In order for OpenLDAP to be used as a backend for Samba, logically, the DIT will need to use attributes that can properly describe Samba data. Such attributes can be obtained by introducing a Samba LDAP schema. Let's do this now.

Maintenant que slapd connaît les attributs Samba, nous pouvons définir quelques indices basés sur ces attributs. L'indexation des entrées est un moyen d'améliorer les performances lorsqu'un client effectue une recherche filtrée dans le DIT.

Créez le fichier samba_indices.ldif avec le contenu suivant :

dn: olcDatabase={1}mdb,cn=config
changetype: modify
replace: olcDbIndex
olcDbIndex: objectClass eq
olcDbIndex: uidNumber,gidNumber eq
olcDbIndex: loginShell eq
olcDbIndex: uid,cn eq,sub
olcDbIndex: memberUid eq,sub
olcDbIndex: member,uniqueMember eq
olcDbIndex: sambaSID eq
olcDbIndex: sambaPrimaryGroupSID eq
olcDbIndex: sambaGroupType eq
olcDbIndex: sambaSIDList eq
olcDbIndex: sambaDomainName eq
olcDbIndex: default sub,eq

Avec l'utilitaire ldapmodify, charger les nouveaux indices :

sudo ldapmodify -Q -Y EXTERNAL -H ldapi:/// -f samba_indices.ldif

Si tout s'est bien passé, vous devriez voir les nouveaux indices en utilisant ldapsearch :

sudo ldapsearch -Q -LLL -Y EXTERNAL -H \
ldapi:/// -b cn=config olcDatabase={1}mdb olcDbIndex

Next, configure the smbldap-tools package to match your environment. The package comes with a configuration helper script called smbldap-config. Before running it, though, you should decide on two important configuration settings in /etc/samba/smb.conf:

It's important to make these choices now because smbldap-config will use them to generate the config that will be later stored in the LDAP directory. If you run smbldap-config now and later change these values in /etc/samba/smb.conf there will be an inconsistency.

Once you are happy with netbios name and workgroup, proceed to generat the smbldap-tools configuration by running the configuration script which will ask you some questions:

sudo smbldap-config

Some of the more important ones:

Le script smbldap-populate va ensuite ajouter les objets LDAP nécessaires pour Samba. C'est une bonne idée que de commencer par sauvegarder votre DIT avec slapcat :

sudo slapcat -l backup.ldif

Once you have a backup proceed to populate your directory. It will ask you for a password for the "domain root" user, which is also the "root" user stored in LDAP:

sudo smbldap-populate -g 10000 -u 10000 -r 10000

The -g, -u and -r parameters tell smbldap-tools where to start the numeric uid and gid allocation for the LDAP users. You should pick a range start that does not overlap with your local /etc/passwd users.

You can create a LDIF file containing the new Samba objects by executing sudo smbldap-populate -e samba.ldif. This allows you to look over the changes making sure everything is correct. If it is, rerun the script without the '-e' switch. Alternatively, you can take the LDIF file and import its data per usual.

Votre répertoire LDAP a maintenant les informations nécessaires pour authentifier les utilisateurs Samba.