trusted relation between Active Directory and Open Directory

[peshay]

Hello,

I have a Windows Server 2003 Active Directory and a Mac OS X Leopard 10.5.3 Open Directory.
Every Directory should have it´s own independent domain structure. But I want to have Users from the OD to have access on a share on the AD, for example. As I knew, I could make a trusted relation between the directories, like number 2) on this link: https://www.afp548.com/xrealm/
number 1) didn´t worked because I dont´t have ksetup on the Windows command line.
I read an article which explains that, how it would work with Samba: http://msadfaq.de/wiki/ActiveDirectory/trust_relationship_samba_ad (sorry for you guys, it´s in german)
Because Mac OS X also uses Samba, I thought that this should work. But if I try this command:
net rpc trustdom add -Udiradmin -d 1

I get an error back:
[2008/06/18 09:07:25, 1, pid=7994] /SourceCache/samba/samba-187/samba/source/utils/net_rpc.c:run_rpc_command(170)
rpc command function failed! (NT_STATUS_INSUFFICIENT_RESOURCES)

And this is what the samba logfiles says:
opendirectory_sam_searchname gave -14136 [eDSRecordNotFound]: no dsRecTypeStandard:Computers record for account ‘WIN2003$’
odssam_getgrnam gave -14136 [eDSRecordNotFound]: no dsRecTypeStandard:Groups record for ‘WIN2003$’!
opendirectory_sam_searchname gave -14136 [eDSRecordNotFound]: no dsRecTypeStandard:Computers record for account ‘WIN2003$’
no credentials available

_samr_create_user: Running the command `/usr/bin/opendirectorypdbconfig -c create_computer_account -r win2003$ -n /LDAPv3/127.0.0.1′ gave 136
opendirectory_sam_searchname gave -14136 [eDSRecordNotFound]: no dsRecTypeStandard:Computers record for account ‘WIN2003$’
pdb_default_create_user: failed to add a new account for ‘WIN2003$’

If I create a group with the name of the AD domain and rerun the command, I get this error:
[2008/06/18 09:13:10, 1, pid=8055] /SourceCache/samba/samba-187/samba/source/utils/net_rpc.c:run_rpc_command(170)
rpc command function failed! (NT_STATUS_ALIAS_EXISTS)

And get this in the samba logfile:
opendirectory_sam_searchname gave -14136 [eDSRecordNotFound]: no dsRecTypeStandard:Computers record for account ‘WIN2003$’

If I then also create a computer account with this name, I get this error:
[2008/06/18 09:14:34, 1, pid=8068] /SourceCache/samba/samba-187/samba/source/utils/net_rpc.c:run_rpc_command(170)
rpc command function failed! (NT_STATUS_INTERNAL_ERROR)

samba logfile:
User WIN2003$ with invalid SID S-0-0 in passdb
Could not get RID of fresh user

If this would work correctly I should be able to search at the Windows Server for Users in the OD domain, to give them rights in the AD domain.

Thanks for any help
Andreas

[peshay]

No ideas? At least a rtfm would be nice, if it points to a manual that really could help me to do this!

[peshay]

now I got it!
I installed the Support Tools from Windows 2003 Server and then I had ksetup, after adding the other domain, I was able to mount a share from the Mac OS X Server with a Win2003 Kerberos Ticket!
But its not working in the other directory, if I have a kerberos ticket from the OS X Server I cannot mount a SMB Share from the Windows Server:
ahu:~$ smbclient -k –user ahu \\\\win2003\\\wmpub
ads_krb5_mk_req: krb5_get_credentials failed for win2003$@WIN2003.EXAMPLE.COM (Decrypt integrity check failed)
cli_session_setup_kerberos: spnego_gen_negTokenTarg failed: Decrypt integrity check failed
session setup failed: SUCCESS – 0

Any ideas, whats missing?

[Author]

Posts