Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss

[Samba] Import USER and PASSWORD Samba3+OpenLadp TO Samba4

880 views
Skip to first unread message

vinifa

unread,
Aug 25, 2015, 1:50:03 AM8/25/15
to
Good morning people! I would like some help from you, I'm looking to migrate
my 300 registered users in my samba3 + openladp to my new domain Samba4. I
will rejoin all machines in the new domain, but would not want to register
the 300 users again. I managed to import the user with the ldb command:

ldbadd -H /var/lib/samba/private/sam.ldb newusertest.ldif

When I give the command:

samba-tool user list

test the new user appears, but it is disabled in Windows RSAT also the
password does not work, although I have spent the password in ldif. Someone
managed to do this, migrate the user and password? If so, how it was done,
how should I proceed?

I await your help, thanks!



--
View this message in context: http://samba.2283325.n4.nabble.com/Import-USER-and-PASSWORD-Samba3-OpenLadp-TO-Samba4-tp4690180.html
Sent from the Samba - General mailing list archive at Nabble.com.

--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba

Rowland Penny

unread,
Aug 25, 2015, 3:20:02 AM8/25/15
to
On 25/08/15 06:16, vinifa wrote:
> Good morning people! I would like some help from you, I'm looking to migrate
> my 300 registered users in my samba3 + openladp to my new domain Samba4. I
> will rejoin all machines in the new domain, but would not want to register
> the 300 users again. I managed to import the user with the ldb command:
>
> ldbadd -H /var/lib/samba/private/sam.ldb newusertest.ldif
>
> When I give the command:
>
> samba-tool user list
>
> test the new user appears, but it is disabled in Windows RSAT also the
> password does not work, although I have spent the password in ldif. Someone
> managed to do this, migrate the user and password? If so, how it was done,
> how should I proceed?
>
> I await your help, thanks!
>
>
>
> --
> View this message in context: http://samba.2283325.n4.nabble.com/Import-USER-and-PASSWORD-Samba3-OpenLadp-TO-Samba4-tp4690180.html
> Sent from the Samba - General mailing list archive at Nabble.com.
>

No sorry, my crystal ball is on the fritz so I cannot read your
newusertest.ldif from here, so I cannot tell you where you are going wrong.

Rowland

Rowland Penny

unread,
Aug 25, 2015, 10:00:03 AM8/25/15
to
On 25/08/15 14:43, vinifa wrote:
> Thank Rowland, imagine that your crystal ball is not working, my already
> broken a long time .... I want to know if anyone here in the list have been
> through a similar problem with my, no wonder the ldif anyone, just wonder if
> anyone else has had to import only users and Openldap passwords for Samba4.
> Again thank you for your huge and wonderful collaboration Rowland.
>
>
>
> --
> View this message in context: http://samba.2283325.n4.nabble.com/Import-USER-and-PASSWORD-Samba3-OpenLadp-TO-Samba4-tp4690180p4690198.html
> Sent from the Samba - General mailing list archive at Nabble.com.
>

Look, just do what I asked you to do in my roundabout way, post the ldif
(suitably sanitized) and I or someone else will tell you where you are
going wrong, without seeing the ldif, nobody can help you.

vinifa

unread,
Aug 25, 2015, 10:00:04 AM8/25/15
to
Thank Rowland, imagine that your crystal ball is not working, my already
broken a long time .... I want to know if anyone here in the list have been
through a similar problem with my, no wonder the ldif anyone, just wonder if
anyone else has had to import only users and Openldap passwords for Samba4.
Again thank you for your huge and wonderful collaboration Rowland.



--
View this message in context: http://samba.2283325.n4.nabble.com/Import-USER-and-PASSWORD-Samba3-OpenLadp-TO-Samba4-tp4690180p4690198.html
Sent from the Samba - General mailing list archive at Nabble.com.

vinifa

unread,
Aug 25, 2015, 10:20:04 AM8/25/15
to
That's my ldif I can import successfully. The problem is not passing the
password for the Samba4...

dn: cn=usertest,cn=users,dc=dominio,dc=local
objectClass: usertest
sAMAccountName: usertest
displayName: User Test
homeDirectory: /home/usertest
uid: usertest
cn: usertest
uidNumber: 10211
userPassword:: e1NTSEF9Mk1Ya0NSTGsxQjRDbGhmcnk5MTYybEFMOEVoTFowUkg=
sn: usertest
givenName: usertest



--
View this message in context: http://samba.2283325.n4.nabble.com/Import-USER-and-PASSWORD-Samba3-OpenLadp-TO-Samba4-tp4690180p4690200.html
Sent from the Samba - General mailing list archive at Nabble.com.

Rowland Penny

unread,
Aug 25, 2015, 11:10:03 AM8/25/15
to
On 25/08/15 15:05, vinifa wrote:
> That's my ldif I can import successfully. The problem is not passing the
> password for the Samba4...
>
> dn: cn=usertest,cn=users,dc=dominio,dc=local
> objectClass: usertest
> sAMAccountName: usertest
> displayName: User Test
> homeDirectory: /home/usertest
> uid: usertest
> cn: usertest
> uidNumber: 10211
> userPassword:: e1NTSEF9Mk1Ya0NSTGsxQjRDbGhmcnk5MTYybEFMOEVoTFowUkg=
> sn: usertest
> givenName: usertest
>
>
>
> --
> View this message in context: http://samba.2283325.n4.nabble.com/Import-USER-and-PASSWORD-Samba3-OpenLadp-TO-Samba4-tp4690180p4690200.html
> Sent from the Samba - General mailing list archive at Nabble.com.
>
OK, before I comment on this ldif, can we confirm just how you are
running samba4, are you running it as an AD DC? or an NT4-style PDC i.e.
are you using openldap with samba4.

Rowland

vinifa

unread,
Aug 25, 2015, 11:10:04 AM8/25/15
to
I am using AD DC. I already have a domain Samba3 + Openladp, I'm creating
this new domain Samba4, but I want to import all users who have already
registered in my base Openldap. If it was the same demesne I would use the
migration tool, but it's a different domain.



--
View this message in context: http://samba.2283325.n4.nabble.com/Import-USER-and-PASSWORD-Samba3-OpenLadp-TO-Samba4-tp4690180p4690202.html
Sent from the Samba - General mailing list archive at Nabble.com.

Rowland Penny

unread,
Aug 25, 2015, 11:50:03 AM8/25/15
to
On 25/08/15 16:02, vinifa wrote:
> I am using AD DC. I already have a domain Samba3 + Openladp, I'm creating
> this new domain Samba4, but I want to import all users who have already
> registered in my base Openldap. If it was the same demesne I would use the
> migration tool, but it's a different domain.
>
>
>
> --
> View this message in context: http://samba.2283325.n4.nabble.com/Import-USER-and-PASSWORD-Samba3-OpenLadp-TO-Samba4-tp4690180p4690202.html
> Sent from the Samba - General mailing list archive at Nabble.com.
>

OK, this is a users object in my test AD domain:

dn: CN=User3,CN=Users,DC=example,DC=com
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: user
cn: User3
instanceType: 4
whenCreated: 20150621144659.0Z
uSNCreated: 45224
name: User3
objectGUID: cafff519-eeae-4a4b-8395-09b059a9b919
userAccountControl: 512
codePage: 0
countryCode: 0
primaryGroupID: 513
objectSid: S-1-5-21-2025076216-3455336656-3842161122-2106
accountExpires: 9223372036854775807
sAMAccountName: User3
sAMAccountType: 805306368
userPrincipalName: Us...@example.com
objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=example,DC=com
unixUserPassword: ABCD!efgh12345$67890
msSFU30Name: User3
msSFU30NisDomain: example
uidNumber: 10023
gidNumber: 10007
unixHomeDirectory: /home/User3
loginShell: /bin/false
whenChanged: 20150624075921.0Z
pwdLastSet: 0
uSNChanged: 45447
distinguishedName: CN=User3,CN=Users,DC=example,DC=com

If I wanted to add this user with an ldif, I would use something like this:

dn: CN=User3,CN=Users,DC=example,DC=com
changetype: add
cn: User3
objectClass: user
sAMAccountName: User3
userPrincipalName: Us...@example.com
name: User3
userAccountControl: 512
objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=example,DC=com
uid: User3
msSFU30Name: User3
msSFU30NisDomain: example
uidNumber: 10023
gidNumber: 10007
loginShell: /bin/false
unixHomeDirectory: /home/User3
unixUserPassword: ABCD!efgh12345$67890

dn: CN=User3,CN=Users,DC=example,DC=com
changetype: modify
replace: unicodePwd
unicodePwd::$UNICODEPWD"

To get $UNICODEPWD, I would do this:

UNICODEPWD=$(echo -n "\"$_USER_PW\"" | $_ICONV -f UTF-8 -t UTF-16LE |
$_BASE64 -w 0)

As you can see the required ldif is different from yours and I told you
this over on the samba-technical mailing list.

The easiest way for you to add the users will be to write a script that
will parse your ldif, using it to obtain the user name etc and then use
'samba-tool user create' to actually create the users, your only problem
will be obtaining the users password. Unless you know the users plain
passwords, it may be easier to create a new password and set the user to
change the password at next logon.

Rowland
Rowland

vinifa

unread,
Aug 25, 2015, 1:50:04 PM8/25/15
to
Got it, I'll edit my best ldif, I'm thinking and do what you said, reading my
ldif, seeking users and regarding the password, leave without password, but
force him to change at next logon. Now, as I have in ldif enable this
option? Or I'll have to do this in the user manager for user-RSAT Windows?
And thanks for Rowland strength.



--
View this message in context: http://samba.2283325.n4.nabble.com/Import-USER-and-PASSWORD-Samba3-OpenLadp-TO-Samba4-tp4690180p4690212.html
Sent from the Samba - General mailing list archive at Nabble.com.

Rowland Penny

unread,
Aug 25, 2015, 2:00:03 PM8/25/15
to
On 25/08/15 18:36, vinifa wrote:
> Got it, I'll edit my best ldif, I'm thinking and do what you said, reading my
> ldif, seeking users and regarding the password, leave without password, but
> force him to change at next logon. Now, as I have in ldif enable this
> option? Or I'll have to do this in the user manager for user-RSAT Windows?
> And thanks for Rowland strength.
>
>
>

I don't think that is going to work, you are going to have to give the
user a password and somehow get it to them, email ? a webpage ?

Rowland

vinifa

unread,
Aug 25, 2015, 2:10:03 PM8/25/15
to
A blank password should work yes, but I do not know if I can make is to put
each user change password at next logon. I did not see this option in the
ldif ...



--
View this message in context: http://samba.2283325.n4.nabble.com/Import-USER-and-PASSWORD-Samba3-OpenLadp-TO-Samba4-tp4690180p4690214.html
Sent from the Samba - General mailing list archive at Nabble.com.

Rowland Penny

unread,
Aug 25, 2015, 3:00:04 PM8/25/15
to
On 25/08/15 18:53, vinifa wrote:
> A blank password should work yes, but I do not know if I can make is to put
> each user change password at next logon. I did not see this option in the
> ldif ...
>
>
>
> --
> View this message in context: http://samba.2283325.n4.nabble.com/Import-USER-and-PASSWORD-Samba3-OpenLadp-TO-Samba4-tp4690180p4690214.html
> Sent from the Samba - General mailing list archive at Nabble.com.
>

You need to set the pwdLastSet** attribute to zero (0)

Rowland

vinifa

unread,
Aug 26, 2015, 11:10:04 AM8/26/15
to
Really did not work, if I create a user in RSAT no password, and select the
option to change password at next logon, works. Now if I import the LDIF
even enabling this function does not work. This issue of password, you know
how I can put a default password for all users, such as 123456?

I did not understand what you sent me.

replace: unicodePwd
unicodePwd :: $ unicodePwd "

To get $ unicodePwd, I would do this:

UnicodePwd = $ (echo -n "\" $ _ user_pw \ "" | $ _ICONV -f -t UTF-8 UTF-16LE
|
$ _BASE64 -w 0)



--
View this message in context: http://samba.2283325.n4.nabble.com/Import-USER-and-PASSWORD-Samba3-OpenLadp-TO-Samba4-tp4690180p4690271.html
Sent from the Samba - General mailing list archive at Nabble.com.

L.P.H. van Belle

unread,
Aug 26, 2015, 11:30:04 AM8/26/15
to
Hai,
just make a CSV file and import your users.

this is the script i used.

#!/bin/bash
## example
## display naam in AD wil be : Louis van Belle (
cat /home/samba/backup/users.csv | awk -F ";" '{system("/usr/bin/samba-tool user add "$5" --mail-address="$7" \
--given-name="$4" --surname=\""$3"\" --telephone-number="$6" --department="$1" --description=\""$1"\" \
--random-password --userou=ou=Company")}';

the layout of the CSV( which i got from an export of my samba3+ldap)
IT-Department;L.P.H.;van Belle;Louis;my-loginname;phonenummer;e-m...@domain.tld;

use : samba-tool user add --help
for more examples

this is how it for you would be.. where the password is WelkomUsername

/usr/bin/samba-tool user add "$5" "Welkom$5" --mail-address="$7" \
--given-name="$2" --surname=\""$3"\" --telephone-number="$6" \
--department="$1" --description=\""$1"\" --userou=ou=Company \
--must-change-at-next-login

Just notice that i made an separated OU for my company.. ( see also the help )


Greetz,

Louis


>-----Oorspronkelijk bericht-----
>Van: samba [mailto:samba-...@lists.samba.org] Namens vinifa
>Verzonden: woensdag 26 augustus 2015 17:01
>Aan: sa...@lists.samba.org
>Onderwerp: Re: [Samba] Import USER and PASSWORD
>Samba3+OpenLadp TO Samba4

Rowland Penny

unread,
Aug 26, 2015, 12:00:05 PM8/26/15
to
Hi Louis,
I actually advised him to do something similar with his ldif.

Vinifa,
What I posted was a piece of code from a bash script I wrote to add Unix
users to AD,this is it again:

UNICODEPWD=$(echo -n "\"$_USER_PW\"" | $_ICONV -f UTF-8 -t UTF-16LE |
$_BASE64 -w 0)


It sets the variable 'UNICODEPWD' to what running the code inside the
brackets produces.

i.e. if the users password is to be 'password' , 'echo -n \"password\" |
iconv -f UTF-8 -t UTF-16LE | base64 -w 0'

The '|' means 'pass' or more correctly 'pipe' the result of the left
hand command to the command on the right, the '\' signs are important,
they escape the quote marks which MUST be there.

Rowland

vinifa

unread,
Aug 26, 2015, 10:40:03 PM8/26/15
to
Hello! Good evening, thanks for your help! I could import the users of my CSV
for my Samba4 following its recommendations, but unfortunately there's
something wrong, despite the user there, it does not work, give a klist to
check the credential, returns me the error:

kinit: Client 'us...@DOMAIN.LOCAL' not found in Kerberos database while
getting initial credentials

Even if I change the password through the RSAT, it does not.

I also noticed something when I give getent passwd returns me the user a
little different. Looks like was:

DOMAIN\user1:*:3000345:100: User1 Test: /home/DOMAIN/user1:/bin/false
:/bin/false100::/home/DOMAIN/user2

This problem happened to you?

That's my CSV

server:/tmp# cat export_novo.csv
COMPANY; User1; Test; user1

The simple command, with only User and Password looked like this:

cat export_novo.csv | awk -F ";" '{system("samba-tool user add "$4"
"pass$4"")}';





--
View this message in context: http://samba.2283325.n4.nabble.com/Import-USER-and-PASSWORD-Samba3-OpenLadp-TO-Samba4-tp4690180p4690327.html

vinifa

unread,
Sep 1, 2015, 12:50:03 AM9/1/15
to
Thank Rowland Penny-6 and L.P.H. Van Belle for all the help I could not do
that users were exported from script, but I got a "trigger" to matter the
bills ... was ugly to look at, but for me it worked. I exported the CSV,
then edited, made a statement block where each line I gave the samba-tool
user add, edit in Excel and Notepad ++ to find and replace ... it took me 10
minutes to do 300 users ... LOL
Anyway, I am very grateful for your help, thank you!


###########################################################
#/bin/bash
samba-tool user add user1 pass --given-name=User --surname="Test"
--description=departament --userou=ou=SMB3 --must-change-at-next-login;
samba-tool user add user2 pass --given-name=User2 --surname="Test"
--description=departament --userou=ou=SMB3 --must-change-at-next-login;

###########################################################



--
View this message in context: http://samba.2283325.n4.nabble.com/Import-USER-and-PASSWORD-Samba3-OpenLadp-TO-Samba4-tp4690180p4690606.html

mathias dufresne

unread,
Sep 1, 2015, 9:50:04 AM9/1/15
to
Hi,

You should be able to keep your users passwords:

There is a patch written by Alberto Maria Fiaschi, posted on this list or
on samba-technical, to be able to set user password with pdbedit using
nt-hash.

Perhaps I'm wrong but I believe there is a nt-hash in Samba3 / OpenLDAP
configurations.

I've really tested this patch only Samba 4.3.0-rc3, as I had to complie
that version. The patch was applying itself without complain against 4.2.3,
but I didn't push until compilation...

Regarding disabled users you should set them the correct
"userAccountControl" value when you add them with ldif files. I haven't dig
enough into that to tell you what values are correct.

Cheers,
0 new messages