{"id":76863,"date":"2023-06-05T13:10:58","date_gmt":"2023-06-05T17:10:58","guid":{"rendered":"https:\/\/jumpcloud.com\/?post_type=support&#038;p=76863"},"modified":"2024-10-03T14:16:08","modified_gmt":"2024-10-03T18:16:08","slug":"configure-samba-support-to-use-cloud-ldap","status":"publish","type":"support","link":"https:\/\/jumpcloud.com\/support\/configure-samba-support-to-use-cloud-ldap","title":{"rendered":"Configure Samba Support to Use Cloud LDAP"},"content":{"rendered":"\n<p>Enabling Samba support allows LDAP users to authenticate to endpoints that require Samba attributes within the LDAP directory. This article explains the JumpCloud configuration. Configuration of the endpoint authenticating to JumpCloud varies and may require vendor documentation to complete.&nbsp;<\/p>\n\n\n\n<div class=\"wp-block-cgb-notification-card-wysiwyg notification-card note\"><div class=\"notification-card-content\"><div class=\"notification-card-icon\"><p><img decoding=\"async\" src=\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/note-icon.png\" \/><\/p><\/div><div class=\"notification-card-copy is-type-body-default\"><div><strong class=\"notification-card-type\">Note:<\/strong> \n<p>To apply a Samba configuration, read and understand the following articles:<\/p>\n\n\n\n<ul>\n<li><a href=\"https:\/\/jumpcloud.com\/support\/use-cloud-ldap\" target=\"_blank\" rel=\"noreferrer noopener\">Use Cloud LDAP<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/jumpcloud.com\/support\/create-an-ldap-group\" target=\"_blank\" rel=\"noreferrer noopener\">Create an LDAP Group<\/a><\/li>\n<\/ul>\n <\/div><\/div><\/div><\/div>\n\n\n\n<p><strong>Compatibility<\/strong>:<\/p>\n\n\n\n<ul>\n<li>Samba Server version 3 &amp; 4<\/li>\n\n\n\n<li>Samba 4 LDAP schema<\/li>\n<\/ul>\n\n\n\n<p><strong>Security Risks:<\/strong><\/p>\n\n\n\n<ul>\n<li>Samba Servers are inherently less secure than other technologies JumpCloud integrates with because&nbsp;it uses&nbsp;<em>plain text equivalent<\/em>&nbsp;password hashing for authentication. See more about Samba password hashing at&nbsp;<a target=\"_blank\" href=\"https:\/\/www.samba.org\/samba\/docs\/man\/manpages-3\/smbpasswd.5.html\" rel=\"noreferrer noopener\">samba.org<\/a>.<\/li>\n\n\n\n<li>In order for JumpCloud LDAP to authenticate users to a Samba server, we must store the NT password hash in the LDAP directory, this is contained in the&nbsp;<code>sambaNTPassword<\/code>&nbsp;attribute.<\/li>\n<\/ul>\n\n\n\n<p><strong>Risk Mitigation:<\/strong><\/p>\n\n\n\n<ul>\n<li>ACLs are in place to restrict access to the sambaNTPassword attribute. Only the Samba Service account is able to access this field when binding\/searching the LDAP tree.<strong>&nbsp;Use a strong password for&nbsp;the Samba Service account.<\/strong><\/li>\n\n\n\n<li>Samba attributes are enabled at the group level. Users that don&#8217;t belong to a Samba enabled group will not get Samba attributes.&nbsp;<strong>Don&#8217;t enable Samba group membership for users that don&#8217;t need to access a Samba resource.<\/strong><\/li>\n\n\n\n<li><strong>StartTLS or SSL is required&nbsp;<\/strong>to return all Samba attributes. If you attempt to bind to LDAP in cleartext, JumpCloud will&nbsp;<strong>NOT&nbsp;<\/strong>return the sambaNTPassword in the results.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-creating-a-samba-service-account\">Creating a Samba Service Account<\/h2>\n\n\n\n<ol>\n<li>Log in to the <a href=\"https:\/\/console.jumpcloud.com\/login\/admin\" target=\"_blank\" rel=\"noreferrer noopener\">JumpCloud Admin Portal<\/a>.<\/li>\n\n\n\n<li>Go to\u00a0<strong>USER MANAGEMENT<\/strong>\u00a0&gt;\u00a0<strong>Users<\/strong>.<\/li>\n\n\n\n<li>Click\u00a0<strong>( + )<\/strong>\u00a0and create a user manually.<\/li>\n\n\n\n<li>Under User Information, set the required attributes username and email address.<\/li>\n\n\n\n<li>Expand&nbsp;<strong>User Security Settings and Permissions<\/strong>&nbsp;and check&nbsp;<strong>Enable as LDAP Bind DN<\/strong>.<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-configuring-samba-authentication\">Configuring Samba Authentication<\/h2>\n\n\n\n<p>You can configure Samba authentication where you configure JumpCloud LDAP.<\/p>\n\n\n\n<ul>\n<li><strong>WORKGROUP<\/strong>: The default value of WORKGROUP should be changed to match the value defined for the workgroup in the Samba server configuration. Samba servers as a primary or member domain controller are not supported.<\/li>\n\n\n\n<li><strong>SID<\/strong>: The default value is automatically generated. In certain cases, this may need to match the SID of your Samba Server. Get Samba SID as root on the Samba server: <code>$ net getlocalsid<\/code><\/li>\n\n\n\n<li><strong>Samba Service Account<\/strong>: This account will be granted access to the sambaNTPassword attribute and should be used in the Samba server LDAP configuration for binding\/searching the JumpCloud LDAP directory. Only one user may be defined as the Samba Service Account per Organization. <\/li>\n<\/ul>\n\n\n\n<div class=\"wp-block-cgb-notification-card-wysiwyg notification-card note\"><div class=\"notification-card-content\"><div class=\"notification-card-icon\"><p><img decoding=\"async\" src=\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/note-icon.png\" \/><\/p><\/div><div class=\"notification-card-copy is-type-body-default\"><div><strong class=\"notification-card-type\">Note:<\/strong> \n<p>It&#8217;s recommended to create an account specifically for the Samba Service configuration. Non-Samba LDAP resources should be configured with a separate, standard LDAP Bind DN user.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n<ul>\n<li><strong>Samba Service Account DN<\/strong>: The DN for the Samba Service account is the same as the regular Bind DN as discussed in <a href=\"https:\/\/jumpcloud.com\/support\/use-cloud-ldap\" target=\"_blank\" rel=\"noreferrer noopener\">Use Cloud LDAP<\/a> and is the typical syntax used in the Samba server LDAP configuration for binding\/searching the JumpCloud LDAP directory.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-enabling-samba-authentication\">Enabling Samba Authentication<\/h2>\n\n\n\n<p>Once Samba Authentication is configured for LDAP, it must be explicitly enabled on a per-group basis. In certain applications, a Linux (posixGroup) group must be created for group presentation to function properly with the Samba server. Refer to your vendor&#8217;s documentation to confirm if this is needed.<\/p>\n\n\n\n<p>For Samba to be enabled for the group, you must confirm a security warning regarding the new Samba Attributes. The group will also be bound to LDAP if it has not already been. Once acknowledged, save the User group. All users can be filtered on the&nbsp;<strong>sambaSamAccount<\/strong> objectClass. See below for a schema example.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-ongoing-ldap-management\">Ongoing LDAP Management<\/h2>\n\n\n\n<p>For ongoing management and at-a-glance results to find who has access to LDAP and Samba, you can see and manage Samba access from the <strong>User Group<\/strong> tab of the LDAP directory.<\/p>\n\n\n\n<p>On the <strong>Users<\/strong> tab, access to LDAP and LDAP Bind DN status can be toggled on a per-user basis.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-schema-example\">Schema Example<\/h2>\n\n\n\n<div class=\"wp-block-cgb-code-block code-block\"><div class=\"code-block-snippet is-type-body-default\">\n<p># jvoigt, Users, 58ed0b640a775e3a595a33db, jumpcloud.com <br>dn: uid=jvoigt,ou=Users,o=58ed0b640a775e3a595a33db,dc=jumpcloud,dc=com <br>givenName: Jens <br>objectClass: top <br>objectClass: person <br>objectClass: organizationalPerson <br>objectClass: inetOrgPerson <br>objectClass: shadowAccount <br>objectClass: posixAccount <br>objectClass: jumpcloudUser <br>objectClass: sambaSamAccount <br>loginShell: \/bin\/bash <br>homeDirectory: \/home\/jvoigt <br>mail: jvoigt@yourdomain.local <br>sambaPrimaryGroupSID: S-1-2-21-1491929956-0175594634-1499083739-11265 <br>uid: jvoigt <br>uidNumber: 5132 <br>sambaAcctFlags: [U] <br>sambaDomainName: WORKGROUP <br>sambaSID: S-1-2-21-1491929956-0175594634-1499083739-11264 <br>gidNumber: 5132 <br>sambaPwdLastSet: -1 <br>sn: Voigt <br>sambaNTPassword: A2B8AD99D0F0B2EA1775EFA1403C08C8 <br>cn: Jens Voigt <br>memberOf: cn=LDAP Fileserver,ou=Users,o=58ed0b640a775e3a595a33db,dc=jumpcloud, dc=com<\/p>\n<\/div><\/div>\n","protected":false},"excerpt":{"rendered":"<p>Enabling Samba support allows LDAP users to authenticate to endpoints that require Samba attributes within the LDAP directory. This article [&hellip;]<\/p>\n","protected":false},"author":204,"featured_media":0,"template":"","meta":{"_acf_changed":false,"_oasis_is_in_workflow":0,"_oasis_original":0,"_oasis_task_priority":"","inline_featured_image":false,"footnotes":""},"support_category":[2845,2896],"support_tag":[],"coauthors":[2838],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v22.9 (Yoast SEO v22.9) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Configure Samba Support to Use Cloud LDAP - JumpCloud<\/title>\n<meta name=\"description\" content=\"Learn how to configure Samba Support to use LDAP.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/jumpcloud.com\/support\/configure-samba-support-to-use-cloud-ldap\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Configure Samba Support to Use Cloud LDAP\" \/>\n<meta property=\"og:description\" content=\"Learn how to configure Samba Support to use LDAP.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/jumpcloud.com\/support\/configure-samba-support-to-use-cloud-ldap\" \/>\n<meta property=\"og:site_name\" content=\"JumpCloud\" \/>\n<meta property=\"article:modified_time\" content=\"2024-10-03T18:16:08+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/07\/202405-MISC-JumpCloudHelpCenter-SiteDisplay-min-2.png\" \/>\n\t<meta property=\"og:image:width\" content=\"890\" \/>\n\t<meta property=\"og:image:height\" content=\"525\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"4 minutes\" \/>\n\t<meta name=\"twitter:label2\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data2\" content=\"jenniferklein\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/jumpcloud.com\/support\/configure-samba-support-to-use-cloud-ldap\",\"url\":\"https:\/\/jumpcloud.com\/support\/configure-samba-support-to-use-cloud-ldap\",\"name\":\"Configure Samba Support to Use Cloud LDAP - JumpCloud\",\"isPartOf\":{\"@id\":\"https:\/\/jumpcloud.com\/#website\"},\"datePublished\":\"2023-06-05T17:10:58+00:00\",\"dateModified\":\"2024-10-03T18:16:08+00:00\",\"description\":\"Learn how to configure Samba Support to use LDAP.\",\"breadcrumb\":{\"@id\":\"https:\/\/jumpcloud.com\/support\/configure-samba-support-to-use-cloud-ldap#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/jumpcloud.com\/support\/configure-samba-support-to-use-cloud-ldap\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/jumpcloud.com\/support\/configure-samba-support-to-use-cloud-ldap#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/jumpcloud.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Support\",\"item\":\"https:\/\/jumpcloud.com\/support\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Configure Samba Support to Use Cloud LDAP\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/jumpcloud.com\/#website\",\"url\":\"https:\/\/jumpcloud.com\/\",\"name\":\"JumpCloud\",\"description\":\"Daily insights on directory services, IAM, LDAP, identity security, SSO, system management (Mac, Windows, Linux), networking, and the cloud.\",\"publisher\":{\"@id\":\"https:\/\/jumpcloud.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/jumpcloud.com\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/jumpcloud.com\/#organization\",\"name\":\"JumpCloud\",\"url\":\"https:\/\/jumpcloud.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/jumpcloud.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2021\/01\/jc-logo-brand-2021.png\",\"contentUrl\":\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2021\/01\/jc-logo-brand-2021.png\",\"width\":598,\"height\":101,\"caption\":\"JumpCloud\"},\"image\":{\"@id\":\"https:\/\/jumpcloud.com\/#\/schema\/logo\/image\/\"}}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Configure Samba Support to Use Cloud LDAP - JumpCloud","description":"Learn how to configure Samba Support to use LDAP.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/jumpcloud.com\/support\/configure-samba-support-to-use-cloud-ldap","og_locale":"en_US","og_type":"article","og_title":"Configure Samba Support to Use Cloud LDAP","og_description":"Learn how to configure Samba Support to use LDAP.","og_url":"https:\/\/jumpcloud.com\/support\/configure-samba-support-to-use-cloud-ldap","og_site_name":"JumpCloud","article_modified_time":"2024-10-03T18:16:08+00:00","og_image":[{"width":890,"height":525,"url":"https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/07\/202405-MISC-JumpCloudHelpCenter-SiteDisplay-min-2.png","type":"image\/png"}],"twitter_card":"summary_large_image","twitter_misc":{"Est. reading time":"4 minutes","Written by":"jenniferklein"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/jumpcloud.com\/support\/configure-samba-support-to-use-cloud-ldap","url":"https:\/\/jumpcloud.com\/support\/configure-samba-support-to-use-cloud-ldap","name":"Configure Samba Support to Use Cloud LDAP - JumpCloud","isPartOf":{"@id":"https:\/\/jumpcloud.com\/#website"},"datePublished":"2023-06-05T17:10:58+00:00","dateModified":"2024-10-03T18:16:08+00:00","description":"Learn how to configure Samba Support to use LDAP.","breadcrumb":{"@id":"https:\/\/jumpcloud.com\/support\/configure-samba-support-to-use-cloud-ldap#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/jumpcloud.com\/support\/configure-samba-support-to-use-cloud-ldap"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/jumpcloud.com\/support\/configure-samba-support-to-use-cloud-ldap#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/jumpcloud.com\/"},{"@type":"ListItem","position":2,"name":"Support","item":"https:\/\/jumpcloud.com\/support"},{"@type":"ListItem","position":3,"name":"Configure Samba Support to Use Cloud LDAP"}]},{"@type":"WebSite","@id":"https:\/\/jumpcloud.com\/#website","url":"https:\/\/jumpcloud.com\/","name":"JumpCloud","description":"Daily insights on directory services, IAM, LDAP, identity security, SSO, system management (Mac, Windows, Linux), networking, and the cloud.","publisher":{"@id":"https:\/\/jumpcloud.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/jumpcloud.com\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/jumpcloud.com\/#organization","name":"JumpCloud","url":"https:\/\/jumpcloud.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/jumpcloud.com\/#\/schema\/logo\/image\/","url":"https:\/\/jumpcloud.com\/wp-content\/uploads\/2021\/01\/jc-logo-brand-2021.png","contentUrl":"https:\/\/jumpcloud.com\/wp-content\/uploads\/2021\/01\/jc-logo-brand-2021.png","width":598,"height":101,"caption":"JumpCloud"},"image":{"@id":"https:\/\/jumpcloud.com\/#\/schema\/logo\/image\/"}}]}},"_links":{"self":[{"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/support\/76863"}],"collection":[{"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/support"}],"about":[{"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/types\/support"}],"author":[{"embeddable":true,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/users\/204"}],"version-history":[{"count":2,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/support\/76863\/revisions"}],"predecessor-version":[{"id":116033,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/support\/76863\/revisions\/116033"}],"wp:attachment":[{"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/media?parent=76863"}],"wp:term":[{"taxonomy":"support_category","embeddable":true,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/support_category?post=76863"},{"taxonomy":"support_tag","embeddable":true,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/support_tag?post=76863"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/jumpcloud.com\/wp-json\/wp\/v2\/coauthors?post=76863"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}