IPA Integration break Samba on 25.10

cfouche · January 3, 2026, 11:12pm

I wanted to try to link my truenas server and a freeipa domain to sync and allow user to login to smb with their user account.
But atfer linking truenas to my freeipa domain (via the ipa integration), Samba auth stopped to work, both for local users and IPA users. Looking at the logs, the only thing I could find is this :

[2026/01/03 13:53:03.964060,  0, traceid=1] ../../source3/librpc/crypto/gse.c:1047(gensec_gse_client_prepare_ccache)
  gensec_gse_client_prepare_ccache: Kinit for TRUENAS$@IDM.REDACTED.COM to access cifs/freeipa-0.idm.redacted.com failed: Preauthentication failed: NT_STATUS_LOGON_FAILURE
[2026/01/03 13:53:04.000244,  1, traceid=1] ../../source3/winbindd/winbindd_cm.c:814(cm_prepare_connection)
  authenticated session setup to freeipa-0.idm.redacted.com using IDM\TRUENAS$ failed with NT_STATUS_LOGON_FAILURE
[2026/01/03 13:53:04.000572,  1, traceid=1] ../../source3/winbindd/winbindd_cm.c:960(cm_prepare_connection)
  Failed to prepare SMB connection to freeipa-0.idm.redacted.com: NT_STATUS_LOGON_FAILURE
[2026/01/03 13:53:04.002207,  1, traceid=1] ../../source3/libsmb/namequery.c:3543(get_sorted_dc_list)
  get_sorted_dc_list: No server for domain 'IDM.REDACTED.COM' available in site 'Default-First-Site-Name', fallback to all servers
[2026/01/03 13:53:04.256343,  1, traceid=1] ../../source3/libads/ldap.c:830(ads_find_dc)
  ads_find_dc: name resolution for realm 'IDM.REDACTED.COM' (domain 'IDM') failed: NT_STATUS_NO_LOGON_SERVERS
[2026/01/03 13:53:04.510274,  1, traceid=1] ../../source3/libsmb/namequery.c:3543(get_sorted_dc_list)
  get_sorted_dc_list: No server for domain 'IDM.REDACTED.COM' available in site 'Default-First-Site-Name', fallback to all servers
[2026/01/03 13:53:34.258077,  0, traceid=1] ../../source3/librpc/crypto/gse.c:1047(gensec_gse_client_prepare_ccache)
  gensec_gse_client_prepare_ccache: Kinit for TRUENAS$@IDM.REDACTED.COM to access cifs/freeipa-0.idm.redacted.com failed: Preauthentication failed: NT_STATUS_LOGON_FAILURE
[2026/01/03 13:53:34.290491,  1, traceid=1] ../../source3/winbindd/winbindd_cm.c:814(cm_prepare_connection)
  authenticated session setup to freeipa-0.idm.redacted.com using IDM\TRUENAS$ failed with NT_STATUS_LOGON_FAILURE
[2026/01/03 13:53:34.290850,  1, traceid=1] ../../source3/winbindd/winbindd_cm.c:960(cm_prepare_connection)
  Failed to prepare SMB connection to freeipa-0.idm.redacted.com: NT_STATUS_LOGON_FAILURE
[2026/01/03 13:53:34.292631,  1, traceid=1] ../../source3/libsmb/namequery.c:3543(get_sorted_dc_list)
  get_sorted_dc_list: No server for domain 'IDM.REDACTED.COM' available in site 'Default-First-Site-Name', fallback to all servers
[2026/01/03 13:53:34.546611,  1, traceid=1] ../../source3/libads/ldap.c:830(ads_find_dc)
  ads_find_dc: name resolution for realm 'IDM.REDACTED.COM' (domain 'IDM') failed: NT_STATUS_NO_LOGON_SERVERS
[2026/01/03 13:53:34.800496,  1, traceid=1] ../../source3/libsmb/namequery.c:3543(get_sorted_dc_list)
  get_sorted_dc_list: No server for domain 'IDM.REDACTED.COM' available in site 'Default-First-Site-Name', fallback to all servers

I have already resolved another bug (I think) with this command :

ldbadd -H /var/db/system/samba4/private/secrets.ldb </dev/null

But I could not find a solution to this problem.

Software info :
TrueNAS 25.10.1 (the ipa connection work and is marked as healthy)
FreeIPA on Almalinux 10 with the ad-trust package installed and configured (done not for the AD trust but because it add some config and dns records needed for samba)
The rest of Freeipa install is pretty much standard without additional configs.

cfouche · January 3, 2026, 11:15pm

The client error :

smbclient -U "IDM\test" //10.0.0.170/bonk
Password for [IDM\test]:
session setup failed: NT_STATUS_NO_LOGON_SERVERS

cfouche · January 6, 2026, 5:24pm

Do anyone have used the IPA integration in TrueNAS ?

dariopnc · January 7, 2026, 8:28am

I’m also trying to accomplish your goal on my machine, with the same level of success as you, it seems

pmh · January 7, 2026, 10:28am

As far as I know Samba supports only Active Directory. Any other authenticator can only be used for other services like FTP, DAV, …

dariopnc · January 7, 2026, 7:57pm

From the official docs (IPA Screens for 25.10)

IPA includes integrated Samba support and can provide user and group information for SMB authentication.

pmh · January 7, 2026, 8:07pm

You are right - I assume you followed the documentation? In that case, I do not have any ideas, either.

Well, re-reading the initial post: in AD it is mandatory that the AD member system uses the AD domain controllers and only the domain controllers as DNS servers. I don’t know if that is also the case for IPA, but it just might be.

dariopnc · January 7, 2026, 8:19pm

In my case I have it like that: IPA server is the only nameserver (from old versions of the documentation).

I’m also facing another issue, that I don’t see any update of log files in /var/log/samba4, only in TrueNas GUI. It was working earlier and it stopped, but don’t know why

Jiechic · February 18, 2026, 12:28am

I have the same problem. Did you solve it?

JLS · July 17, 2026, 2:52pm

I just raised this PR which fixes this issue. Take a look and you can either wait for it to be merged or do what I did and just apply it to your running installation if you are brave.

For some reason you can’t post links in the forum but goto TrueNAS’s github project, go to the middleware repo, and look for PR: 19342

Feel free to vote for it

neofusion · July 17, 2026, 6:56pm

You can, but you will need to increase your trust level in the forum before that’s enabled, see the private message you should have received when creating your account.

Here’s the PR you mentioned:

github.com/truenas/middleware

Fix FreeIPA SMB machine password handling during domain join

master ← jsinglet:fix-freeipa-smb-machine-password

opened 06:10AM - 17 Jul 26 UTC

jsinglet

+2 -2

## Summary Fix two password-handling errors in the FreeIPA SMB join path that… cause Samba's machine-account secret to differ from the password assigned to the FreeIPA CIFS service principal. The mismatch prevents Samba/Winbind from establishing the NETLOGON secure channel even though the TrueNAS host successfully joins FreeIPA and DNS, LDAP, Kerberos, and keytab operations otherwise succeed. ## Root cause TrueNAS generates one random password that must be used consistently for both sides of the SMB machine trust: 1. `ipa-getkeytab -P` uses the password to set the FreeIPA CIFS service-principal credentials and create the corresponding keytab. 2. `net changesecretpw`, through `directoryservices.secrets.set_ipa_secret`, stores the same password in Samba's `secrets.tdb`. The current code changes that value independently in both paths. ### 1. `ipa_ctl.py` sends a literal placeholder to `ipa-getkeytab` The existing subprocess input is: ```python input=b'{password}\n{password}' ``` Because this is an ordinary bytes literal, `ipa-getkeytab` receives the literal text `{password}` twice rather than the value of the generated `password` variable. The function then returns the unrelated generated password to middleware, so the password returned to Samba does not match the password used by FreeIPA. This change formats the generated value before encoding it: ```python input=f'{password}\n{password}'.encode() ``` ### 2. `ipa_join_mixin.py` Base64-encodes the password before storing it in Samba The current code calls: ```python base64.b64encode(password.encode()) ``` before passing the result to `directoryservices.secrets.set_ipa_secret`. `set_ipa_secret` passes the supplied bytes to Samba's `net changesecretpw`; it does not decode this additional Base64 layer first. Samba therefore stores `Base64(password)` rather than the actual password assigned to the FreeIPA CIFS service principal. This change passes the generated password bytes directly: ```python password.encode() ``` The existing `base64` import remains required elsewhere in `ipa_join_mixin.py` for decoding the IPA host keytab. ## User-visible failure On an affected system, the FreeIPA join can appear successful, while the secure-channel test fails: ```text wbinfo --ping-dc checking the NETLOGON for domain[DOMAIN] dc connection to "" failed failed to call wbcPingDc: WBC_ERR_DOMAIN_NOT_FOUND ``` Samba logs can also contain messages such as: ```text NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND fork_domain_child called without domain dc_info : NULL ``` The `WBC_ERR_DOMAIN_NOT_FOUND` result is misleading in this case because domain-controller discovery is working. The actual failure is the mismatched machine secret. ## Reproduction 1. Configure a FreeIPA domain with SMB support. 2. Join TrueNAS to the FreeIPA domain with SMB integration enabled. 3. Confirm that the IPA host join and Kerberos configuration complete successfully. 4. Run: ```bash wbinfo --ping-dc ``` 5. Observe that Winbind cannot establish the NETLOGON secure channel. ## Verification The issue was reproduced using: - TrueNAS SCALE 25.10.4 - FreeIPA with SMB support enabled - Samba using the `SSS` idmap backend After correcting both password paths and repairing the machine secret previously written by the affected code, the secure-channel test succeeded: ```text wbinfo --ping-dc checking the NETLOGON for domain[DOMAIN] dc connection to "ipa.example.com" succeeded ``` FreeIPA-backed SMB authentication then succeeded. ## Existing installations This change prevents future IPA joins from creating mismatched Samba and FreeIPA credentials. It does not retroactively repair a machine password already stored in `secrets.tdb`. Systems joined while running the affected code may need to leave and rejoin the IPA domain, or otherwise regenerate the Samba machine secret, after installing the fix.

awalkerix · July 17, 2026, 6:58pm

I’m reviewing, but will probably incorporate into large changeset that expands fix and adds testing in the relevant areas.

dariopnc · July 19, 2026, 4:09pm

Thank you for diagnosing and proposing a fix!

As written in the PR it won’t fix current setups, though. Can you detail how to regenerate the Samba machine secret and sync both TrueNAS and FreeIPA?

Glujaz · August 30, 2026, 4:07pm

I tried to configure freeIPA today, and I also have the NT_STATUS_NO_LOGON_SERVERS issue. And Ì am on 25.10.6…

I am very new to this, and I was mostly following default install, and I just added a single user for testing, but looking at some CLI tests, the user was all good, except when I tried to connect over SMB including with smbclient…

Glujaz · August 30, 2026, 4:12pm

Ah, sorry, I was replying to quickly. I have NT_STATUS_CONNECTION_DISCONNECTED, with a Kerberos connection, I have NT_STATUS_UNSUCCESSFUL, and from wbinfo in shell, I also got this error WBC_ERR_DOMAIN_NOT_FOUND…

dariopnc · August 31, 2026, 5:42pm

As far as I know the fix hasn’t been backported, so we’ll get that in 26 when it lands

Topic		Replies	Views
Cannot start SMB service after joining IPA Directory Services on 25.10 TrueNAS General SCALE , SMB	16	235	July 17, 2026
IPA/Active Directory setup problems on 25.10 TrueNAS General SCALE	10	515	November 7, 2025
SCALE: Better support for SMB without Active Directory Feature Requests SCALE , SMB	10	1156	July 4, 2025
Issue with LDAP TrueNAS General SCALE	21	1319	January 29, 2025
Use FreeIPA/RedHat IdM for Auth in TrueNAS with Kerberos & LDAP for NFSv4 TrueNAS General SCALE	6	1162	June 25, 2025

IPA Integration break Samba on 25.10

Related topics