APPLICATION NOTE

Active Directory Integration for Samba

Centrify's packaged and tested version of Samba works seamlessly on systems that have been joined to Active Directory using DirectControl

Samba enables Windows users to access file shares on a UNIX server using native Windows SMB protocols. Samba can be configured to use Active Directory to authenticate Windows users. However, when a Windows user saves a file on a UNIX share, Samba must assign UNIX user and group IDs to the file. Windows users do not typically have UNIX profiles, so Samba will set and store arbitrary values for these attributes on each UNIX server. Since Samba does not have a way to centrally store UNIX identity information in Active Directory, users can have different attributes from one server to the next. In most enterprise situations, this is not a workable solution.

Centrify overcomes this shortcoming with a packaged and tested version of Samba that works seamlessly on systems that have been joined to Active Directory using DirectControl. Centrify provides this DirectControl-enabled version of Samba free of charge to help you be more productive and to accelerate your deployment. Customers and those evaluating DirectControl can download it from the Centrify Download Center. See below for more insight into the features and benefits of using the DirectControl-enabled Samba.

Centrify's unique Support for Open Source Software plan provides the same benefits as product support, including guaranteed service levels and other benefits.

Features and Benefits

Centrify's Samba solution makes this Open Source tool enterprise-ready and provides the following additional key features to enable Active Directory users to securely and consistently access UNIX SMB file shares:

Centrally controlled user identity mapping. The DirectControl for Samba module controls the mapping of Active Directory accounts to UNIX Zone profiles to ensure consistent file system access controls across all servers that are joined to the Active Directory domain with DirectControl.

Multi-domain single sign-on support. Users from one Active Directory domain can access Samba shares on servers in another trusted domain without being prompted for their credentials. This is the same behavior that users would expect when using an all-Windows environment.

Active Directory group-based access controls. Some UNIX operating systems limit the number of groups that a user can belong to. For example, a Solaris user can not be a member of more than 32 groups. Centrify's solution overcomes this limitation and also supports nested groups, enabling Samba to leverage Active Directory groups for file access control regardless of the UNIX operating system's limitations.

Automated configuration. The DirectControl for Samba solution includes scripts to automatically configure Samba to work with DirectControl and Active Directory, and scripts to start the appropriate services each time the UNIX system boots. Centrify includes pre-compiled binary versions of the DirectControl-enabled Samba package for each of the supported platforms.

Supported Platforms