title: SSSD Authentication with Samba 4
body: <p>I have recently upgraded to samba 4 from samba 3.5 on a RHEL 6.3 platform. It is pleasing that the new version can replace AD DC and has it's own built it kdc and ldb database. Now my intention is to make linux boxes authenticate to samba4 by connecting through ldap as samba 4 works like a kerberized ldap server. I am able to connect using Apache directory studio using the administrator dn to the ldap database. However I am unable to properly configure sssd on RHEL 6 client machines to authenticate against the samba server via ldap. Here is my sssd configuration file-</p>
  
  <pre><code>[sssd]
  config_file_version = 2
  reconnection_retries = 3
  sbus_timeout = 30
  services = nss, pam
  domains = default
  
  [nss]
  filter_groups = root
  filter_users = root
  reconnection_retries = 3
  
  [pam]
  reconnection_retries = 3
  
  [domain/default]
  ldap_default_authtok_type = password
  ldap_id_use_start_tls = False
  cache_credentials = True
  ldap_group_object_class = group
  ldap_search_base = &lt;My Domain dn&gt;
  chpass_provider = krb5
  ldap_default_authtok = &lt;Administrator Password&gt;
  id_provider = ldap
  auth_provider = krb5
  ldap_default_bind_dn = cn=Administrator,cn=Users,&lt;My Domain dn&gt;
  ldap_user_gecos = displayName
  debug_level = 0
  ldap_uri = ldap://&lt;samba_server_hostname&gt;/
  krb5_realm = &lt;krb auth realm(same as domain name)&gt;
  krb5_kpasswd = &lt;samba_server_hostname&gt;
  ldap_schema = rfc2307bis
  ldap_force_upper_case_realm = True
  ldap_user_object_class = person
  ldap_tls_cacertdir = /etc/openldap/cacerts
  krb5_kdcip = &lt;samba_server_hostname&gt;
  </code></pre>
  
  <p>I can run kinit for Administrator on the client successfully, and I can run ldapsearch when binding as Administrator but id or getent passwd for any user is not working. Any ideas please ??</p>