Page 1 of 1

Samba4 and OpenLDAP Password Synchronization

Published: February 8, 2017 - 2:07 PM
by ee68
Hello,

A huge thank you for your invaluable Samba4 documentation! :D

I'm trying to synchronize Samba4 passwords to OpenLDAP, using your documentation.

For this purpose, I added a DC3 (Debian) compiled to 4.5.1 with gpgme:
# smbd -b | grep "GPGME"
HAVE_GPGME_H
HAVE_GPGME
HAVE_GPGME_NEW
HAVE_LIBGPGME
ENABLE_GPGME


DC1 and DC2 are also running 4.5.1 but without gpgme support, even though they were upgraded from your deb packages.
I already feel like I have the answer to my question... gpgme support is needed on all DCs!

Everything seems to be working upstream on DC3:
- the syncpwd.py script
- the connection to the OpenLDAP server
- password caching with samba-tool
- the samba-syncpasswords.service.

However, the user hash cannot be retrieved with the command:
`samba-tool user getpassword xxx --attributes=virtualSSHA,samaccountname --decrypt-samba-gpg
dn: CN=xxx,CN=xxx,DC=xxx,DC=xxx
sAMAccountName: xxx

Got password OK`.


The prerequisite packages are correctly installed:
rng-tools python-ldap python-crypto python-m2crypto python-gpgme python-gpgme-dbg libgpgme11-dev.

Any ideas on how to retrieve the user hashes?
Should I reinstall Samba 4.5.1 compiled with gpgme support on DC1 and DC2?
It's possible using virtual machines, but it's a bit of a challenge.

Thanks in advance for your expert advice,

Eric.

Re: Samba4 and OpenLDAP Password Synchronization

Published: March 1, 2017 - 3:32 PM
by ssamson
Hello,

Yes, you need to have gpme support on all domain controllers.
They also need a gpg key and the corresponding ID in the smb.conf file.

The script only works with users who changed their password after its implementation.

You can try using Samba version 4.5.4 instead of reinstalling the DCs.
https://samba.tranquil.it/jessie64/samba-4.5.4/

Re: Samba4 and OpenLDAP Password Synchronization

Published: March 1, 2017 - 5:54 PM
by ee68
Hello,

thank you for your reply.

I will test it by updating to version 4.5.4 with your packages as soon as possible...
Hopefully, gpgme support will be enabled after the update.

I will let you know if it works after the update.

Have a good evening.

Re: Samba4 and OpenLDAP Password Synchronization

Published: May 9, 2017 - 2:39 PM
by ee68
Hello,

I upgraded to Samba 4.5.4 on all DCs, so I now have GPGME support.
It's almost working...
Now I'm successfully retrieving the password hash after changing the password:
virtualSSHA: {SSHA}am+7UkRfBjpH/9mu7THj14z5Qci6tdZp
Got password OK.


However, replication to the OpenLDAP directory isn't working. In the samba-syncpasswords logs, I get the error "Exception global name 'time' is not defined"
samba-syncpasswords[27698]: Tue May 9 10:25:52 2017: pid[27698]: DONE-EXIT: Exception global name 'time' is not defined
samba-syncpasswords[27698]: DONE-EXIT: change password to adldaps


The connection to The LDAP directory is working correctly, and the bind is successful in LDAP admin mode. However, if I change the password of an AD user that doesn't exist in LDAP, I get the following message: DONE-EXIT: User 'aduser3' not exist.

Any ideas to help me debug this?

Other questions:
Does each DC need its own key and ID in smb.conf, or should it be the same for all DCs?
Because if I request the hash on a DC that hasn't changed its password:
`samba-tool user getpassword adldaps --attributes=virtualSSHA,samaccountname --decrypt-samba-gpg`,
I get: `WARNING: 'adldaps': SambaGPG can't be decrypted into CLEARTEXT: ERR_BAD_SECKEY: Decryption failed`.

And logically, the `samba-syncpasswords` service should be running on each DC?

Thanks in advance

, Eric

Re: Samba4 and OpenLDAP Password Synchronization

Published: June 1, 2017 - 4:31 PM
by ssamson
However, replication to the OpenLDAP directory is not working. In the samba-syncpasswords logs, I have the error "Exception global name 'time' is not defined"
samba-syncpasswords[27698]: Tue May 9 10:25:52 2017: pid[27698]: DONE-EXIT: Exception global name 'time' is not defined
samba-syncpasswords[27698]: DONE-EXIT: change password to adldaps
The "import time" is missing at the beginning of the script
The connection to the LDAP directory works fine, and the bind is successful as an LDAP admin. However, if I change the password of an AD user that doesn't exist in LDAP, I get the message: DONE-EXIT: User 'aduser3' not exist.

Any ideas on how to debug this?
There is no user replication, only the password part.
You need to find another method to replicate users.
Other questions:
Does each DC need its own key and ID in smb.conf, or should it be the same for all DCs?
Because if I request the hash on a DC that hasn't changed its password:
`samba-tool user getpassword adldaps --attributes=virtualSSHA,samaccountname --decrypt-samba-gpg`
WARNING: 'adldaps': SambaGPG can't be decrypted into CLEARTEXT: ERR_BAD_SECKEY: Decryption failed.

And logically, should the `samba-syncpasswords` service be running on each DC?
Yes, you need the same gpg key + id on all DCs.
Yes, the samba-syncpasswords service must be running on each DC

Re: Samba4 and OpenLDAP Password Synchronization

Published: February 1, 2018 - 12:33 PM
by julinux
Hello,

I just tested the script on a Samba4 4.5.12 (Debian Stretch) system, and I'm getting the following error in the syslog, which I don't know how to interpret.
The users are found correctly, but the synchronization fails:

Feb 1 12:18:10 dc1 samba-syncpasswords[18022]: dn:
Feb 1 12:18:10 dc1 samba-syncpasswords[18022]: userAccountControl: 66048
Feb 1 12:18:10 dc1 samba-syncpasswords[18022]: pwdLastSet: 131619569553456160
Feb 1 12:18:10 dc1 samba-syncpasswords[18022]: userPrincipalName: john.doe@domaine.lan
Feb 1 12:18:10 dc1 samba-syncpasswords[18022]: sAMAccountName: john.doe
Feb 1 12:18:10 dc1 samba-syncpasswords[18022]: objectGUID: 4e3d953f-7d85-4718-9286-4397c5c8cf64
Feb 1 12:18:10 dc1 samba-syncpasswords[18022]: instanceType: 4
Feb 1 12:18:10 dc1 samba-syncpasswords[18022]: # supplementalCredentials::: REDACTED SECRET ATTRIBUTE
Feb 1 12:18:10 dc1 samba-syncpasswords[18022]: # unicodePwd::: REDACTED SECRET ATTRIBUTE
Feb 1 12:18:10 dc1 samba-syncpasswords[18022]: Feb 1 12:18:10 2018: pid[18022]: #Passwords[28] 4e3d953f-7d85-4718-9286-4397c5c8cf64 S-1-5-21-220842246-1859053709-2034179705-1143
Feb 1 12:18:10 dc1 samba-syncpasswords[18022]: # attrs=['dn', 'objectGUID', 'sAMAccountName']
Feb 1 12:18:10 dc1 samba-syncpasswords[18022]: Thu Feb 1 12:18:10 2018: pid[18022]: Call Popen[/opt/syncpwd.py] for CN=John Doe,CN=Users,DC=domain,DC=lan
Feb 1 12:18:10 dc1 samba-syncpasswords[18022]: Thu Feb 1 12:18:10 2018: pid[18022]: DONE-EXIT: NOK
Feb 1 12:18:10 dc1 samba-syncpasswords[18022]: Thu Feb 1 12:18:10 2018: pid[18022]: # Dirsync[29] 5ede31ac-7390-4dd4-91de-bf6293d3dcc0 S-1-5-21-220842246-1859053709-2034179705-1137


However, I have correctly installed the required dependencies and my version of Samba should, in principle, support GPME:

]dc1:samba#smbd -b | grep "GPGME"
HAVE_GPGME_H
HAVE_GPGME
HAVE_GPGME_NEW
HAVE_LIBGPGME
ENABLE_GPGME

However, when I try to retrieve the password hash, I don't see it.
For example:

dc1:samba#samba-tool user getpassword john.doe --attributes=virtualSSHA --decrypt-samba-gpg
dn: CN=John Doe,CN=Users,DC=domain,DC=lan

Got password OK


Do you have any idea what's wrong?

Thank you.

Re: Samba4 and OpenLDAP Password Synchronization

Published: February 6, 2018 - 4:58 PM
by julinux
Hello,

I'm replying to myself. I've solved the problem, which apparently stemmed from the fact that the password had never been changed on the Samba4 side. Once the passwords were changed for a few test users, it worked.
I was then able to test password synchronization from Samba4 to a remote LDAP directory (different domain).
The synchronization works well; however, I've noticed something I don't understand.

If I try to change a user's password using the command line:

`samba-tool user setpassword toto` `
New Password:
Retype Password:
Changed password OK`

`#samba-tool user getpassword toto --attributes=virtualSSHA --decrypt-samba-gpg
dn: CN=toto,CN=Users,DC=domaine,DC=lan
virtualSSHA: {SSHA}Lnfkk3WSTzwJux3o7wCMCXjnlC/4zuCs

Got password OK`


And I monitor the logs in `/var/log/syslog`, the password change isn't applied immediately. It only happens if I change the password of another user. Is there a way to make it take effect instantly?

Attaching this script to the command "samba-tool user syncpasswords" and running it via systemd seems to act as a trigger that propagates changes, but in my case, it only works roughly every two changes.

Any ideas?
Thanks in advance. :)

Re: Samba4 and OpenLDAP Password Synchronization

Published: Dec 11, 2018 - 12:06 PM
by julinux
Good morning,

I'm answering myself, but from a different angle.
My previous tests were performed on Red Hat 7 with your packages in version 4.6.4.
Having encountered quite a few problems with replication topologies, I went back to a more classic platform, with ubuntu18 and samba 4.7.6 (goodbye replication problems).
But, when I put the samba4 password synchronization script back into place with the syncpwd.py script, I am now encountering another problem.

Here is the trace of it:

Code: Select all

Dec 11 11:51:36 DC01 samba-syncpasswords[13698]: Tue Dec 11 11:50:24 2018: pid[13698]: DONE-EXIT: Exception {'desc': u'Other (e.g., implementation specific) error'}

I don't appear to have any dependency issues with Python packages and am able to decrypt a password via the CLI (the password cache has been initialized correctly):

Code: Select all

 samba-tool user getpassword toto --attributes=virtualSSHA --decrypt-samba-gpg
dn: CN=Toto toto,CN=Users,DC=domaine,DC=fr
virtualSSHA: {SSHA}MdPe1hbGUSNJdKEhdgYSJCQCRaS3EuNxumB

Do you have any ideas on how to troubleshoot this?

Re: Samba4 and OpenLDAP Password Synchronization

Published: Dec 12, 2018 - 09:04
by julinux
Good morning,

Has anyone tested this script under Ubuntu 18?
I should point out that the setup is exactly the same as the one that was set up in redhat7 and which worked very well.
I even modified the script so that it synchronizes the users' Samba4 passwords to both the userpassword and sambantpassword fields of a remote LDAP server. (If anyone's interested...)

In this case, I tried to backport the python-ldap package from stretch (2.4.28-0.1) onto ubuntu (version 3.0.0-1), without further results.
I also set the samba-syncpassword service to debuglevel=10 to find out more.

Here is the complete track:

Code: Select all

Dec 12 08:45:22 p-smb-01 samba-syncpasswords[4731]: lpcfg_servicenumber: couldn't find ldb
Dec 12 08:45:22 p-smb-01 samba-syncpasswords[4731]: ERROR(exception): uncaught exception - ERROR: 1 - cn=Thomas Dupont,ou=Clients,dc=remotedomain,dc=lan
Dec 12 08:45:22 p-smb-01 samba-syncpasswords[4731]: Traceback (most recent call last):
Dec 12 08:45:22 p-smb-01 samba-syncpasswords[4731]:   File "/opt/syncpwd.py", line 64, in <module>
Dec 12 08:45:22 p-smb-01 samba-syncpasswords[4731]:     set_user_password(ldap_destination, user['sAMAccountName'], user['password'])
Dec 12 08:45:22 p-smb-01 samba-syncpasswords[4731]:   File "/opt/syncpwd.py", line 50, in set_user_password
Dec 12 08:45:22 p-smb-01 samba-syncpasswords[4731]:     ldap_destination.modify_s(dn, ldif)
Dec 12 08:45:22 p-smb-01 samba-syncpasswords[4731]:   File "/usr/lib/python2.7/dist-packages/ldap/ldapobject.py", line 629, in modify_s
Dec 12 08:45:22 p-smb-01 samba-syncpasswords[4731]:     return self.modify_ext_s(dn,modlist,None,None)
Dec 12 08:45:22 p-smb-01 samba-syncpasswords[4731]:   File "/usr/lib/python2.7/dist-packages/ldap/ldapobject.py", line 602, in modify_ext_s
Dec 12 08:45:22 p-smb-01 samba-syncpasswords[4731]:     resp_type, resp_data, resp_msgid, resp_ctrls = self.result3(msgid,all=1,timeout=self.timeout)
Dec 12 08:45:22 p-smb-01 samba-syncpasswords[4731]:   File "/usr/lib/python2.7/dist-packages/ldap/ldapobject.py", line 749, in result3
Dec 12 08:45:22 p-smb-01 samba-syncpasswords[4731]:     resp_ctrl_classes=resp_ctrl_classes
Dec 12 08:45:22 p-smb-01 samba-syncpasswords[4731]:   File "/usr/lib/python2.7/dist-packages/ldap/ldapobject.py", line 756, in result4
Dec 12 08:45:22 p-smb-01 samba-syncpasswords[4731]:     ldap_result = self._ldap_call(self._l.result4,msgid,all,timeout,add_ctrls,add_intermediates,add_extop)
Dec 12 08:45:22 p-smb-01 samba-syncpasswords[4731]:   File "/usr/lib/python2.7/dist-packages/ldap/ldapobject.py", line 329, in _ldap_call
Dec 12 08:45:22 p-smb-01 samba-syncpasswords[4731]:     reraise(exc_type, exc_value, exc_traceback)
Dec 12 08:45:22 p-smb-01 samba-syncpasswords[4731]:   File "/usr/lib/python2.7/dist-packages/ldap/ldapobject.py", line 313, in _ldap_call
Dec 12 08:45:22 p-smb-01 samba-syncpasswords[4731]:     result = func(*args,**kwargs)
Dec 12 08:45:22 p-smb-01 samba-syncpasswords[4731]: ldap.OTHER: {'desc': u'Other (e.g., implementation specific) error'}
Dec 12 08:45:22 p-smb-01 samba-syncpasswords[4731]:   File "/usr/lib/python2.7/dist-packages/samba/netcmd/__init__.py", line 176, in _run
Dec 12 08:45:22 p-smb-01 samba-syncpasswords[4731]:     return self.run(*args, **kwargs)
Dec 12 08:45:22 p-smb-01 samba-syncpasswords[4731]:   File "/usr/lib/python2.7/dist-packages/samba/netcmd/user.py", line 2281, in run
Dec 12 08:45:22 p-smb-01 samba-syncpasswords[4731]:     sync_loop(wait)
Dec 12 08:45:22 p-smb-01 samba-syncpasswords[4731]:   File "/usr/lib/python2.7/dist-packages/samba/netcmd/user.py", line 2170, in sync_loop
Dec 12 08:45:22 p-smb-01 samba-syncpasswords[4731]:     dirsync_loop()
Dec 12 08:45:22 p-smb-01 samba-syncpasswords[4731]:   File "/usr/lib/python2.7/dist-packages/samba/netcmd/user.py", line 2147, in dirsync_loop
Dec 12 08:45:22 p-smb-01 samba-syncpasswords[4731]:     handle_object(ri, r)
Dec 12 08:45:22 p-smb-01 samba-syncpasswords[4731]:   File "/usr/lib/python2.7/dist-packages/samba/netcmd/user.py", line 1964, in handle_object
Dec 12 08:45:22 p-smb-01 samba-syncpasswords[4731]:     run_sync_command(obj.dn, ldif)
Dec 12 08:45:22 p-smb-01 samba-syncpasswords[4731]:   File "/usr/lib/python2.7/dist-packages/samba/netcmd/user.py", line 1933, in run_sync_command
Dec 12 08:45:22 p-smb-01 samba-syncpasswords[4731]:     raise Exception("ERROR: %s - %s\n" % (res, reply))
Dec 12 08:45:22 p-smb-01 samba-syncpasswords[4731]: Wed Dec 12 08:45:21 2018: pid[4731]: Using cache_ldb[/var/lib/samba/private/user-syncpasswords-cache.ldb]
Dec 12 08:45:22 p-smb-01 samba-syncpasswords[4731]: Wed Dec 12 08:45:21 2018: pid[4731]: currentPid: 4731
Dec 12 08:45:22 p-smb-01 samba-syncpasswords[4731]: Wed Dec 12 08:45:21 2018: pid[4731]: Wait before connect - sleep(1)
Dec 12 08:45:22 p-smb-01 samba-syncpasswords[4731]: Wed Dec 12 08:45:22 2018: pid[4731]: Connecting to 'ldapi:///var/lib/samba/private/ldap_priv/ldapi'
Dec 12 08:45:22 p-smb-01 samba-syncpasswords[4731]: Wed Dec 12 08:45:22 2018: pid[4731]: Resuming monitoring
Dec 12 08:45:22 p-smb-01 samba-syncpasswords[4731]: dirsyncFilter: (&(objectClass=user)(userAccountControl:1.2.840.113556.1.4.803:=512)(!(sAMAccountName=krbtgt*)))
Dec 12 08:45:22 p-smb-01 samba-syncpasswords[4731]: dirsyncControls: ['dirsync:1:0:0:TVNEUwMAAACAmlevZ5HUAQAAAAAAAAAAoAAAAEnQAAAAAAAAAAAAAAAAAABJ0AAAAAAAAIzV6KNOBVBGkH8wcdL4YbEBAAAAAAAAAAYAAAAAAAAAjNXoo04FUEaQfzBx0vhhsUnQAAAAAAAAAiZpGzM1hUKp/pa8km+OEANyCAAAAAAAOYtMZ5FpwE+BYxhasmoMpkNuBwAAAAAA1WFydNCQ10eFOIIMdBpXTLHZCAAAAAAAkjvogTKirk2lnUjQTB/7g7yWAAAAAAAAROqcq1Vng0K7L30S0XzA5hc6BwAAAAAA', 'extended_dn:1:0']
Dec 12 08:45:22 p-smb-01 samba-syncpasswords[4731]: syncCommand: /opt/syncpwd.py
Dec 12 08:45:22 p-smb-01 samba-syncpasswords[4731]: Wed Dec 12 08:45:22 2018: pid[4731]: dirsync_loop(): results 1
Dec 12 08:45:22 p-smb-01 samba-syncpasswords[4731]: Wed Dec 12 08:45:22 2018: pid[4731]: # Dirsync[0] d95c335d-1c98-46be-a198-ad7d5de43e2c S-1-5-21-659298242-1763559122-495668692-1592
Dec 12 08:45:22 p-smb-01 samba-syncpasswords[4731]: dn: <GUID=d95c335d-1c98-46be-a198-ad7d5de43e2c>;<SID=S-1-5-21-659298242-1763559122-495668692-1592>;CN=Thomas Dupont,CN=Users,DC=localdomain,DC=lan
Dec 12 08:45:22 p-smb-01 samba-syncpasswords[4731]: pwdLastSet: 131890743129894340
Dec 12 08:45:22 p-smb-01 samba-syncpasswords[4731]: objectGUID: d95c335d-1c98-46be-a198-ad7d5de43e2c
Dec 12 08:45:22 p-smb-01 samba-syncpasswords[4731]: instanceType: 4
Dec 12 08:45:22 p-smb-01 samba-syncpasswords[4731]: # supplementalCredentials::: REDACTED SECRET ATTRIBUTE
Dec 12 08:45:22 p-smb-01 samba-syncpasswords[4731]: # unicodePwd::: REDACTED SECRET ATTRIBUTE
Dec 12 08:45:22 p-smb-01 samba-syncpasswords[4731]: # dBCSPwd::: REDACTED SECRET ATTRIBUTE
Dec 12 08:45:22 p-smb-01 samba-syncpasswords[4731]: Wed Dec 12 08:45:22 2018: pid[4731]: # Passwords[0] d95c335d-1c98-46be-a198-ad7d5de43e2c S-1-5-21-659298242-1763559122-495668692-1592
Dec 12 08:45:22 p-smb-01 samba-syncpasswords[4731]: # attrs=['dn', 'objectGUID', 'sAMAccountName', 'virtualClearTextUTF8', 'virtualSSHA']
Dec 12 08:45:22 p-smb-01 samba-syncpasswords[4731]: Wed Dec 12 08:45:22 2018: pid[4731]: Call Popen[/opt/syncpwd.py] for CN=Thomas Dupont,CN=Users,DC=localdomain,DC=lan
Dec 12 08:45:22 p-smb-01 samba-syncpasswords[4731]: Wed Dec 12 08:45:22 2018: pid[4731]: cn=Thomas Dupont,ou=Clients,dc=remotedomain,dc=lan
Dec 12 08:45:22 p-smb-01 samba-syncpasswords[4731]: Traceback (most recent call last):
Dec 12 08:45:22 p-smb-01 samba-syncpasswords[4731]:   File "/opt/syncpwd.py", line 64, in <module>
Dec 12 08:45:22 p-smb-01 samba-syncpasswords[4731]:     set_user_password(ldap_destination, user['sAMAccountName'], user['password'])
Dec 12 08:45:22 p-smb-01 samba-syncpasswords[4731]:   File "/opt/syncpwd.py", line 50, in set_user_password
Dec 12 08:45:22 p-smb-01 samba-syncpasswords[4731]:     ldap_destination.modify_s(dn, ldif)
Dec 12 08:45:22 p-smb-01 samba-syncpasswords[4731]:   File "/usr/lib/python2.7/dist-packages/ldap/ldapobject.py", line 629, in modify_s
Dec 12 08:45:22 p-smb-01 samba-syncpasswords[4731]:     return self.modify_ext_s(dn,modlist,None,None)
Dec 12 08:45:22 p-smb-01 samba-syncpasswords[4731]:   File "/usr/lib/python2.7/dist-packages/ldap/ldapobject.py", line 602, in modify_ext_s
Dec 12 08:45:22 p-smb-01 samba-syncpasswords[4731]:     resp_type, resp_data, resp_msgid, resp_ctrls = self.result3(msgid,all=1,timeout=self.timeout)
Dec 12 08:45:22 p-smb-01 samba-syncpasswords[4731]:   File "/usr/lib/python2.7/dist-packages/ldap/ldapobject.py", line 749, in result3
Dec 12 08:45:22 p-smb-01 samba-syncpasswords[4731]:     resp_ctrl_classes=resp_ctrl_classes
Dec 12 08:45:22 p-smb-01 samba-syncpasswords[4731]:   File "/usr/lib/python2.7/dist-packages/ldap/ldapobject.py", line 756, in result4
Dec 12 08:45:22 p-smb-01 samba-syncpasswords[4731]:     ldap_result = self._ldap_call(self._l.result4,msgid,all,timeout,add_ctrls,add_intermediates,add_extop)
Dec 12 08:45:22 p-smb-01 samba-syncpasswords[4731]:   File "/usr/lib/python2.7/dist-packages/ldap/ldapobject.py", line 329, in _ldap_call
Dec 12 08:45:22 p-smb-01 samba-syncpasswords[4731]:     reraise(exc_type, exc_value, exc_traceback)
Dec 12 08:45:22 p-smb-01 samba-syncpasswords[4731]:   File "/usr/lib/python2.7/dist-packages/ldap/ldapobject.py", line 313, in _ldap_call
Dec 12 08:45:22 p-smb-01 samba-syncpasswords[4731]:     result = func(*args,**kwargs)
Dec 12 08:45:22 p-smb-01 samba-syncpasswords[4731]: ldap.OTHER: {'desc': u'Other (e.g., implementation specific) error'}
Dec 12 08:45:22 p-smb-01 samba-syncpasswords[4731]: Wed Dec 12 08:45:22 2018: pid[4731]: RESULT: 1
Dec 12 08:45:22 p-smb-01 systemd[1]: samba-syncpasswords.service: Main process exited, code=exited, status=255/n/a
Dec 12 08:45:22 p-smb-01 systemd[1]: samba-syncpasswords.service: Failed with result 'exit-code'.
Dec 12 08:45:23 p-smb-01 systemd[1]: samba-syncpasswords.service: Service hold-off time over, scheduling restart.

Here are also the versions of the packages used:

Code: Select all

python-gpgme                          0.3-1.2 (backporté depuis debian)
python-ldap                           3.0.0-1
python-samba                          2:4.7.6+dfsg~ubuntu-0ubuntu2.5    amd64        Python bindings for Samba
samba                                 2:4.7.6+dfsg~ubuntu-0ubuntu2.5    amd64        SMB/CIFS file, print, and login server for Unix
samba-common                          2:4.7.6+dfsg~ubuntu-0ubuntu2.5    all          common files used by both the Samba server 
tis-sysvolsync                        0.2.2                             amd64        Install a sync process for samba4 sysvol directory using syncthing tool.

python --version
Python 2.7.15rc1

Re: Samba4 and OpenLDAP Password Synchronization

Published: Dec 12, 2018 - 11:14
by julinux
Answering myself, the exception was simply due to the fact that the remote ldap could no longer write (full partition...) :)