sssd-libwbclient is needed on RHEL/CentOS 7.5+ systems

[erinn]

Cookbook version

1.1.4

Chef-client version

14.2.0

Platform Details

RHEL 7.5 x86_64
samba-4.7.1-9.el7_5.x86_64

Scenario:

When a RHEL system is AD joined using SSSD, winbind does not function as samba is not AD joined. To get samba to work with an systems joined to the AD through SSSD the package sssd-libwbclient is needed. However, it can't just blindly be installed as it will override winbind, and for folks who join a system to the AD using samba, they rely on winbind.

An attribute or a flag of some sort is needed to state that SSSD is being used and as such the package sssd-libwbclient needs to be installed.

Steps to Reproduce:

Setup cookbook to configure a RHEL/CentOS 7.5 system that is joined to the AD via SSSD to run as a file share (security = ads) startup of samba will fail because winbind is not enabled, obscure error message in /var/log/samba/log.smbd:
[2018/08/22 10:48:42.481282, 0] ../source3/auth/auth_util.c:1399(make_new_session_info_guest)
create_local_token failed: NT_STATUS_NO_MEMORY
[2018/08/22 10:48:42.482097, 0] ../source3/smbd/server.c:2011(main)
ERROR: failed to setup guest info.

Winbind will not start due to not being AD joined, solution is to install the sssd-libwbclient package.

Expected Result:

Samba to start and serve shares.

Actual Result:

Already mentioned in steps to reproduce.

[damacus]

Thanks for such a detailed case.

We should be able to cook up something.

[damacus]

Hey @erinn do you fancy dropping a PR? If you want any guidance to testing or style, please don't hesitate to ask.

Thanks,
Dan

[jringoot]

Thanks: installing "sssd-libwbclient" was just the solution for me to the same error you have, to get samba up and running

create_local_token failed: NT_STATUS_NO_MEMORY

[damacus]

Would you mind making a fix to this cookbook to share that with all the other users of the cookbook?

Thanks!
Dan

[jringoot]

Would you mind making a fix to this cookbook to share that with all the other users of the cookbook?

Thanks!
Dan

Sorry Dan, I don't know howto, I am not a chef user, but I do use sssd as authentication service.
This is the first hit I got when googling for the error I got.