Samba et ldap en PDC, problème
par viperone le 12/06/2008

Bonjour alors voici exactement ce qui se passe:
J'ai suivi ce tuto : http://damstux.free.fr/wiki/index.php?title=PDC_Samba_et_LDAP
mais arrivé a la vérification de l'imbrication samba et ldap
càd la commande net getlocalsid
me renvoie :
[2008/06/12 17:11:40,0] lib/smbldap.c:smbldap_connect_system(977)
failed to bind to server ldap://127.0.0.1/ with dn="cn=amin,dc=domaineldap;dc=itn" error: can't contact LDAP server
(unknown)
SID for domaint SERVTFE is: S-1-5-21-2215045963-1281290644-93627746

Mes fichiers de configuration:
smb.conf
[global]
workgroup=domainetfe
netbios name = servtfe
server string = Samba-LDAP PDC Server
domain master = Yes
local master = Yes
domain logons = Yes
os level = 40
#passwd program = /usr/sbin/smbldap-passwd ?u %u
ldap passwd sync = Yes
passdb backend = ldapsam:ldap://127.0.0.1/
ldap admin dn = cn=admin,dc=domaineldap,dc=itn
ldap suffix = dc=domaineldap,dc=itn
ldap group suffix = ou=Groups
ldap user suffix = ou=Users
ldap machine suffix = ou=Machines
add user script = /usr/sbin/smbldap-useradd -m "%u"
ldap delete dn = Yes
delete user script = /usr/sbin/smbldap-userdel "%u"
add machine script = /usr/sbin/smbldap-useradd -w "%u"
add group script = /usr/sbin/smbldap-groupadd -p "%g"
#delete group script = /usr/sbin/smbldap-groupdel "%g"
add user to group script = /usr/sbin/smbldap-groupmod -m "%u" "%g"
delete user from group script = /usr/sbin/smbldap-groupmod -x "%u" "%g"
set primary group script = /usr/sbin/smbldap-usermod -g "%g" "%u"
logon path = \\%L\profile\%U
logon drive = P:
logon home = \\%L\%U
socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
case sensitive = No
default case = lower
preserve case = yes
short preserve case = Yes
#character set = iso8859-1
#domain admin group = @admin
dns proxy = No
wins support = Yes
hosts allow = 192.168.0. 127.
winbind use default domain = Yes
nt acl support = Yes
msdfs root = Yes
hide files = /desktop.ini/ntuser.ini/NTUSER.*/
### FIN DE LA PARTIE GLOBALE #####
#### LES PARTAGES #####
[netlogon]
path = /home/netlogon
writable = No
browseable = No
write list = Administrateur
#
[profile]
path = /home/export/profile
browseable = No
writeable = Yes
profile acls = yes
create mask = 0700
directory mask = 0700
#
[homes]
comment = Repertoire Personnel
browseable = No
writeable = Yes
#
[partage]
comment = Repertoire commun
browseable = Yes
writeable = Yes
public = No
path = /home/partage

smbldap.conf
slaveLDAP="127.0.0.1"
slavePort="389"
masterLDAP="127.0.0.1"
masterPort="389"
ldapTLS="0"
verify="require"
### A changer ==>
suffix="dc=domaineldap,dc=itn"
usersdn="ou=Users,${suffix}"
computersdn="ou=Machines,${suffix}"
groupsdn="ou=Groups,${suffix}"
idmapdn="ou=Idmap,${suffix}"
sambaUnixIdPooldn="cn=NextFreeUnixId,${suffix}"
scope="sub"
hash_encrypt="SSHA"
crypt_salt_format="%s"
userLoginShell="/bin/bash"
userHome="/home/%U"
userHomeDirectoryMode="700"
#Nom d'affichage - utiliser smbldap-useradd -c
userGecos="User"
defaultUserGid="513"
defaultComputerGid="515"
skeletonDir="/etc/skel"
#Les mots de passe expirent dans 10ans
defaultMaxPasswordAge="3650"
with_smbpasswd="0"
smbpasswd="/usr/bin/smbpasswd"
with_slappasswd="0"
slappasswd="/usr/sbin/slappasswd"

slapd.conf
# This is the main slapd configuration file. See slapd.conf(5) for more
# info on the configuration options.
#######################################################################
# Global Directives:
# Features to permit
#allow bind_v2
# Schema and objectClass definitions
######## Schéma par défaut
include /etc/ldap/schema/core.schema
include /etc/ldap/schema/cosine.schema
include /etc/ldap/schema/nis.schema
include /etc/ldap/schema/inetorgperson.schema
######## On rajoute le schema samba ( ligne à créer)
include /etc/ldap/schema/samba.schema
# Schema check allows for forcing entries to
# match schemas for their objectClasses's
schemacheck on
# Where the pid file is put. The init.d script
# will not stop the server if you change this.
pidfile /var/run/slapd/slapd.pid
# List of arguments that were passed to the server
argsfile /var/run/slapd.args
# Read slapd.conf(5) for possible values
loglevel 0
# Where the dynamically loaded modules are stored
modulepath /usr/lib/ldap
moduleload back_bdb
#######################################################################
# Specific Backend Directives for bdb:
# Backend specific directives apply to this backend until another
# 'backend' directive occurs
backend bdb
checkpoint 512 30
#######################################################################
# Specific Backend Directives for 'other':
# Backend specific directives apply to this backend until another
# 'backend' directive occurs
#backend <other>
#######################################################################
# Specific Directives for database #1, of type bdb:
# Database specific directives apply to this databasse until another
# 'database' directive occurs
database bdb
# The base of your directory in database #1
######## Donnez le nom de votre base LDAP (normalement debconf a rajouté pour vous cette ligne)
suffix "dc=domaineldap,dc=itn"
######## Donnez le nom de votre base LDAP avec le nom Admin. ( ligne à créer)
rootdn "cn=admin,dc=domaineldap,dc=itn"
######## Dans une console root lancez la commande slappasswd, donnez votre mot de passe que vous aviez
######## mis à l'installation de slapd (dans debconf), la commande vous renvoie le mot de passe crypté,
######## copiez le. ( ligne à créer)
rootpw {SSHA}vW0QyTPM3gdRN8cN7aJpxoZfTu3YQdBz
# Where the database file are physically stored for database #1
directory "/var/lib/ldap"
# Indexing options for database #1
index objectClass eq
# Save the time that the entry gets modified, for database #1
lastmod on
# Where to store the replica logs for database #1
# replogfile /var/lib/ldap/replog
# The userPassword by default can be changed
# by the entry owning it if they are authenticated.
# Others should not be able to see it, except the
# admin entry below
# These access lines apply to database #1 only
access to attrs=userPassword
by dn="cn=admin,dc=domaineldap,dc=itn" write
by anonymous auth
by self write
by * none
# Ensure read access to the base for things like
# supportedSASLMechanisms. Without this you may
# have problems with SASL not knowing what
# mechanisms are available and the like.
# Note that this is covered by the 'access to *'
# ACL below too but if you change that as people
# are wont to do you'll still need this if you
# want SASL (and possible other things) to work
# happily.
access to dn.base="" by * read
# The admin dn has full write access, everyone else
# can read everything.
access to *
by dn="cn=admin,dc=domaineldap,dc=itn" write
by * read

Voili voilou, si vous pouvez me filer un coup de papatte ca serait super :D
Merci d 'avance :)

---