Authenticating Ubuntu 16.04/Mint 18 Sarah client against Samba

For some scenarios, it may be usefull to set up the Linux login to work with Zentyal's Users and Groups (Samba4).
The two main reasons to configure this are:

• Being able to log in with any domain user into any host machine, without granting root privileges.
• Automatically acquiring the main Kerberos ticket (TGT), which can be then used to transparently access other services in the domain without prompting for user credentials.

Zentyal 5.0 and Ubuntu 16.04 will be used for this example.
Your Linux client should be able to access Zentyal through the LAN network, Zentyal has to be your default DNS server.

For this example, you will have an example Users domain provisioned, a domain administrator and an example user

Install the required packages on the linux client:

sudo apt-get install sssd heimdal-clients msktutil libnss-sss libpam-sss

You can leave the default Kerberos realm blank, it will be configured later.
As the superuser, edit the file /etc/krb5.conf and write the following lines, deleting the rest of the file:

[libdefaults]
        default_realm = ZENTYAL-DOMAIN.LAN
        rdns = no
        dns_lookup_kdc = true
        dns_lookup_realm = false

Pay attention to the indentation, there is a for the parameters inside the block.
Replace the default_realm parameter with your domain, all capital letters. Pay attention to the capitalization for all the commands in this document, it is significant.
Open the LDAP port in Zentyal's firewall, section Internal networks to Zentyal
As the superuser, edit the file /etc/hosts to configure the FQDN of this host:

127.0.0.1       localhost
127.0.1.1       lubuntu.zentyal-domain.lan  lubuntu

As the regular user, get the Kerberos ticket of the domain admin:

user@lubuntu:~$ kinit Administrator
Administrator@ZENTYAL-DOMAIN.LAN's Password: 
user@lubuntu:~$ klist
Credentials cache: FILE:/tmp/krb5cc_1001
        Principal: Administrator@ZENTYAL-DOMAIN.LAN

  Issued                Expires               Principal
Jul 17 22:30:04 2014  Jul 18 08:29:53 2014  krbtgt/ZENTYAL-DOMAIN.LAN@ZENTYAL-DOMAIN.LAN

You will now generate the Kerberos principals for this host, replace the host names for the client and the server, and again, pay attention to the capitalization:

user@lubuntu:~$ msktutil -N -c -b 'CN=COMPUTERS' -s HOST/lubuntu.zentyal-domain.lan -k test.keytab --computer-name LUBUNTU --upn LUBUNTU$ --server zentyal.zentyal-domain.lan --user-creds-only --verbose

user@lubuntu:~$ msktutil -N -c -b 'CN=COMPUTERS' -s HOST/lubuntu -k test.keytab --computer-name LUBUNTU --upn LUBUNTU$ --server zentyal.zentyal-domain.lan --user-creds-only --verbose

Now, you should be able to see your host name on Zentyal's LDAP tree:

destroy the Kerberos ticket

user@lubuntu:~$ kdestroy

Copy the keytab file to /etc/sssd:

user@lubuntu:~$ sudo cp test.keytab /etc/sssd/

as a superuser, create the file /etc/sssd/sssd.conf with the content:

[sssd]

services = nss, pam
config_file_version = 2
domains = zentyal-domain.lan


[nss]

entry_negative_timeout = 0
debug_level = 5


[pam]

debug_level = 5


[domain/zentyal-domain.lan]

debug_level = 10
enumerate = false
id_provider = ad
auth_provider = ad
chpass_provider = ad
access_provider = ad
dyndns_update = false
ad_hostname = zentyal.zentyal-domain.lan
ad_server = zentyal.zentyal-domain.lan


ad_domain = zentyal-domain.lan
ldap_schema = ad
ldap_id_mapping = true
fallback_homedir = /home/%u
default_shell = /bin/bash
ldap_sasl_mech = gssapi
ldap_sasl_authid = LUBUNTU$
krb5_keytab = /etc/sssd/test.keytab

ldap_krb5_init_creds = true

ad_gpo_access_control = disabled

replace domain and host names where necessary, the parameter krb5_keytab should point to the keytab you created and copied.
Set the correct permissions for the sssd.conf file:

root@lubuntu:/etc/sssd# sudo chmod 0600 sssd.conf 

And restart the SSSD service

root@lubuntu:/etc/sssd# sudo service sssd restart
stop: Unknown instance: 
sssd start/running, process 1671

Now, as a superuser, edit the file /etc/pam.d/common-session and below the line

session required        pam_unix.so

Add the line

session required pam_mkhomedir.so skel=/etc/skel umask=0077

Now, you should be able to login as any domain user:

PAM will automatically create the home directory for this user if needed, and the user will be granted the TGT Kerberos ticket directly after login in: