#5064 LDAP Client finds user objects, but "no users found under base"
I am running a NextCloud VM from www.nextcloud.com, with Webmin 1.870, and I'm attempting to get Samba connected to a domain (single Windows Server 2003 R2 domain controller) and to be able to access folder shares as domain users. I have successfully joined the domain, and I'm able to browse the active directory objects, but I'm not able to view any users or groups in the Webmin interface. A Google search returns an apparently similar issue from Sept 2016 and the result is that it was a know issue that was supposed to be resolved: https://www.virtualmin.com/node/42113 I am seeing this in December 2017, so it might be re-broken if it had been resolved.
From the LDAP Client tab: I have configured the DC by IP, connecting using V3 LDAP, the domain Administrator credentials, and encryption = Yes (not TLS). I have installed NIS tools on the DC and assigned UID and GID to the users & groups I want to potentially share folders with in Samba (my account is UID 10006 and the testgroup is GID 10006). On the LDAP Browser, I am able to browse the domain objects (attached screenshot is my account object). I have put my account and a test group into the base PBS.LOCAL object, in case it wasn't able to search deeper than the top level. When I press the Validate Config button:
Finding LDAP base for users ..
.. found base dc=PBS,dc=LOCAL.
Connecting to LDAP server ..
.. connected to 192.168.88.10
Searching for users ..
.. no users found under base dc=PBS,dc=LOCAL.
LDAP Users and Groups tab also displays a lack of any users or groups. I can provide more details/configs/logs, but I first wanted to check and see if this is still a known issue, and/or if there's a workaround that others have used.
Based on your screenshot, it doesn't look like the objects under the LDAP base have the
posixAccountobject class. This is needed for them to be recognized as Unix users.Thanks for the response, although I'm struggling with confirming. To add this posixAccount object class, do I need to make a change in the users themselves via Active Directory Users & Groups on the dc, or is there modification in the Linux system? I've so far not been able to find anything about posixAccount in the user or group properties, and I found mention of editing the /etc/ldap.conf file, but so farr nothing I've tweaked in there has made domain accounts appear via the Validate Config button. Also, (I presume this is relevant), getent returns no users (passwd) or groups (group).
Yes, you'd need to make this change on the active directory server to add a new object class.