What centralized user database for TrueNAS shares access (including SMB)?

TrueNAS General
,
1

Hello,

I’m posting here to be sure I fully understand the options I have for my use case, which is:

  • I want my (about 10-20) users and their credentials to be in a centralized DB (It’s already the case: I have an OpenLDAP server that’s already used by some services like web applications, etc.).
  • I want those users to use their credentials for accessing shares (Samba and NFS. iSCSI?).
  • I want to be able to set up ACLs for my datasets and shares using those users and groups.

Note: Moving my existing OpenLDAP users to a new system (AD or other) is not an issue.

I am running TrueNAS SCALE v25.04.2.3.

As “SMB shares can no longer be set up using LDAP authentication” (source) I guess I must use Active Directory?

I’ve read stuff about FreeIPA being easier to setup, but as it can only integrate with TrueNAS via LDAP it won’t be able to authenticate my users for SMB shares: it’s a no-go.

So my only option is:

  • to have an Active Directory domain (run/manage with some other software than TrueNAS)
  • to have my TrueNAS server join this Active Directory domain

Is that right? No alternative?

Thanks

2

I think that’s backwards. AD is very easy to set up and deploy.

3

Yes. AD or nothing. As a directory service AD and Windows are actually quite good, reliable, and easy to manage. We, too, run two Windows servers for AD only and nothing else.

Virtualised on TrueNAS CORE, but you can pick any hypervisor you prefer. I just generally recommend virtualising Windows because a restore of service after a hardware failure and replacement can be a real pain with Windows on bare metal.

4

MS strongly recommends at least one physical DC. IIRC there are some features you’ll want the hypervisor to support to protect against USN rollback if you have to roll back a DC VM to a prior state. Back in my admin days I’d prefer to just deploy / promote a new DC and demote / remove the failed one rather than trying to recover (just make sure to fix up DNS afterwards).

That said, Windows AD is a very polished product with a lot of conveniences for admins that make it worthwhile over DIY stuff.

5

Forgot to say: we don’t have any Windows server to act as Primary Domain Controller.
So setup an AD means installing and configuring Samba as a PDC, totally doable (done in last job) but seems less “easy” than FreeIPA no? (again: I did not use FreeIPA so I’m might be totally wrong about it’s easiness).

Well: Thanks for the confirmation that AD is the way to go :+1:.

6

I would not expect TrueNAS to work with a Samba PDC. I would always run Windows. But we will need @awalkerix to confirm if Samba is supported at all.

7

If the admin configures the samba domain controller correctly then it doesn’t matter from the TrueNAS perspective.

The key thing we don’t support is hacking TrueNAS into a domain controller (we actually compile without DC support).

That said, “support” here just means it’s possible. We don’t extend software support to CE users.

8

I’ve already done this in the past (both for TrueNAS Core and Scale) and it was running just fine.

That’s not my goal: DC will indeed be on another machine.