DomainGroup, chgrp DomainUser:DomainGroup - all work, no errors.

I can login via ssh with domain credentials.

smbclient -k -L any-other-host - also works.


root@this-server:~# smbclient -k -L this-server -d 3
lp_load_ex: refreshing parameters
Initialising global parameters
rlimit_max: increasing rlimit_max (1024) to minimum Windows limit (16384)
params.c:pm_process() - Processing configuration file "/usr/local/samba/etc/smb.conf"
Processing section "[global]"
added interface eth0 ip= bcast= netmask=
Client started (version 4.1.13).
resolve_lmhosts: Attempting lmhosts lookup for name this-server<0x20>
resolve_lmhosts: Attempting lmhosts lookup for name this-server<0x20>
resolve_wins: WINS server resolution selected and no WINS servers listed.
resolve_hosts: Attempting host lookup for name this-server<0x20>
Connecting to at port 445
Doing spnego session setup (blob length=96)
got OID=1.2.840.48018.1.2.2
got OID=1.2.840.113554.1.2.2
got OID=
got principal=not_defined_in_RFC4178@please_ignore
cli_session_setup_spnego: using target hostname not SPNEGO principal
cli_session_setup_spnego: guessed server principal=cifs/this-server@MY-DOMAIN
Doing kerberos session setup
ads_cleanup_expired_creds: Ticket in ccache[FILE:/tmp/krb5cc_0.1] expiration Sat, 29 Nov 2014 02:29:49 MSK
SPNEGO login failed: Access denied
session setup failed: NT_STATUS_ACCESS_DENIED

(/usr/local/samba/etc/smb.conf is a symlink to /usr/share/samba/smb.conf)

Excerpt from the logs:

[2014/11/28 16:46:58.430797,  1, pid=6006, effective(0, 0), real(0, 0), class=auth] ../source3/auth/user_krb5.c:164(get_user_from_kerberos_info)
  Username MY-DOMAIN\Administrator is invalid on this system
[2014/11/28 16:46:58.430856,  1, pid=6006, effective(0, 0), real(0, 0)] ../source3/auth/auth_generic.c:97(auth3_generate_session_info_pac)
  Failed to map kerberos principal to system user (NT_STATUS_LOGON_FAILURE)
[2014/11/28 16:46:58.430965,  1, pid=6006, effective(0, 0), real(0, 0)] ../source3/smbd/sesssetup.c:276(reply_sesssetup_and_X_spnego)
  Failed to generate session_info (user and group token) for session setup: NT_STATUS_ACCESS_DENIED

Here is a bunch of configuration info, mostly if not completely irrelevant:

/etc/samba/smb.conf (which is also a symlink to /usr/share/samba/smb.conf)


   netbios name = this-server
   realm = MY-DOMAIN
   workgroup = MY-DOMAIN
   server string = %h server
   dns proxy = no
   log file = /var/log/samba/log.%m
   max log size = 1000
   syslog = 0
   panic action = /usr/share/samba/panic-action %d

   security = ads
   encrypt passwords = yes
   passdb backend = tdbsam
   obey pam restrictions = yes
   unix password sync = yes
   passwd program = /usr/bin/passwd %u
   passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .
   pam password change = yes
   map to guest = bad user

   winbind enum groups = yes
   winbind enum users = yes

   idmap config * : backend        = tdb
   idmap config * : range          = 20000-29999

   idmap config MY-DOMAIN : backend  = rid
   idmap config MY-DOMAIN : range    = 10000 - 19999

   winbind trusted domains only = no
   winbind use default domain = yes
   client use spnego = yes
   kerberos method = secrets and keytab

   vfs objects = acl_xattr
   map acl inherit = yes
   store dos attributes = yes
   template homedir = /home/%D/%U
   template shell = /bin/bash
   load printers = no
   printcap name = /dev/null
   log level = 10

   comment = Home Directories
   browseable = no
   read only = yes
   create mask = 0700
   directory mask = 0700
   valid users = %S

   path = /srv/samba/test
   read only = no

/etc/hosts       localhost       localhost.localdomain   this-server.MY-DOMAIN        this-server   domain-controller.MY-DOMAIN  domain-controller


search MY-DOMAIN


passwd:         files winbind
group:          files winbind
shadow:         files winbind

hosts:          files dns wins
networks:       files

protocols:      db files
services:       db files
ethers:         db files
rpc:            db files

netgroup:       nis

All /etc/pam.d/* files are all generated with pam-auth-update, here are the contents anyway:


@include common-auth
@include common-account
@include common-session-noninteractive


auth    [success=2 default=ignore]      pam_unix.so nullok_secure
auth    [success=1 default=ignore]      pam_winbind.so krb5_auth krb5_ccache_type=FILE cached_login try_first_pass
auth    requisite                       pam_deny.so
auth    required                        pam_permit.so


account [success=2 new_authtok_reqd=done default=ignore]        pam_unix.so
account [success=1 new_authtok_reqd=done default=ignore]        pam_winbind.so
account requisite                       pam_deny.so
account required                        pam_permit.so


session [default=1]                     pam_permit.so
session requisite                       pam_deny.so
session required                        pam_permit.so
session required        pam_unix.so
session optional        pam_winbind.so


session [default=1]                     pam_permit.so
session requisite                       pam_deny.so
session required                        pam_permit.so
session required        pam_unix.so
session optional        pam_winbind.so


password        [success=2 default=ignore]      pam_unix.so obscure sha512
password        [success=1 default=ignore]      pam_winbind.so use_authtok try_first_pass
password        requisite                       pam_deny.so
password        required                        pam_permit.so


default_realm = MY-DOMAIN

krb4_config = /etc/krb.
krb4_realms = /etc/krb.realms
kdc_timesync = 1
ccache_type = 4
forwardable = true
proxiable = true

default_tgs_enctypes = rc4-hmac des-cbc-crc des-cbc-md5
default_tkt_enctypes = rc4-hmac des-cbc-crc des-cbc-md5
preferred_enctypes = rc4-hmac des-cbc-crc des-cbc-md5

        kdc = domain-controller.my-domain
        admin_server = domain-controller.my-domain
        default_domain = MY-DOMAIN

.my-domain = MY-DOMAIN
my-domain = MY-DOMAIN

What might be the problem here and how do I resolve it?

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.