Active Directory (AD) server authentication - Revision history

Pa-P at 13:31, 26 November 2025

2025-11-26T13:31:10Z

← Older revision		Revision as of 13:31, 26 November 2025
Line 61:		Line 61:
	*'''rid + tdb (default)''' - This option utilizes the rid backend for ID mapping to AD users. UID/GIDs range has to be entered manually The tdb backend is used when no other configuration is set. Recommended for large databases.Samba Wiki link for rid backend: [https://wiki.samba.org/index.php/Idmap_config_rid https://wiki.samba.org/index.php/Idmap_config_rid]		*'''rid + tdb (default)''' - This option utilizes the rid backend for ID mapping to AD users. UID/GIDs range has to be entered manually The tdb backend is used when no other configuration is set. Recommended for large databases.Samba Wiki link for rid backend: [https://wiki.samba.org/index.php/Idmap_config_rid https://wiki.samba.org/index.php/Idmap_config_rid]
	*'''ad (with RFC2307 schema) + tdb''' - Allows reading ID mappings from an AD server, provided that the uidNumber attributes for users and gidNumber attributes for groups were added in advance in the AD. This backend requires additional configuration of uidNumber and gidNumber on the AD server side. The tdb back end is used when no other configuration is set. Samba Wiki link for rid backend: [https://wiki.samba.org/index.php/Idmap_config_ad https://wiki.samba.org/index.php/Idmap_config_ad]		*'''ad (with RFC2307 schema) + tdb''' - Allows reading ID mappings from an AD server, provided that the uidNumber attributes for users and gidNumber attributes for groups were added in advance in the AD. This backend requires additional configuration of uidNumber and gidNumber on the AD server side. The tdb back end is used when no other configuration is set. Samba Wiki link for rid backend: [https://wiki.samba.org/index.php/Idmap_config_ad https://wiki.samba.org/index.php/Idmap_config_ad]
	*'''autorid''' - ~~This backend can be used if users are imported from a set of different domains.~~ Automatically configures the range to be used for each domain. The only configuration needed is the range of UID/GIDs used for user/group mappings and the number of IDs per domain.Samba Wiki link for autorid backend: [https://wiki.samba.org/index.php/Idmap_config_autorid https://wiki.samba.org/index.php/Idmap_config_autorid]		*'''autorid''' - Automatically configures the range to be used for each domain. The only configuration needed is the range of UID/GIDs used for user/group mappings and the number of IDs per domain. Samba Wiki link for autorid backend: [https://wiki.samba.org/index.php/Idmap_config_autorid https://wiki.samba.org/index.php/Idmap_config_autorid]


			Autorid is not recommended in cluster environments.

	== Troubleshooting ==		== Troubleshooting ==

Ma-W: 1 revision

2024-12-19T15:12:55Z

1 revision

← Older revision	Revision as of 15:12, 19 December 2024
(No difference)

Da-F at 09:23, 12 December 2024

2024-12-12T09:23:55Z

← Older revision		Revision as of 09:23, 12 December 2024
Line 57:		Line 57:
	*'''Scan all trusted domains''' - Using this function allows the user to obtain users and groups from the main and trusted domains.		*'''Scan all trusted domains''' - Using this function allows the user to obtain users and groups from the main and trusted domains.

	<br/>'''ID mapping ~~back end~~:'''		<br/>'''ID mapping backend:'''

	*'''rid + tdb (default)''' - This option utilizes the rid backend for ID mapping to AD users. UID/GIDs range has to be entered manually The tdb backend is used when no other configuration is set. Recommended for large databases.Samba Wiki link for rid backend: [https://wiki.samba.org/index.php/Idmap_config_rid https://wiki.samba.org/index.php/Idmap_config_rid]		*'''rid + tdb (default)''' - This option utilizes the rid backend for ID mapping to AD users. UID/GIDs range has to be entered manually The tdb backend is used when no other configuration is set. Recommended for large databases.Samba Wiki link for rid backend: [https://wiki.samba.org/index.php/Idmap_config_rid https://wiki.samba.org/index.php/Idmap_config_rid]
	*'''ad (with RFC2307 schema) + tdb''' - Allows reading ID mappings from an AD server, provided that the uidNumber attributes for users and gidNumber attributes for groups were added in advance in the AD. This backend requires additional configuration of uidNumber and gidNumber on the AD server side. The tdb back end is used when no other configuration is set. Samba Wiki link for rid backend: [https://wiki.samba.org/index.php/Idmap_config_ad https://wiki.samba.org/index.php/Idmap_config_ad]		*'''ad (with RFC2307 schema) + tdb''' - Allows reading ID mappings from an AD server, provided that the uidNumber attributes for users and gidNumber attributes for groups were added in advance in the AD. This backend requires additional configuration of uidNumber and gidNumber on the AD server side. The tdb back end is used when no other configuration is set. Samba Wiki link for rid backend: [https://wiki.samba.org/index.php/Idmap_config_ad https://wiki.samba.org/index.php/Idmap_config_ad]
	*'''autorid''' - This backend can be used if users are imported from a set of different domains. Automatically configures the range to be used for each domain. The only configuration needed is the range of UID/GIDs used for user/group mappings and the number of IDs per domain.Samba Wiki link for autorid backend: [https://wiki.samba.org/index.php/Idmap_config_autorid https://wiki.samba.org/index.php/Idmap_config_autorid]		*'''autorid''' - This backend can be used if users are imported from a set of different domains. Automatically configures the range to be used for each domain. The only configuration needed is the range of UID/GIDs used for user/group mappings and the number of IDs per domain.Samba Wiki link for autorid backend: [https://wiki.samba.org/index.php/Idmap_config_autorid https://wiki.samba.org/index.php/Idmap_config_autorid]
	<div></div><div></div>


			== Troubleshooting ==

			'''<span style="font-size:small">The TDB UID/GIDs mapping does not work properly.</span>'''

			'''Single-Domain Environments'''
			<div>It is recommended to use the "autorid" option in the "ID mapping backend" settings. Alternatively, you can use the "rid+tdb" option. If you choose "rid+tdb," set the UID/GIDs mapping to "rid" and define the Min ID and Max ID range (e.g., 2,000,000 to 2,999,999). The range 1,000,000 to 1,999,999 is reserved.</div><br/>
			'''Multi-Domain Environments'''
			<div>The "autorid" option cannot be used. Instead, use "rid+tdb" or "ad (with RFC2307 schema) + tdb." Ensure the UID/GIDs mapping is set to "rid" and define the Min ID and Max ID range for each domain (e.g., 2,000,000 to 2,999,999 for the first domain, 3,000,000 to 3,999,999 for the second domain, etc.).</div>
	[[Category:Help topics]]		[[Category:Help topics]]

Pa-P at 11:50, 3 January 2024

2024-01-03T11:50:10Z

← Older revision		Revision as of 11:50, 3 January 2024
Line 1:		Line 1:
	This ~~function allows you to connect to an existing Active Directory server. You can also observe the status of this connection and check if~~ users ~~and~~ groups ~~were recently synchronized~~.		__NOTOC__
			This functionality is available in '''User Management > Share users/groups > Authorization protocols'''.

	To ~~connect~~ to the existing ~~AD click the “'''Join AD~~ server~~'''" button.~~		<br/>To configure a connection to the existing Active Directory server:

	~~Status description:~~		#Navigate to the '''User Management '''section in the left menu.
			#Go to the '''Share users/groups''' tab.
			#Find the '''Active Directory (AD) server authentication''' block.
			#Enable the '''Enable protocol''' option.

	*Connection - shows whether you are connected to an AD server or not,
	*Users/groups list - shows when were the lists of users and groups last synchronized or if they are synchronizing.

	~~Users and groups are synchronized with an Active Directory server every 2 hours. Synchronization can also be started manually by using the “'''Synchronize'''” button.~~

	~~Optionally, you can set the “'''~~AD server authentication ~~settings'''”. In this case, you must fill in the following fields:~~		== AD server authentication status ==

	*~~Realm,~~		*'''Connection''' - shows whether you are connected to an AD server or not.
	*~~Server IP,~~		*'''Users/groups list''' - shows when the lists of users and groups were last synchronized or if the synchronization is taking place at the moment.
	*Administrator name,
	*Password.

	'''~~NOTE~~'''~~: Password cannot contain:~~		Users and groups are synchronized with an Active Directory server every 2 hours. Synchronization can also be started manually by using the '''Synchronize''' button.

	~~special characters such as ' " ` ^ & $ # ~ [ ] \ / \| ~~
	*spaces,
	*less than 12 and more than 16 characters.

	~~==== ====~~

	~~'''The following reasons might prevent you from connecting to Active Directory:'''~~		== AD server authentication settings ==

			To connect to the existing AD server, fill in the following fields with credentials provided by the AD server administrator and click the '''Apply''' button.

			*'''Realm'''
			*'''Administrator name'''
			*'''Password'''<br/>NOTE''': Password cannot contain:'''
			*special characters such as ' " ` ^ & $ # ~ [ ] \ / \|  : ? < >
			**spaces
			**less than 12 and more than 16 characters
			*'''Organizational Unit (OU) - '''a direct path to the container where the Computer Organizational Unit is placed. The path must be entered starting from the primary container name within the domain structure. The container name set by default is '''Computers'''. If another container name is used instead, then '''Computers''' must be changed to the appropriate name. If the path to the container is nested, use a slash as the connector. In the screenshot below, the OU is in the '''Computers''' container that is nested in '''AllComputers > Marketing'''. In this example, the path to the OU is: '''AllComputers/Marketing/Computers'''<br/><br/>[[File:Ad-structure.png]]<br/><br/>NOTE''': Container name can't contain:'''
			**special characters such as , + " \ < > ; = / #
			**spaces


			<div>'''The following reasons might prevent you from connecting to Active Directory:'''<br/></div>
			#Difference in time between Active Directory Server - if the time difference is greater than 5 minutes, the connection is not possible.
			#The method of authenticating trusted domains - the authentication has to be set to two-way trust. Otherwise, it is not possible to read users and groups from trusted domains.
			#DNS configuration - for an Active Directory domain, it is not possible to use a round-robin mechanism in DNS. This is connected to the fact that only one IP address is authorized. In a moment when another IP is obtained from DNS, the connection is not possible.
	#The '''server name''' is the same as the Computer Organizational Unit (OU) named in the Active Directory (AD) server. If the object with the same name exists and the user that you use to log in to the AD server does not have permission to access this file, the connection will fail. The solution is to delete the existing computer object from the AD server. The following information explains how to delete the OU file:		#The '''server name''' is the same as the Computer Organizational Unit (OU) named in the Active Directory (AD) server. If the object with the same name exists and the user that you use to log in to the AD server does not have permission to access this file, the connection will fail. The solution is to delete the existing computer object from the AD server. The following information explains how to delete the OU file:
	#*Log on to the Domain Controller with the domain administrator account. Press Windows Logo + R, enter "dsa.msc" and press Enter.		<ul style="margin-left: 80px;">
	#*In the "Active Directory Users and Computers" window, select the domain container in which the OU you are looking for is located.		<li>Log on to the Domain Controller with the domain administrator account. Press Windows Logo + R, enter "dsa.msc" and press Enter.</li>
	#*Select the computer object and delete it.		<li>In the "Active Directory Users and Computers" window, select the domain container in which the OU you are looking for is located.</li>
	<~~blockquote~~>'''Note:''' By default, any created Organizational Unit is protected from accidental deletion. To delete the OU, you need to clear the "Protect object from accidental deletion" checkbox, which you can find in the object properties in the "Object" tab. By deleting OU, you delete all nested objects that it contains as well.</~~blockquote~~>		<li>Select the computer object and delete it.</li>
			</ul>

			::'''Note''': By default, any created Organizational Unit is protected from accidental deletion. To delete the OU, you need to clear the "Protect object from accidental deletion" checkbox, which you can find in the object properties in the "Object" tab. By deleting OU, you delete all nested objects that it contains as well.
			:::<div><br/></div>

			== Users and user groups management ==

			'''Management mode:'''

			*'''Scan single domain (default)''' - Using this function allows the user to obtain users and groups from the main domain only.

			*'''Scan all trusted domains''' - Using this function allows the user to obtain users and groups from the main and trusted domains.

			<br/>'''ID mapping back end:'''

			*'''rid + tdb (default)''' - This option utilizes the rid backend for ID mapping to AD users. UID/GIDs range has to be entered manually The tdb backend is used when no other configuration is set. Recommended for large databases.Samba Wiki link for rid backend: [https://wiki.samba.org/index.php/Idmap_config_rid https://wiki.samba.org/index.php/Idmap_config_rid]
			*'''ad (with RFC2307 schema) + tdb''' - Allows reading ID mappings from an AD server, provided that the uidNumber attributes for users and gidNumber attributes for groups were added in advance in the AD. This backend requires additional configuration of uidNumber and gidNumber on the AD server side. The tdb back end is used when no other configuration is set. Samba Wiki link for rid backend: [https://wiki.samba.org/index.php/Idmap_config_ad https://wiki.samba.org/index.php/Idmap_config_ad]
			*'''autorid''' - This backend can be used if users are imported from a set of different domains. Automatically configures the range to be used for each domain. The only configuration needed is the range of UID/GIDs used for user/group mappings and the number of IDs per domain.Samba Wiki link for autorid backend: [https://wiki.samba.org/index.php/Idmap_config_autorid https://wiki.samba.org/index.php/Idmap_config_autorid]
			<div></div><div></div>
	[[Category:Help topics]]		[[Category:Help topics]]

Pa-P: 1 revision

2021-12-03T13:27:40Z

1 revision

← Older revision	Revision as of 13:27, 3 December 2021
(No difference)

Da-F at 10:34, 11 June 2021

2021-06-11T10:34:12Z

← Older revision		Revision as of 10:34, 11 June 2021
Line 23:		Line 23:
	*less than 12 and more than 16 characters.		*less than 12 and more than 16 characters.

			==== ====

			'''The following reasons might prevent you from connecting to Active Directory:'''

			#The '''server name''' is the same as the Computer Organizational Unit (OU) named in the Active Directory (AD) server. If the object with the same name exists and the user that you use to log in to the AD server does not have permission to access this file, the connection will fail. The solution is to delete the existing computer object from the AD server. The following information explains how to delete the OU file:
			#*Log on to the Domain Controller with the domain administrator account. Press Windows Logo + R, enter "dsa.msc" and press Enter.
			#*In the "Active Directory Users and Computers" window, select the domain container in which the OU you are looking for is located.
			#*Select the computer object and delete it.
			<blockquote>'''Note:''' By default, any created Organizational Unit is protected from accidental deletion. To delete the OU, you need to clear the "Protect object from accidental deletion" checkbox, which you can find in the object properties in the "Object" tab. By deleting OU, you delete all nested objects that it contains as well.</blockquote>
	[[Category:Help topics]]		[[Category:Help topics]]

Ma-W: 1 revision

2019-03-28T13:12:27Z

1 revision

← Older revision	Revision as of 13:12, 28 March 2019
(No difference)

Ma-W at 15:55, 25 March 2019

2019-03-25T15:55:01Z

@@ Line 1: / Line 1: @@
-<span style="font-size:small"><span style="font-family: Arial;  color: rgb(0, 0, 0);  background-color: transparent;  font-weight: 400;  font-style: normal;  font-variant: normal;  text-decoration: none;  vertical-align: baseline">This function allows you to connect to an existing Active Directory server. You can also observe the status of this connection and check when users and groups were recently synchronised.</span></span>
+This function allows you to connect to an existing Active Directory server. You can also observe the status of this connection and check if users and groups were recently synchronized.
-<span style="font-size:small"><span style="font-family: Arial;  color: rgb(0, 0, 0);  background-color: transparent;  font-weight: 400;  font-style: normal;  font-variant: normal;  text-decoration: none;  vertical-align: baseline">Status description:</span></span>
+To connect to the existing AD click the “'''Join AD server'''" button.
-<span style="font-size:small"><span style="font-family: Arial;  color: rgb(0, 0, 0);  background-color: transparent;  font-weight: 400;  font-style: normal;  font-variant: normal;  text-decoration: none;  vertical-align: baseline">Users and groups are synchronised with Active Directory server every 2 hours. Synchronisation can also be started manually by using the “Synchronise” button.</span></span>
+Status description:
 [[Category:Help topics]]

Ma-W: Ma-W moved page Active Directory server authentication to Active Directory (AD) server authentication

2019-03-25T15:53:44Z

Ma-W moved page Active Directory server authentication to Active Directory (AD) server authentication

@@ Line 1: / Line 1: @@
-This function allows you to connect to an existing Active Directory server. You can also observe the status of this connection and check if users and groups were recently synchronized.
+<span style="font-size:small"><span style="font-family: Arial;  color: rgb(0, 0, 0);  background-color: transparent;  font-weight: 400;  font-style: normal;  font-variant: normal;  text-decoration: none;  vertical-align: baseline">This function allows you to connect to an existing Active Directory server. You can also observe the status of this connection and check when users and groups were recently synchronised.</span></span>
-To connect to the existing AD click the “'''Join AD server'''" button.
+<span style="font-size:small"><span style="font-family: Arial;  color: rgb(0, 0, 0);  background-color: transparent;  font-weight: 400;  font-style: normal;  font-variant: normal;  text-decoration: none;  vertical-align: baseline">Status description:</span></span>
-Status description:
+<span style="font-size:small"><span style="font-family: Arial;  color: rgb(0, 0, 0);  background-color: transparent;  font-weight: 400;  font-style: normal;  font-variant: normal;  text-decoration: none;  vertical-align: baseline">Users and groups are synchronised with Active Directory server every 2 hours. Synchronisation can also be started manually by using the “Synchronise” button.</span></span>
 [[Category:Help topics]]

Ma-W at 14:57, 13 February 2019

2019-02-13T14:57:22Z

@@ Line 1: / Line 1: @@
-<span style="font-size:small"><span style="font-family: Arial;  color: rgb(0, 0, 0);  background-color: transparent;  font-weight: 400;  font-style: normal;  font-variant: normal;  text-decoration: none;  vertical-align: baseline">This function allows you to connect to an existing Active Directory server. You can also observe the status of this connection and check when users and groups were recently synchronised.</span></span>
+This function allows you to connect to an existing Active Directory server. You can also observe the status of this connection and check if users and groups were recently synchronized.
-<span style="font-size:small"><span style="font-family: Arial;  color: rgb(0, 0, 0);  background-color: transparent;  font-weight: 400;  font-style: normal;  font-variant: normal;  text-decoration: none;  vertical-align: baseline">Status description:</span></span>
+To connect to the existing AD click the “'''Join AD server'''" button.
-<span style="font-size:small"><span style="font-family: Arial;  color: rgb(0, 0, 0);  background-color: transparent;  font-weight: 400;  font-style: normal;  font-variant: normal;  text-decoration: none;  vertical-align: baseline">Users and groups are synchronised with Active Directory server every 2 hours. Synchronisation can also be started manually by using the “Synchronise” button.</span></span>
+Status description:
 [[Category:Help topics]]