Configure Samba for Kerberos authentication

.gitignore

@@ -4,3 +4,4 @@ dist/
 docker-compose.override.yml
 # test/conftest.py creates .env files
 .env
+test/samba.keytab

docker-compose.yml

@@ -6,15 +6,16 @@ services:
     environment:
       REALM: bridoulou.fr
       ADMIN_PASS: 1Ntegral
-      DNS_BACKEND: "NONE"
     volumes:
+      - ./test/fixtures/samba/kerberos.sh:/docker-entrypoint-init.d/00-kerberos.sh
+      - ./test:/test  # Use to export keytab in kerberos.sh
       - ./test/fixtures/samba/nominal.sh:/docker-entrypoint-init.d/95-nominal.sh
       - ./test/fixtures/samba/extra.sh:/docker-entrypoint-init.d/96-extra.sh
     hostname: samba1
     domainname: ldap2pg.docker
     labels:
       com.dnsdock.alias: samba1.ldap2pg.docker
-    command: [-d=1]
+    command: [-d=3]
 
   postgres:
     image: postgres:${PGVERSION-16}-alpine

ldaprc

@@ -4,3 +4,7 @@ TLS_REQCERT allow
 NETWORK_TIMEOUT 5
 TIMEOUT 5
 REFERRALS off
+SASL_AUTHCID Administrator
+# Disable canonicalization which trigger Kerberos SPN ldap/172.X.Y.Z instead of ldap/samba1.ldap2pg.docker.
+# With canonicalisation, GSSAPI fails with "Server not found in Kerberos database".
+SASL_NOCANON on

test/fixtures/samba/kerberos.sh

@@ -0,0 +1,21 @@
+#!/bin/bash
+
+set -x
+samba-tool spn add ldap/samba1.ldap2pg.docker SAMBA1$
+samba-tool spn add ldap/localhost SAMBA1$
+samba-tool spn add ldap/localhost.localdomain SAMBA1$
+
+# Get Gateway (field 3) from default route (destination is 0.0.0.0).
+gateway_hex="$(grep -E '^\w+\s+00000000' /proc/net/route | cut -f 3)"
+gateway_bytes=( # IP is little endian.
+	$((16#${gateway_hex:6:2}))
+	$((16#${gateway_hex:4:2}))
+	$((16#${gateway_hex:2:2}))
+	$((16#${gateway_hex:0:2}))
+)
+printf -v gateway "%d.%d.%d.%d" "${gateway_bytes[@]}"
+
+samba-tool spn add "ldap/$gateway" SAMBA1$
+samba-tool spn list SAMBA1$
+samba-tool domain exportkeytab /test/samba.keytab --principal=Administrator
+chown -v "$(stat -c %u:%g "${BASH_SOURCE[0]}")" /test/samba.keytab

test/krb5.conf

@@ -0,0 +1,17 @@
+[libdefaults]
+ ticket_lifetime = 24h
+ renew_lifetime = 7d
+ forwardable = true
+ rdns = false
+ default_realm = BRIDOULOU.FR
+ default_keytab_name = FILE:test/samba.keytab
+
+[realms]
+ BRIDOULOU.FR = {
+    kdc = samba1.ldap2pg.docker
+    admin_server = samba1.ldap2pg.docker
+ }
+
+[domain_realm]
+.ldap2pg.docker = BRIDOULOU.FR
+ldap2pg.docker = BRIDOULOU.FR