Can't get AD groups / users working on Freenas 9.2.1.2/9.2.1.3

[rakaris]

Hello!
I'm trying to configure the AD integration on FreeNas but I can't get it working.
I have added Freenas Server in the domain. The commands:

wbinfo -u (to view users)
wbinfo -g (to view groups)
getent password
getent group

generated output is correct, but I can't see any group / user at GUI permissions management when switching to Windows permissions mode. When I'm open the permissions management, the following error is generated at /var/log/messages

Mar 24 19:20:02 stor-1 manage.py: [common.freenasusers:441] Directory Users could not be retrieved: 'NoneType' object has no attribute '__getitem__'
Mar 24 19:20:45 stor-1 manage.py: [common.freenasusers:441] Directory Users could not be retrieved: 'NoneType' object has no attribute '__getitem__'

I have tried to change the permissions manually with chown but I was not be able to get CIFS share access from Windows.
Any suggestions?
Thanks!

 

[dlavigne]

Looks like this bug: https://bugs.freenas.org/issues/4382.

 

[rakaris]

I have not enabled tls/ssl requirement for LDAP in domain at the moment. I have Apache sites on other servers configured with LDAP authentication provider without tls/ssl and it works perfectly.
So I think this is not Bug 4832 case. Any syugestions? Do I need to register another bug?
Thanks!

Here is my config:

Code:

[global]
        dos charset = CP437
        workgroup = MSM
        realm = MSM.LOCAL
        server string = FreeNAS Server
        server role = member server
        security = ADS
        allow trusted domains = No
        map to guest = Bad User
        null passwords = Yes
        obey pam restrictions = Yes
        smb passwd file = /var/etc/private/smbpasswd
        private dir = /var/etc/private
        guest account = nobody01
        max log size = 51200
        server min protocol = CORE
        unix extensions = No
        load printers = No
        printcap name = /dev/null
        disable spoolss = Yes
        local master = No
        domain master = No
        dns proxy = No
        cache directory = /var/tmp/.cache/.samba
        pid directory = /var/run/samba
        panic action = /usr/local/libexec/samba/samba-backtrace
        template shell = /bin/sh
        winbind cache time = 7200
        winbind enum users = Yes
        winbind enum groups = Yes
        winbind use default domain = Yes
        winbind refresh tickets = Yes
        winbind offline logon = Yes
        idmap config MSM: range = 20000-20000000
        idmap config MSM: backend = rid
        idmap config * : range = 10000-19999
        idmap config * : backend = tdb
        create mask = 0666
        directory mask = 0777
        directory name cache size = 0
        map archive = No
        map readonly = no
        store dos attributes = Yes
        strict locking = No
        dos filemode = Yes
 
[Installs]
        path = /mnt/Installs
        read only = No
        inherit acls = Yes
        veto files = /.snap/.windows/.zfs/
        vfs objects = zfsacl, streams_xattr, aio_pthread
        zfsacl:acesort = dontcare
        nfs4:chown = yes
        nfs4:acedup = merge
        nfs4:mode = special
        recycle:subdir_mode = 0700
        recycle:directory_mode = 0777
        recycle:touch = yes
        recycle:versions = yes
        recycle:keeptree = yes
        recycle:repository = .recycle/%U

 

[rakaris]

I have not enabled tls/ssl requirement for LDAP in domain at the moment. I have Apache sites on other servers configured with LDAP authentication provider without tls/ssl and it works perfectly.
So I think this is not Bug 4832 case. Any syugestions? Do I need to register another bug?
Thanks!

Here is my config:

Code:

[global]
        dos charset = CP437
        workgroup = MSM
        realm = MSM.LOCAL
        server string = FreeNAS Server
        server role = member server
        security = ADS
        allow trusted domains = No
        map to guest = Bad User
        null passwords = Yes
        obey pam restrictions = Yes
        smb passwd file = /var/etc/private/smbpasswd
        private dir = /var/etc/private
        guest account = nobody01
        max log size = 51200
        server min protocol = CORE
        unix extensions = No
        load printers = No
        printcap name = /dev/null
        disable spoolss = Yes
        local master = No
        domain master = No
        dns proxy = No
        cache directory = /var/tmp/.cache/.samba
        pid directory = /var/run/samba
        panic action = /usr/local/libexec/samba/samba-backtrace
        template shell = /bin/sh
        winbind cache time = 7200
        winbind enum users = Yes
        winbind enum groups = Yes
        winbind use default domain = Yes
        winbind refresh tickets = Yes
        winbind offline logon = Yes
        idmap config MSM: range = 20000-20000000
        idmap config MSM: backend = rid
        idmap config * : range = 10000-19999
        idmap config * : backend = tdb
        create mask = 0666
        directory mask = 0777
        directory name cache size = 0
        map archive = No
        map readonly = no
        store dos attributes = Yes
        strict locking = No
        dos filemode = Yes
 
[Installs]
        path = /mnt/Installs
        read only = No
        inherit acls = Yes
        veto files = /.snap/.windows/.zfs/
        vfs objects = zfsacl, streams_xattr, aio_pthread
        zfsacl:acesort = dontcare
        nfs4:chown = yes
        nfs4:acedup = merge
        nfs4:mode = special
        recycle:subdir_mode = 0700
        recycle:directory_mode = 0777
        recycle:touch = yes
        recycle:versions = yes
        recycle:keeptree = yes
        recycle:repository = .recycle/%U

I have added debug log in the attachment. There are no tls/ssl errrors, too.

 

[dlavigne]

Yes, if you suspect it is a different bug, please put this info into a new ticket and post the issue number here.

 

[mikesm]

Looks like this bug: https://bugs.freenas.org/issues/4382.

What is the GPO variable that turns this on/off? I think this is my problem.

Thanks!
Mike