1

My basic requirement is to use a macOS Monterey machine as a server (without running macOS Server, which is deprecated) to host SMB shares while using Active Directory as my network accounts source (an Ubuntu server running Samba4 AD DC), and have other macOS machine's user's loging in using the Kerberos SSO Extension (in other words, without having to enter credentials for the shares). Seemed simple enough :)

For the server, I initially explored the built-in smb setup in Monterey (ie: enabling "File Sharing") with the machine bound (authenticated bind) to the AD DC, but when trying to login via SMB from the client machines (click on the server on the left of a finder window), "Network Users" cannot see shares created by a local admin user (though the Kerberos SSO Extension handled passing the SSO credentials flawlessly). If I logged into the macOS Monterey server machine with an Active Directory account, it created a local home folder and then I could auto-log-in with the Kerberos-SSO extension for that same user as expected from a client machine (but could only see the home folder for that network user as a share - still couldn't see the ones that the local admin account created). Searched for a long time, tried lots of suggestions, but gave up on that option.

Figured I'd try installing samba from samba.org so I did a brew install samba on the Monterey server machine. I set it up similar to another SMB file server I have running on Ubuntu (eg: security = ads, configured realm = AD.DOMAIN.COM, etc.) but I seem to be unable to get it to talk to the AD DC server to validate user accounts. I get a lot of "NT_STATUS_NO_LOGON_SERVERS" in the debug log along with "winbindd not running" (which of course, doesn't appear to be available for macOS these days unless I've missed it). So - samba.org's implementation doesn't seem to pick up the methods Apple has used to get the kerberos authentication and domain binding working despite having done that AD authenticated bind on the server machine and seeing proper output from sudo ktutil list (even when configuring the smb.conf to include password server - dc.ad.domain.com), and I don't seem to be able to figure out what those underlying components are without spending significantly more time here. (did notice that homebrew's formula code for samba compiled it by default using --without-ads, which was problem #7 or #8 I stumbled upon - which told me that the formula trimmed samba down to the basics to get it to compile on a mac).

I've spent quite a bit of time searching for others who may have documented this same setup (host SMB shares on a mac using AD as the source for network accounts and Kerberos SSO Extension as the macOS client's authentication method (though I'd settle for simply entering a username/password and saving that to the keychain)) to no avail. Searching for macos and samba bring up a lot of stuff all the way back to 2004 (making it harder to sift through, as some of the older items are no longer relevant)

Question:

Rather than troubleshooting my setup, config files, etc. (which might take a while), I'm wondering if anyone can point me to a documented setup like this that they've seen that someone has managed to get working? I've just about exhausted the ways in which I can search for this setup. (I realize this looks like an ask to do my searching for me, but I'm really just looking to see if someone already has this running and can share a few tricks they used to get it going that I may not have run across yet - if my pain sounds familiar).

Failing that, perhaps I'll start a new post with lots of detail on my two approaches here (including what I've already tried over the last few weeks) to see if I've missed something. I know - trying to get a mac to host a robust samba file server is probably not the best idea (but I'll cling to that requirement for a while longer before I elect to go with another option).

Thank you in advance!

1
  • 1
    Welcome to Ask Different! Some friendly editorial advice>. Consider distilling this down to direct and practical question; succinctness helps immensely. Questions with a direct, practical question to be answered gets better responses and are more likely to get you to a solution.
    – Allan
    Feb 12, 2023 at 4:40

1 Answer 1

0

So, a bit of inspiration from @Todd's post here (Mounting SMB share on Monterey is rejected) using Apple's built-in SMB service about adding users to a specific share (com.apple.sharepoint.group.#) using dscl which I had read before and tried (didn't work) got me thinking about permissions. I realize that the folder I set up to test a share from the local admin account was within the local admin account's home directory structure (and hence not accessible to network users). Setting up a folder in the /Users/Shared folder instead resulted in AD Network users successfully seeing and accessing the share.

Doh! (I say sheepishly)

So I've solved my problem for using Apple's built-in SMB services (which was Plan A). The issues with the samba.org install (Plan B) still persist, but I will move on from here. I am happy that Ask Different's "Related Posts" on the right brought that one back to my attention again to carry on the thinking. Great site! Thank you.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .