Openfiler AD authentication

[GoldenWonder]

Just about to give up with this on so any suggestions will be handy!

 

Running Openfiler to create a NAS box, but cannot get it to authenticate via AD. Tried every variation on configuration but nothing seems to work. No errors, no joining to AD and nothing to hint at what is going wrong.

 

Checked the usual like system clock and DNS resolving ok but I'm stumped. You don't seem to get any logging errors either which doesn't help.

[danrhodes]

What type of auth are you trying to use? Kerberos, Transparent Kerberos, LDAP, Transparent NTLM??

[GoldenWonder]

I've been setting the options for 'Windows domain controller and authentication' and Kerberos. I've joined lots of hardware NAS boxes to our domain before with no issues (except clocks being out of sync!)

 

EDIT - its obviously goosed now, any configuration change I 'apply' simply results in a blank page being returned. FreeNAS anyone?!

Edited May 26, 2010 by GoldenWonder

[danrhodes]

I know it shouldn't make any difference but have you been using FQDN for your server and the Domain in CAPITALS as sometimes it can be fussy about these things.

 

Also if you are trying to configure openfiler through IE that also can complicate matter's, try using putty to SSH in or Firefox if you dont fancy the SSH method.

 

D

[GoldenWonder]

I've been using FQDN for server names, and have tried the domain in Caps and lower case.

 

I haven't tried using a different browser yet, might give Firefox a go once I've rebuilt it.

[danrhodes]

It must be a weird one, I've added what must be hundereds of NAS boxes to network over my years in IT and rarely have any issues apart from the obligitory time sync issues!

 

D

[Guest TheLibrarian]

I think I found this on EduGeek previously, I know I found it useful - Michael's guide to setting up OpenFiler 2.3 with Active Directory as a NAS box.

[danrhodes]

I think I found this on EduGeek previously, I know I found it useful - Michael's guide to setting up OpenFiler 2.3 with Active Directory as a NAS box.

 

Excellent trauling work Librarian, bookmarked that one!

 

D

[GoldenWonder]

Tried that excellent guide and configured as specified. Alas the user groups list remains completel empty no matter what I do!

[danrhodes]

This any good - https://forums.openfiler.com/viewtopic.php?id=3091

[GoldenWonder]

I looked through and the 'bug' with the realm name seems to have been resolved. Either that or it doesn't happen when I used Firefox. Now I have no errors, but when I open group list its empty!

 

I notice that although the guides recommend using the Join Domain option, my nas box still is not appearing in the domain. I guess this is part of the problem

 

The only error I can seem to get is if I try to add a new user:

 

Error adding new user.

ldap_add: No such object (32)

matched DN: DC=domainname,DC=org,DC=uk

additional info: 0000208D: NameErr: DSID-031001CD, problem 2001 (NO_OBJECT), data 0, best match of:

'DC=domainname,DC=org,DC=uk'

Edited May 26, 2010 by GoldenWonder

[GoldenWonder]

Well I got a stage further. After a complete rebuild and reinstall I managed to get the OF box to see AD, and user groups appeared. However after creating shares and setting permissions I get variable results. I've given Domain Admins full rights and a staff group R/W rights. This generally either doesn't work and a Windows authentication box appears when trying to access the share (\\nas\share) or they get a Windows error saying that it could not connect to the resource (i.e as if the path was invalid)

 

I noticed that when I expanded the Domain Admins group in the OF gui, it only showed users in the same OU as the group - some of our accounts are in a sub-OU and they weren't showing. It looks like OF is like a lot of other linux/unix systems that will only read AD if everything is in a single OU

[GoldenWonder]

To close this one off (and if anyone else is thinking of using OF in an AD environment - don't bother!)

 

I got it working - sort of. But it stops working every so often (i.e the group list shows up empty and no one can access any shares) so I can only assume OF isn't ready for AD authentication yet. Shame really but this is what holds me back from using more linux based stuff here -theres always a catch getting it to work with existing kit!

[danrhodes]

Have you tried FreeNas its alot better than open filer. I use FreeNas at home, I think its been on for nearly 1000 days without even a hickup!

[GoldenWonder]

I tried Freenas but this seemed a bit awkward in setting up the shares. Might have to revisit it and try again.

[danrhodes]

I have tried both OF and FN and find FN to be the better of the two products. Give it a chance!

 

D

[KK20]

I have to disagree. Our openfiler is used as server backup (server OU RW only), media library (pupil OU RO, staff OU RW) and staff shared work area (staff OU only) and pupils shared area (pupils OU read only, staff OU R/W). It is a 4x 1Tb drive software RAID1 array. Currently it is only an SMB share although I do intend on bringing an iSCSI array online in the coming year. Uptime is 121 days as of now, never missed a beat and groups work just fine.

 

I used the exact guide that librarian posted. "Use Windows domain controller and authentication": domain is my local "friendly" non FQDN name. DC is non-FQ friendly name. ADS realm is FQDN in capitals. Orginally I joined it to the domain. That was about that really.

Edited June 3, 2010 by KK20