SOLVED Trying to bind with active directory

[emiguy]

Hi,

This is my first time trying to get Truenas to bind to AD. I followed the documentation here, and things seemed to go smoothly... but it is not yet working.

When I do a midclt call activedirectory.domain_info | jq, my output looks very encouraging:

Code:

{
  "LDAP server": "192.168.99.99",
  "LDAP server name": "DC1.mydomain.com",
  "Realm": "mydomain.COM",
  "Bind Path": "dc=mydomain,dc=COM",
  "LDAP port": 389,
  "Server time": 1634215810,
  "KDC server": "192.168.99.99",
  "Server time offset": 0,
  "Last machine account password change": 0
}

(the domain and ip address are deliberately sanitized)

But when I do a wbinfo -t, I get:

Code:

could not obtain winbind interface details: WBC_ERR_WINBIND_NOT_AVAILABLE
could not obtain winbind domain name!
checking the trust secret for domain (null) via RPC calls failed
failed to call wbcCheckTrustCredentials: WBC_ERR_WINBIND_NOT_AVAILABLE
Could not check secret

The other interesting thing is, even though TrueNas tells me it is hooked up OK to AD -- I do not see the truenas server listed amongst the PCs in the domain in Active Directory Users and Computers. Shouldn't I?

When I do a ps -auxw, I do not see winbindd running in the background, shouldn't I also see that? It isn't listed among the services on the the interface, so I'm not sure how it should be started... on the command line I ran /etc/local/rc.d/winbindd start, which gave me no complaints. In fact it said: "Starting Winbindd". But when I look at the process list, it still is not there.

/var/log/samba4/log.winbindd shows:

Code:

[2021/10/14 09:06:56.174349,  0] ../../source3/winbindd/winbindd_cache.c:3205(initialize_winbindd_cache)
  initialize_winbindd_cache: clearing cache and re-creating with version number 2
[2021/10/14 09:06:56.176143, 0] ../../source3/winbindd/winbindd_util.c:1283(init_domain_list)
Could not fetch our SID - did we join?
[2021/10/14 09:06:56.176196, 0] ../../source3/winbindd/winbindd.c:1455(winbindd_register_handlers)
unable to initialize domain list

Which probably relates to the fact that I do not see the truenas box listed among the servers in AD.... Since the configuration seemed go without a hitch, I expected it to be. Was there something more I had to do?

Thanks for your help.

 

[emiguy]

OK. I found the problem. There was a name mismatch in my smb configuration -- the Workgroup name must match the domain name, and mine didn't. I had this set up as a non-domain member initially. The "?" icon warns of this, but it also states: "When this is unconfigured and Active Directory or LDAP are active, TrueNAS will detect and set the correct workgroup from these services.". I didn't configure it... so I thought TrueNas was going to do this for me after configuring directory services. It makes sense, I just misunderstood.

All appears to be well.