kanidm and samba: password synchronization setup with security = user

[lopter]

Hello,

kanidm is a pretty exciting discovery for me today, I feel humbled and admirative. Thanks for attacking such a big problem, and for the thorough summary in #2627.

@Firstyear & @TheRealGramdalf, in that issue you talk about using security = user in Samba, and I felt my question was off-topic so I am posting it here: it looks like you folks use the tdbsam passdb backend, how do you synchronize the database with other Samba servers in that case?

Is it possible to load the samba schema and use kanidm as an ldapsam backend? My understanding from reading the kanidm's documentation is no, and kanidm uses a static/hardcoded schema.

And an alternative to security = user would be epic of course.

[yaleman]

Is it possible to load the samba schema and use kanidm as an ldapsam backend

Kanidm doesn't provide this functionality. #2627 is designed to track attempting to provide a secure and usable backend for Samba... but it's a long ways off.

[lopter]

Thanks @yaleman, since it's a long way off, I have been thinking (for a while actually) to come-up with a custom passdb backend to help with that issue, would that be a crazy thing to do?

[yaleman]

If it's something you want to build to learn about how to do such things then it sounds like a challenge. I can't say either way if it's something we'd support including in Kanidm core however.

[Firstyear]

The problem is that NTLM is on the way out, so we really need to look into krb here. It's likely that any attempt to make a passdb backend won't work soon in the near future.

[TheRealGramdalf]

Is it possible to load the samba schema and use kanidm as an ldapsam backend? My understanding from reading the kanidm's documentation is no, and kanidm uses a static/hardcoded schema.

I haven't bothered as I don't need to sync between hosts, but you should be able to cobble something together with lldap and kanidm's LDAP legacy sync functionality (Or just with plain lldap, though that somewhat defeats the point of SSO).
Just keep in mind that you'll need to use the LLDAP CLI to create the schema within LLDAP, as last I checked registering custom schemas (like sambas') is considered semi-experimental. I believe there's a discussion/issue over at https://github.com/lldap/lldap