My basic requirement is to use a macOS Monterey machine as a server (without running macOS Server, which is deprecated) to host SMB shares while using Active Directory as my network accounts source (an Ubuntu server running Samba4 AD DC), and have other macOS machine's user's loging in using the Kerberos SSO Extension (in other words, without having to enter credentials for the shares). Seemed simple enough :)
For the server, I initially explored the built-in smb setup in Monterey (ie: enabling "File Sharing") with the machine bound (authenticated bind) to the AD DC, but when trying to login via SMB from the client machines (click on the server on the left of a finder window), "Network Users" cannot see shares created by a local admin user (though the Kerberos SSO Extension handled passing the SSO credentials flawlessly). If I logged into the macOS Monterey server machine with an Active Directory account, it created a local home folder and then I could auto-log-in with the Kerberos-SSO extension for that same user as expected from a client machine (but could only see the home folder for that network user as a share - still couldn't see the ones that the local admin account created). Searched for a long time, tried lots of suggestions, but gave up on that option.
Figured I'd try installing samba from samba.org so I did a brew install samba on the Monterey server machine. I set it up similar to another SMB file server I have running on Ubuntu (eg: security = ads, configured realm = AD.DOMAIN.COM, etc.) but I seem to be unable to get it to talk to the AD DC server to validate user accounts. I get a lot of "NT_STATUS_NO_LOGON_SERVERS" in the debug log along with "winbindd not running" (which of course, doesn't appear to be available for macOS these days unless I've missed it). So - samba.org's implementation doesn't seem to pick up the methods Apple has used to get the kerberos authentication and domain binding working despite having done that AD authenticated bind on the server machine and seeing proper output from sudo ktutil list (even when configuring the smb.conf to include password server - dc.ad.domain.com), and I don't seem to be able to figure out what those underlying components are without spending significantly more time here. (did notice that homebrew's formula code for samba compiled it by default using --without-ads, which was problem #7 or #8 I stumbled upon - which told me that the formula trimmed samba down to the basics to get it to compile on a mac).
I've spent quite a bit of time searching for others who may have documented this same setup (host SMB shares on a mac using AD as the source for network accounts and Kerberos SSO Extension as the macOS client's authentication method (though I'd settle for simply entering a username/password and saving that to the keychain)) to no avail. Searching for macos and samba bring up a lot of stuff all the way back to 2004 (making it harder to sift through, as some of the older items are no longer relevant)
Question:
Rather than troubleshooting my setup, config files, etc. (which might take a while), I'm wondering if anyone can point me to a documented setup like this that they've seen that someone has managed to get working? I've just about exhausted the ways in which I can search for this setup. (I realize this looks like an ask to do my searching for me, but I'm really just looking to see if someone already has this running and can share a few tricks they used to get it going that I may not have run across yet - if my pain sounds familiar).
Failing that, perhaps I'll start a new post with lots of detail on my two approaches here (including what I've already tried over the last few weeks) to see if I've missed something. I know - trying to get a mac to host a robust samba file server is probably not the best idea (but I'll cling to that requirement for a while longer before I elect to go with another option).
Thank you in advance!
