samba - May 2024 - Samba with external SSO

Hi!

My goal is to connect Authentik to Samba (running on Ubuntu).

What I tried (with no success):
- Samba directly to the LDAP outpost (as Authentik can expose it's internal
DB like that): this would/will work but Authentik can't use the Samba scheme
at the moment.
- Samba -> PAM -> sssd -> LDAP outpost: in theory this worked a long
time ago (SMBv1?) but as the password is not sent in the clear (as I understand
it's nonce-based) this is not a possible solution (+ somewhere it was
explicitly stated sssd support was dropped)
- Samba + (sssd) + Winbind + LDAP? Couldn't try this one, as I seen that
basically sssd=Winbind (yet there WAS a module for Winbind to use sssd?)

...and this is where I got stuck.

What would I need to connect Authentik and Samba together without AD being the
central place where I store users? (As two-way sync isn't in Authentik atm.
with AD)

(Ideally I'd avoid AD, but at this point I'm open to many things.)

(I've followed the mailing list etiquette to the best of my abilities: this
is my first message on any of them.)

On Tue, 14 May 2024 07:29:25 +0000
Gerg? V?ri via samba <samba at lists.samba.org> wrote:
> Hi!
> 
> My goal is to connect Authentik to Samba (running on Ubuntu).
> 
> What I tried (with no success):
> - Samba directly to the LDAP outpost (as Authentik can expose it's
> internal DB like that): this would/will work but Authentik can't use
> the Samba scheme at the moment.
I wouldn't rely on the samba ldap schema anyway, it is mainly meant for
the old NT4-style PDCs and they rely on SMBv1 and there is a good
chance they will be removed at some point, they are deprecated already.
> - Samba -> PAM -> sssd -> LDAP outpost: in theory this worked a
long
> time ago (SMBv1?) but as the password is not sent in the clear (as I
> understand it's nonce-based) this is not a possible solution (+
> somewhere it was explicitly stated sssd support was dropped)
That should tell you something.
> - Samba + (sssd) + Winbind + LDAP? Couldn't try this one, as I seen
> that basically sssd=Winbind (yet there WAS a module for Winbind to
> use sssd?)
The winbind daemon came first and is used to connect Samba to AD, from
my understanding it was mostly written by one person. That person then
went on to work for redhat, where they wrote sssd to connect to
freeipa, using the winbind code as a base, in fact, sssd still requires
some of the Samba packages to function.
> 
> ...and this is where I got stuck.
> 
> What would I need to connect Authentik and Samba together without AD
> being the central place where I store users? (As two-way sync isn't
> in Authentik atm. with AD)
There is your (and Authentiks) problem, AD is the source of truth, it
is where users, groups and computers etc are stored, it is where
passwords are stored (in an unreadable unicode hash). In other words,
AD must be in charge. This is not to say that you could not setup an
external ldap server and sync users & passwords between it and AD, but
it will be, in my opinion, a lot of work for little return, especially
as there are other SSO providers that work with AD directly.

Rowland