How to authorize Samba users in external LDAP?

Question

linux

Hello.

To maintain a single user database, we raised the OpenLDAP server, we are transferring all systems to authorization through LDAP. (Moreover, we do not have a Windows domain and are not expected to because of the large number of Win XP Home)

Task : the user must enter a login and password when accessing the network share, Samba must request LDAP authentication. One scheme is widespread

on the Internet , in which it is necessary to give samba administrative access to LDAP and make changes to the LDAP scheme. This approach seems undesirable to me due to the fact that there should be more than one such Samba server and how they will “get along” running on the same LDAP server is not clear to me. Question

: Is it possible to provide transparent authorization for the end user on a Samba-file-server with an external LDAP, if possible without granting Samba elevated privileges and minimal interference with the structure of the LDAP database. (Here , for example, they say that it is impossible)

There is anonymous access to the LDAP server and I have already checked with the help of one lib that it is possible to authorize a user to the service via LDAP.

If someone has experience in building similar configurations, please tell, direct, explain. Thanks in advance.

Answer 1

At one of the past jobs, the domain controller worked on samba under diesel fuel.
GPOs will not work with WinHome, so there is no need for more.
hm. and it is impossible to connect pam_ldap?
if samba can be authorized in the domain through kerberos, who prevents the other way around?
we have domain users on samba, ssh was perfectly authorized, it even lies somewhere as it was configured, you need to search

Answer 2

A very pressing question! Faced the same problem, from a samba the most primitive file-garbage with management of the rights on LDAP is required. All the manuals found on the internet seem to be shooting from a very large caliber cannon to fight sparrows.