SO: Windows server 2008
AD2008
Dominio: beta.py
IP:192.168.12.25

SO: Open Suse 11.3
Proxy
IP: 192.168.12.4
 

[libdefaults]
        default_realm = BETA.PY
        clockskew = 300
        dns_lookup_realm = false
        dns_lookup_kdc = false
        default_tgs_enctypes = DES-CBC-CRC DES-CBC-MD5 RC4-HMAC
        default_tkt_enctypes = DES-CBC-CRC DES-CBC-MD5 RC4-HMAC
        preferred_enctypes = DES-CBC-CRC DES-CBC-MD5 RC4-HMAC



[realms]
BETA.PY = {
        kdc = 192.168.12.25
        default_domain = beta.py
        admin_server = 192.168.12.25
}

beta.py = {
        kdc = 192.168.12.25
        default_domain = beta.py
        admin_server = 192.168.12.25
}

beta = {
        kdc = 192.168.12.25
        default_domain = beta
        admin_server = 192.168.12.25
}

[logging]
        kdc = FILE:/var/log/krb5/krb5kdc.log
        admin_server = FILE:/var/log/krb5/kadmind.log
        default = SYSLOG:NOTICE:DAEMON

[domain_realm]
        .beta.py = BETA.PY
        .beta = beta

[appdefaults]
pam = {
        ticket_lifetime = 1d
        renew_lifetime = 1d
        forwardable = true
        proxiable = false
        minimum_uid = 0
        retain_after_close = false
        try_first_pass = true
        clockskew = 300
        external = sshd
        use_shmem = sshd
#               clockskew = 300
#               external = sshd
#               use_shmem = sshd
}
 

[global]

 security = ADS
  netbios name = proxy
  realm = beta.py
  password server = ad.beta.py
  workgroup = BETA
  log level = 1
  syslog = 0
  idmap uid = 10000-29999
  idmap gid = 10000-29999
  winbind separator = +
  winbind enum users = yes
  winbind enum groups = yes
  winbind use default domain = yes
  template homedir = /home/%D/%U
  template shell = /bin/bash
  client use spnego = yes
  domain master = no
  server string = Servidor Proxy de Dominio
  encrypt passwords = yes


[homes]
        comment = Home Directories
        valid users = %S, %D%w%S
        browseable = No
        read only = No
        inherit acls = Yes
[profiles]
        comment = Network Profiles Service
        path = %H
        read only = No
        store dos attributes = Yes
        create mask = 0600
        directory mask = 0700
[users]
        comment = All users
        path = /home
        read only = No
        inherit acls = Yes
        veto files = /aquota.user/groups/shares/
[groups]
        comment = All groups
        path = /home/groups
        read only = No
        inherit acls = Yes
[printers]
        comment = All Printers
        path = /var/tmp
        printable = Yes
        create mask = 0600
        browseable = No
[print$]
        comment = Printer Drivers
        path = /var/lib/samba/drivers
        write list = @ntadmin root
        force group = ntadmin
        create mask = 0664
        directory mask = 0775
 

passwd: compat winbind
group:  compat winbind

hosts:          files dns
networks:       files dns

services:       files
protocols:      files
rpc:            files
ethers:         files
netmasks:       files
netgroup:       files nis
publickey:      files

bootparams:     files
automount:      files nis
aliases:        files
 

auth_param ntlm program /usr/bin/ntlm_auth --helper-protocol=squid-2.5-ntlmssp
auth_param ntlm children 20
auth_param ntlm keep_alive on
auth_param basic program /usr/bin/ntlm_auth --helper-protocol=squid-2.5-ntlmssp
auth_param basic children 15
auth_param basic realm Servidor Proxy de Dominio BETA.PY
auth_param basic credentialsttl 2 hours

acl authenticated proxy_auth REQUIRED

http_access allow all authenticated

external_acl_type nt_group ttl=0 concurrency=5 %LOGIN /usr/sbin/wbinfo_group.pl
 

proxy:~ # /usr/bin/ntlm_auth --username=ferbog
password:
NT_STATUS_OK: Success (0x0)
 

proxy:~ # kinit administrador@BETA.PY
Password for administrador@BETA.PY:
proxy:~ # klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: administrador@BETA.PY

Valid starting     Expires            Service principal
08/18/10 11:41:54  08/18/10 21:41:57  krbtgt/BETA.PY@BETA.PY
        renew until 08/19/10 11:41:54