Table of Contents

Introduction

I want to thank oshogbo and vermaden for their help. They did all the hard work to make this work, and this article is just my notes on deploying their solution. Both were very generous with their help in writing this article.

This article assumes you already have a FreeIPA domain running and a FreeBSD server that is enrolled as a member of that domain. We will walk through the steps to set up that FreeBSD server as a Samba server with FreeIPA authentication enabled. For more information, see the following articles:

My post on how to enroll FreeBSD as a FreeIPA domain member
vermaden’s exhaustive post on setting up the entire infrastructure

NOTE: I have not been successful in making this work with Kerberos tickets, but it does work by providing your FreeIPA userid and password. It’s not perfect, but I’ve been waiting for a solution to this for over 10 years and I wanted to publish what I have working so far.

Build and Install

Making Samba work with FreeIPA requires a custom build of both net/samba416 and net/freeipa-client.

For net/samba416, configure the port to use the MIT Kerberos libraries. Specifically, include these settings in the port options:

OPTIONS_FILE_UNSET+=GSSAPI_BUILTIN
OPTIONS_FILE_SET+=GSSAPI_MIT

For net/freeipa-client, you’ll need the ports overlay provided here: https://github.com/oshogbo/freeipa-idm-overlay. This port provides the ipasam.so shared library.

Once those custom ports are built, install both on your server.

Configuration

On the FreeIPA server

[root@idm ~]# ipa permission-add "CIFS-Server-Read-Passwords" \
                 --attrs={ipaNTHash,ipaNTSecurityIdentifier} \
                 --type=user \
                 --right={read,search,compare} \
                 --bindtype=permission
------------------------------------------------------
Added permission "CIFS-Server-Read-Passwords"
------------------------------------------------------
  Permission name: CIFS-Server-Read-Passwords
  Granted rights: read, search, compare
  Effective attributes: ipaNTHash, ipaNTSecurityIdentifier
  Bind rule type: permission
  Subtree: cn=users,cn=accounts,dc=lab,dc=org
  Type: user
  Permission flags: SYSTEM, V2

[root@idm ~]# ipa privilege-add "CIFS-Server-Privilege"
---------------------------------------
Added privilege "CIFS-Server-Privilege"
---------------------------------------
  Privilege name: CIFS-Server-Privilege

[root@idm ~]# ipa privilege-add-permission "CIFS-Server-Privilege" --permission="CIFS-Server-Read-Passwords"
  Privilege name: CIFS-Server-Privilege
  Permissions: CIFS-Server-Read-Passwords
-----------------------------
Number of permissions added 1
-----------------------------

[root@idm ~]# ipa role-add "CIFS-Server"
------------------------
Added role "CIFS-Server"
------------------------
  Role name: CIFS-Server

[root@idm ~]# ipa role-add-privilege "CIFS-Server" --privilege="CIFS-Server-Privilege"
  Role name: CIFS-Server
  Privileges: CIFS-Server-Privilege
----------------------------
Number of privileges added 1
----------------------------

[root@idm ~]# ipa service-add cifs/samba.lab.org
-------------------------------------------------------------
Added service "cifs/samba.lab.org@LAB.ORG"
-------------------------------------------------------------
  Principal name: cifs/samba.lab.org@LAB.ORG
  Principal alias: cifs/samba.lab.org@LAB.ORG
  Managed by: samba.lab.org

[root@idm ~]# ipa role-add-member "CIFS-Server" --services=cifs/samba.lab.org
  Role name: CIFS-Server
  Privileges: CIFS-Server-Privilege
  Member services: cifs/samba.lab.org@LAB.ORG
-------------------------
Number of members added 1
-------------------------

[root@idm ~]# ipa-getkeytab -s idm.lab.org -p cifs/samba.lab.org -k cifs-samba.keytab
Keytab successfully retrieved and stored in: cifs-samba.keytab

Deploy the Kerberos keytab

Move the cifs-samba.keytab file from the FreeIPA server to the FreeBSD Samba server at /usr/local/etc/smb4.keytab.
Set its owner to root and permissions to 0400.

On the FreeBSD Samba server

Install the ipasam.so library.

root@samba:~ # mkdir -p /usr/local/lib/samba4/modules/pdb
root@samba:~ # cp /usr/local/lib/ipasam.so /usr/local/lib/samba4/modules/pdb/ipasam.so

Configure Samba

Samba is configured in /usr/local/etc/smb4.conf. There are hundreds of options when configuring Samba, so we will not discuss all of them here. Here is a working configuration that should give you a good starting point.

[global]

  # Configure realm
  workgroup = MENDLIK
  realm = MENDLIK.ORG
  security = user
  map to guest = Never
  server role = member server

  # Use Kerberos for authentication
  passdb backend           = ipasam:ldaps://<YOUR-LDAP-SERVER>
  ldapsam:trusted          = yes
  create krb5 conf         = no
  dedicated keytab file    = FILE:/usr/local/etc/smb4.keytab
  kerberos method          = dedicated keytab
  state directory          = /var/lib/samba4
  cache directory          = /var/lib/samba4
  include                  = registry

  idmap config * : range   = 0 - 0
  idmap config * : backend = tdb

  idmap config MENDLIK : range   = <START-OF-USERID-RANGE> - <END-OF-USERID-RANGE>
  idmap config MENDLIK : backend = sss

  ldap suffix              = dc=mendlik,dc=org
  ldap user suffix         = cn=users,cn=accounts
  ldap machine suffix      = cn=computers,cn=accounts
  ldap group suffix        = cn=groups,cn=accounts
  ldap ssl                 = no

  wins support = yes
  domain master = no
  local master = no
  preferred master = no
  use sendfile = yes

  # Logging
  log level = 1
  log file = /var/log/samba4/log.%m

  # Performance and locking
  kernel oplocks = yes
  posix locking = yes
  strict locking = auto
  veto files = /._*/.DS_Store/
  delete veto files = yes

  # ACL and permission handling
  nt acl support = yes
  inherit acls = yes
  inherit permissions = no
  map acl inherit = yes

  # Extended attributes
  ea support = yes
  store dos attributes = yes

  # Client compatibility
  min receivefile size = 0

  # VFS objects
  vfs objects = zfsacl catia fruit streams_xattr

  # Apple/Fruit settings (helps Linux too)
  fruit:encoding = native
  fruit:metadata = stream
  fruit:resource = file
  fruit:locking = none

  # ZFS ACL mapping
  zfsacl:map_dacl_protected = yes
  zfsacl:map_dacl_inherit = yes

  # Create masks
  create mask = 0775
  directory mask = 2775

[public]
  comment = Public Share
  path = /tank/public
  read only = yes
  force group = admins
  write list = @admins

  # Create masks
  force create mode = 0664
  force directory mode = 2775

[homes]
  comment = Home Directories
  path = /tank/personal/%S
  read only = no
  browseable = no
  valid users = %S, %D%w%S

Validate the Configuration

Before starting Samba, run testparm to validate the configuration file:

root@samba:~ # testparm /usr/local/etc/smb4.conf

Review the output for any errors or warnings before proceeding.

Start Samba

root@samba:~ # service samba_server enable
root@samba:~ # service samba_server start

Troubleshooting

If Samba is crashing on startup with a message like the following, it could be that the libraries were not fully replaced when installing the custom-built version.

30249   │ [2026/06/02 03:25:26.324970,  0] ../../lib/util/fault.c:176(smb_panic_log)
30250   │   INTERNAL ERROR: Signal 11: Segmentation fault in pid 21913 (4.16.11)

Run the following to check whether all Kerberos libraries are resolving correctly:

> ldd /usr/local/sbin/smbd | grep krb
        libkrb5samba-samba4.so => /usr/local/lib/samba4/private/libkrb5samba-samba4.so (0x2631fef9d000)
        libkrb5.so.3.3 => /usr/local/lib/libkrb5.so.3.3 (0x263203cfe000)
        libauthkrb5-samba4.so => /usr/local/lib/samba4/private/libauthkrb5-samba4.so (0x26320fb05000)
        libkrb5-samba4.so => not found (0)
        libndr-krb5pac.so.0 => /usr/local/lib/compat/pkg/libndr-krb5pac.so.0 (0x26321f787000)
        libgssapi_krb5.so.2.2 => /usr/local/lib/libgssapi_krb5.so.2.2 (0x26322195a000)
        libkrb5support.so.0.1 => /usr/local/lib/libkrb5support.so.0.1 (0x2632223d2000)
        libkrb5-samba4.so => not found (0)

Those “not found” lines are a problem. Check your system for backup libraries and remove them:

> pkg info | grep samba416-backup-libraries
samba416-backup-libraries-20260307182744

> pkg remove samba416-backup-libraries-20260307182744

Then restart samba_server and it should work.