TrueNAS Scale and Authentik for SMB auth

Hi guys,

I have set up TrueNAS Scale and authentik in my homelab. On TrueNAS I have a few different SMB shares accessible by different users. In authentik I currently manage auth for a couple different web-apps through its proxy provider.
Now I would like to be able to offer my users the possibility to use the same account data on those web-apps and for their SMB shares (for simplicitys sake). At the same time, I don’t want to manually sync these pieces of data accross those two systems. How can I achieve this?

I see that AD and/or LDAP might be solutions. Now what I also see, is that AD seems to require having another Windows machine running (which I don’t like, because of the IMO unnecessary overhead) and LDAP in smb might be getting deprecated or something along those lines (according to some posts here on the forum), but most importantly seems to be a hassle to set up (at least I didn’t find a guide for someone new to all those fancy protocols, trying to integrate authentik and TrueNAS Scale).

If anyone has some advice that would be much appreciated.

Thanks in advance.

Samba can run AD

Thanks for your reply, could you elaborate a little?

https://wiki.samba.org/index.php/Setting_up_Samba_as_an_Active_Directory_Domain_Controller

How could I use this? I have smb shares running on my TrueNAS system, but I have all my authentication stuff on the authentik system which does not use smb. This does not sound like it could help me here.

Authentik supports AD via LDAP, Samba can run AD, simples.

Do you know some specific documentation which could help me better understand what I need to do according to you? Because I don’t want to use TrueNAS and its install of samba to be a source of truth for authentik, actually I would like quite the opposite: authentik should manage all the user data on its own and if I want to use a smb share truenas should verify the credentials against authentik.

What you want to do is not possible.

You have two options :

  1. Install AD to be source of truth and point both TrueNAS and Authentik to it

  2. Re-use TrueNAS Samba to run AD to be the truth, and point Authentik to it

Or just wait for Oauth support

TrueNAS doesn’t support this, and hasn’t for a long time.

I would be surprised to see OAuth fix my problem in the slightest.

And as I said I don’t want to have distributed sources of truth, so this doesn’t seem like a suitable solution to me.

Anyway thanks for trying to help out.

Would you know of a way that does work in my case?

You’ve already mentioned one: use Authentik as an LDAP provider. LDAP itself unfortunately is poorly documented and often opaque.

Is it compiled out ?

AD will be the single source of truth, everything else will connect into it.

Did you manage to set this up mate ?

Did you look into sssd ?

Is it compiled out ?

Yes

LDAP server by itself can’t be used for SMB auth.