OpenDJ integration with Samba

Although the integration of OpenDJ with Samba is not explicitly documented, it does exist for OpenDS – which, as we already know, is the same product as OpenDJ. However, what is not covered is the synchronisation for the Samba password attributes with the LDAP password. This is the aspect we would try to cover in this article.

The problem

In order to have Windows PCs authenticated against Samba, it has to use encoding algorithms specified by Microsoft standards to store the password hashes. For that purpose, it uses two attributes: “sambaLMPassword” and “sambaNTPassword”. On the other hand, an LDAP directory server would normally use “userPassword” attribute to store it’s own password hash (which, by the way, is usually not according to the Microsoft world).

This situation brings about the issue of password synchronisation between the “userPassword” and Samba password attributes. Although Samba provides a feature to synchronise the Samba password with the LDAP password, it does not work in the opposite direction – when the password is changed though the LDAP, the Samba password attributes remain unchanged.

Solution to this problem can be achieved with a plug-in which intercepts the password changes and synchronises the attributes with appropriate values.

The plug-in

OpenDJ has been designed to be highly extensible, so that virtually every aspect of the way it works could be customised. It also comes with an example plug-in which can serve as a good starting basis for development.

Our plug-in covers the following use cases:

• the user password is changed using LDAP modify operation (replace change type on “userPassword” or delete and add change on “userPassword”), and
• the user password is changed using Password Modify Extended Operation.

The basic set-up for OpenDJ integration with Samba is available on the OpenDS wiki page –” Samba as Primary Domain Controler”. Please note that those are basic instructions for a quick set-up and it might not be appropriate for the production use. For the production, make sure you completely understand both products and how to configure them properly to fir your environment. Among other things, consider using a dedicated user instead of “cn=Directory Manager” as noted above.

The installation of the plug-in requires the following steps:

1. copy the JAR file to the OpenDJ directory tree;
2. install the plug-in schema;
3. restart the directory, and
4. configure the plug-in.

dsconfig -X create-plugin -D "cn=directory manager" 
-w <password> -h localhost 
--plugin-name "Samba Password Synchronisation" 
--type samba-password --set enabled:true 
--set samba-oc:sambaSAMAccount

dsconfig -X -n create-debug-target -D "cn=directory manager" 
-w <password> -h localhost --publisher-name "File-Based Debug Logger" 
--target-name cz.profiq.opendj.plugins.SambaPasswordPlugin 
--set debug-level:all

dsconfig -X -n set-log-publisher-prop -D "cn=directory manager" 
-w <password> -h localhost --publisher-name "File-Based Debug Logger" 
--set enabled:true