Mount password protected Samba share with Kerberos ticket

active-directoryautomountkerberoskeychainsmb

My iMac is connected to the Active Directory server, with no additional GID and UID setup, I can login to the OS X using AD user credentials, but I also need to mount the Desktops and probably other shares.

The problem is that I use Linux hosted Samba servers, and I need to push the Desktop's share path to the OS X clients somehow. I can mount that using OS X' Samba client, but I need to do that automatically. As I'm already authenticated against AD, there must be a way to use my Kerberos ticket to access the share without password, isn't it?

Some guys say that it is possible with passwords stored in keychain, but I don't get it much, when are passwords stored in keychain? Should I add it once, and will that work forever?

Best Answer

We use the dsconfigad tool - to enable single sign-on we need to fire the dsconfigad -enableSSO command, after that there is no need to retype the passwords, Kerberos tickets are being reused.

To mount a Samba share subfolder automatically, you need to enable "Show connected servers" in the Finder preferences, then use cmdK to connect to the subfolder in Samba share, and create an alias on Desktop or wherever you want, after you can disable showing connected servers on Desktop. Then you can just click on the alias and it will open the shared subfolder.

Related Solutions

Mount a samba drive, with password from keychain

Here's how I did it

mkdir -p /Volumes/work \
&& mount -t smbfs //admin:$(security find-internet-password -D "Network Password" -l "share name" -w)@server/work /Volumes/work

The keychain access was a bit tricky, I found the answer and wrote it there. The important part was the capitals when specifying the secret kind.

You'll need to be able to create directories in /Volumes as well. This answer helped me.

MacOS – Automount SMB share at specific location

I've had to do this as well, and I have an Applescript I wrote and cobbled together from working sources to request the user's password and then use mount_smbfs to mount to a specific location (with folders already set up).

This prevents stale passwords from quickly locking out the account, and also prevents passwords in the script body. I do hard-code the username in the script, that's safe enough I think.

I also do (list disks) to check which shares are already mounted, and then use the results to report back the mounted shares, and any failed mount attempts.

Best Answer

Related Solutions

Mount a samba drive, with password from keychain

MacOS – Automount SMB share at specific location

Related Question