Connect to ActiveDirectory Windows Server 2008

[chrisg (Chris Gebhardt)]

Users are not pushed to NethServer and you will be able to see them only on specific pages (like Web Content Filter), sadly the “Users” page is not one of them.

So, NS is false advertising then? It CLEARLY states that AD and email addresses will be imported from AD and now you, as part of the Dev Team are saying that factually FALSE? Perhaps you are mistaken? Or I am not reading this correctly?

From the Administrator Manual:
"The Email module integrates with an Active Directory (AD) environment, if Active Directory member role is enabled in Windows Network page.
To make NethServer work with the external LDAP database provided by Active Directory, the following rules applies:

Only enabled accounts are considered (userAccountControl attribute).
IMAP and SMTP login name is the value of sAMAccountName attribute.
Email addresses associated with an user are the values of mail…"

[giacomo (Giacomo Sanchietti)]

So, NS is false advertising then? It CLEARLY states that AD and email addresses will be imported from AD and now you, as part of the Dev Team are saying that factually FALSE? Perhaps you are mistaken? Or I am not reading this correctly?

You’re not reading correctly, the manual states that “The Email module integrates with an Active Directory (AD) environment”, no one talked about importing
NS reads the users directly from the AD server and no local copy is made. Also, the manual talks about Email modules, not a full integration.

Please be patient, we are working very hard on the next release to create the best user experience for anybody who wants to play with AD

[alefattorini (Alessio Fattorini)]

Tthe documentation probably isn’t clear enough, as @giacomo already said NethServer 6.x can’t live alone without an AD active, so we’re speaking about syncing and not importing

[chrisg (Chris Gebhardt)]

What is the purpose of “integrating” with an AD server and mentioning emails if NS does nothing with that information? Sure, I understand the point of joining the domain for purely security reasons. But what value beyond that is there? Why set false expectations?

I disagree wholeheartedly and so does everyone I have shown this document to. We all read it as NS will use AD and pull the email addresses directly. One stop shopping so-to-speak. If I were NS, I would change the manual immediately to be clear that while you can have NS “talk” to AD, there is no exchange of information. And include a line like: “NS will not import, sync, or otherwise communication with AD for anything other than domain membership. Admins will still need to manually populate users and emails into NS.” THAT IS A FAIR STATEMENT.

[giacomo (Giacomo Sanchietti)]

Maybe we didn’t explained ourselves well enough.
I will try with an example, feel free to ask more!

You have a NS and an AD server acting as PDC of the LAN.
NS is joined to the AD.
NS can act as Mail Server and Web Content Filter using users from AD, but you always need to manage the users from AD server.

Example for Mail Server:

• Join NS to the AD
• Install the mail server
• Create a user goofy on AD
• Add an email field to goofy user on AD
• NS is automatically configured to receive mails for the goofy user

Example for Web Content Filter:

• Join NS to the AD
• Install the web content filter
• Create a user goofy on AD
• On NS create a web content profile for the goofy user (you should see the user from NS web interface)
• NS will filter the web for the goofy user

[chrisg (Chris Gebhardt)]

Example for Mail Server:

• Join NS to the AD
• Install the mail server
• Create a user goofy on AD
• Add an email field to goofy user on AD
• NS is automatically configured to receive mails for the goofy user

If that is the case, it is best news I have heard all week!!! However, the “automatically configured” part is not working. Like I said earlier, I can do a webinfo -u on the NS and see the users. But when trying to log in to the email portal, nothing works.

This is I believe the final step of my implementation. If someone could explain how to get NS to read the email addresses from AD and then send/receive for those addresses, my life would be great! Right now, I am stuck at “* NS is automatically configured to receive mails for the goofy user”

For background, we do have the email addresses listed properly in the AD entry.

[giacomo (Giacomo Sanchietti)]

I think @davidep can help us on this!

[davidep (Davide Principi)]

Like I said earlier, I can do a webinfo -u on the NS and see the users. But when trying to log in to the email portal, nothing works.

Hi @chrisg, if “email portal” is SOGo, one further configuration step is required. Some infos are from this post:

Sogo and AD integration

Hi all.. I'm playing with Sogo and AD integration.. joined the domain, done all the steps as per https://github.com/NethServer/nethserver-sogo#active-directory-integration page.. so far, so good.. just a few questions: 1) how do I create an alias? 2) I read here: http://docs.nethserver.org/en/latest/mail.html Email addresses associated with an user are the values of mail, otherMailbox and proxyAddresses attributes. The last two attributes expect a smtp: prefix before the actual value. Al…

[chrisg (Chris Gebhardt)]

No luck. Does any user actually have AD integrated with NethServer? I’m curious if I am chasing a rabbit here. I’ve done everything suggested but still no luck.

[davidep (Davide Principi)]

I try to recap the situation:

• ads join is OK, and winbind lists the domain accounts. I guess also getent passwd does the same.

• Login on SOGo fails, even after it has been configured with the right permissions to bind the AD LDAP service.

Now it might help to verify if domain users can access their mailboxes with IMAP. Does it work?

[chrisg (Chris Gebhardt)]

Hi David,

Yes, you are right so far. When trying to login, SOGo spins a little when you hit enter so it is doing something. I can completely login with an email account created directly in NS so SOGo works.

IMAP works for the NS user but none of the AD users.

[davidep (Davide Principi)]

Can you see any relevant line in /var/log/imap?

[chrisg (Chris Gebhardt)]

May 2 14:53:50 mail dovecot: imap: Error: Internal auth failure (client-pid=27959 client-id=1)
May 2 14:53:50 mail dovecot: imap-login: Internal login failure (pid=27959 id=1) (internal failure, 1 succesful auths): user=, method=PLAIN, rip=172.30.0.3, lip=192.168.202.42, mpid=27962, TLS: Disconnected, session=<KWSSK+IxZACsHgAD>

May 2 14:54:13 mail dovecot: imap: Error: Internal auth failure (client-pid=28065 client-id=1)
May 2 14:54:13 mail dovecot: imap-login: Internal login failure (pid=28065 id=1) (internal failure, 1 succesful auths): user=, method=PLAIN, rip=172.30.0.3, lip=192.168.202.42, mpid=28066, TLS, session=<Q0noMeIx+wCsHgAD>

[chrisg (Chris Gebhardt)]

From the 10user_source_active_directory config file for SOGo:
push @sogoUserSources, qq(
id = AD_Users;
type = ldap;
CNFieldName = cn;
IDFieldName = sAMAccountName;
#IDFieldName = mail;
UIDFieldName = sAMAccountName;
IMAPLoginFieldName = mail;
canAuthenticate = YES;
bindDN = “CN=$sogoCredentials[0],CN=Users,$adsBasePath”;
bindPassword = “$sogoCredentials[1]”;
baseDN = “$baseDN”;
bindFields = (mail,
sAMAccountName,
);
hostname = $adsLdapServer;
filter = “(objectClass=’‘user’’)”;
scope = SUB;
displayName = “$adsRealm users”;
isAddressBook = YES;
);

[chrisg (Chris Gebhardt)]

I checked AD and the mail attribute is set properly. So is the sAMAccountName.

mail=user2@myamrg.com
sAMAccountName = user2

interestingly, uid is not set to anything in AD.

[davidep (Davide Principi)]

imap: Error: Internal auth failure

So, let’s concentrate on IMAP! I guess the dovecot keytab file has some kind of issue…

Remove it:

rm -vf /var/lib/dovecot/krb5.keytab

Re-create it, and look at the command exit status:

/usr/libexec/nethserver/smbads initkeytab
echo $?

Then

service dovecot restart

Finally try to login again on IMAP. I hope it helps!

[alefattorini (Alessio Fattorini)]

@chrisg I am interested in how your join is going.