SOLVED AD users not showing up but groups are! ....atypical - [solved by move to 9.3beta+]

[Ted Hyde]

Greets - I've been playing between FreeNas and some other OSS NAS options, as well as a TechNet copy of Win Storage Server lately and I really prefer FreeNas. (I even had a personal FreeNas installation many years ago on an ancient system, but that's long since gone).
The intent of this NAS is to replace some troublesome standalone Netgear boxes, as well as support a number of new Apple clients, and if at all possible, integrate with our Zentyal-provided AD.

I have been through many tutorials and understand the unique and sometimes invisible challenges that AD integration creates, so if it just doesn't pan out, oh well.

Many of the trouble tickets I've seen relate to not getting groups AND users to show up for shares authentication, or not getting joined to the domain, etc. My problem is more unique - I can connect to the domain, wbinfo and DNS show good, AD and CIFS turn on, the cache rebuilds, but in the shares view, I only have local users listed (first dropdown). But I DO have Domain Groups listed (2nd dropdown).

The setup:
FreeNas multiple versions as USB image on an AMD Quad Core with 6gb ram ECC DDR3, a 250gb standalone sata drive for FreeNas' own use/logging and a pair of 500gb sata drives as a mirror raid for testing. I will eventually increase the amount of storage space, but I see no need to load everything into the box if it can't work at 500gb. Besides, I have read the manual on how much ram to have per gig many times, plus extra for AD, so this should cover the bases for a sandbox testing rig.
Zentyal 3.5 is my DC, with internal(primary) DNS on that machine, and secondary DNS lists on my ZyXel VPN router.
The domain is tested and operational with Windows, Apple and Linux clients.

I first tried with FN 9.2.1.8 usb image, and was unable to get either users or groups to show up in the shares modal.
So I dumped that, and tried an OpenMediaVault which failed miserably.
So I dumped that and researched for specific versions that some members claimed to get working, particularly the "how to get AD working in FreeNas tutorials", and specifically downloaded those versions, which were: 9.1.1, 9.2.0 and 9.2.1.5. All three of these versions behaved exactly the same way:
a) they load, acquire a dhcp addr from my net, I use that to log into the box, set up new password, hostname and network parameters. Reboot and login as new ip
b) dump the freebsd timeservers and load the standard ntp.org pools, change timezone, resynch clocks and have less than 0.03 sec difference to my DC.
c) set up the solo drive as "sysvol" (arbitrary name), with a dataset uncompressed, available to FreeNas - although the only version I found that you can change where the sys pool is kept is in 9.2.1.8, probably a new feature; thus in the earlier versions this just sat there.
d) set up a zfs volume on the pair of 500gb, mirror and created a dataset within that volume for sharing. Nothing difficult there.
e) enable AD as the directory service, then go into the services-AD modal and set up credentials
f) wait a minute, and let the modal close, watch the console that "things happened".
g) calm myself everytime the console shows "unable to find LDAP server" as other posts have indicated this is normal
h) open a shell (either SSH or the web view, both work) and get positive results from wbinfo - I get a user list, a group list and a good trust result. Everytime.
i) check DNS - both pings and resolutions point in the right direction and to the right hosts.
j) start up a CIFS config, make sure netbios and hostnames are happy.
k) start up a CIFS share on the dataset made earlier
l) open the dataset permissions for this share in an attempt to set the owner user and group to domain credentials after changing the ACL to Windows.....

And that's where it falls apart - the user dropdown is populated ONLY with local users.
But unlike all other complaints I've read, the group dropdown IS POPULATED with Domain Groups!

Unfortunately, if I choose the root user and Domain Admins group, I can't authenticate the share.
If I make the share guest access, I can get in, so the share is functioning at least.

I understand there is a complex interaction between Samba4 AD and the FreeNas AD authentication model, and it's not perfect, but it appears many folks claim to have it working, so what specific information can I send next to help this along?

Normally at this point folks ask for voluminous logs because the problem reported is "I can't connect at all", however FN is joining the domain and gathering credential info, it's just not populating it into one dropdown.

Since it's recurrent across multiple versions of FN that I've tried, I realize it may be more than just FN, but FN is a big part of the puzzle.

If there's any helpful hints, I'd appreciate it!

Regards,
Ted.

 

[dlavigne]

Did you ever figure this out?

 

[Ted Hyde]

Hi - not specifically. Coincidentally, as 9.3Beta rolled out, and since I was in a testing capacity at the time, I figured I'd try out the wizard included with 9.3, particularly since it advertised setting up the initial shares and validating AD settings prior to commit.
The short answer is yes, I have AD working on Freenas 9.3beta with Zentyal 3.5.......the longer answer is that it the wizard by itself doesn't properly set up "Everything" to have it work. In fact, the 9.3Beta wizard may actually do things out-of-order, breaking the system it's intended to build.

I have only attacked this twice now to work it out so it's not a complete resolution, but here's the short form ow what I ended up doing:
1. 93beta on CD, physical sata drives are 1x 250gb, 2x 500gb. Install cd image onto the 250gb drive.
2. Standard install, let box acquire DHCP address.
3. Log into web page via the DHCP-acquired address.
4. Kill the first-run wizard.
5. Set up manual network settings, domain name, time servers. (I prefer a traditional static IP for this install, even above a MAC-reserved IP)
6. Relog into webpage at new manually-set address.
7. Create a dataset for the syspool, and set it in the general settings widget.
8. Now run the wizard and follow through the AD connection setup. CIFS probably won't autostart.
9. Make sure in the CIFS setup that the box name is actually the box name instead of FREENAS (assuming you wanted another name).
10. Start CIFS service manually. IT did kick the AD service off once or twice, but re-enabling it in the AD tab brought it back online.
11. Turn on verbose logging, and I also like the console-in-footer option. Rather handy.
12. Hard reboot. AD may get disabled again, just re-enable.
13. Perform the traditional CLI wbinfo for users, groups and trusts.
14. The wizard will have created a real dataset to share, make sure to note the two options are included in future manually-created shares.
15. Change the permissions of the dataset to windows type, and the user as domain admin and the group as domain users. Don't set a specific user here, make it domain admin.
16. Understand that user-level share control isn't performed at this point. This security level is an AD/domain management item, but I think some folks expect that you should set up your share user level security here. The manual could include a short note that the user/group isn't who gets access to the share, it's who is allowed to control access to the share. Like any other AD management, you then use your pdc tools to set up individual share permissions.

17. After getting that all sorted, open the share with a network browser that has admin permissions, and set up your user-level security.

18. Backup your settings. Then back them up again.
19. Start managing the rest of the NAS as appropriate.

At this point, I get to consider myself amongst the group of FreeNAS users that "Successfully have AD running for credentials validation".

It's functioning now in a production setup, albeit at week 01.

Many thanks,

Ted.