Hybrid Identity & SSO Bridge

# Navigate to your projects folder
cd ~

# Create directory for Samba AD
mkdir -p samba-ad/config samba-ad/data

# Navigate into it
cd samba-ad

# Verify structure
ls -la
# Should show: config/ data/

# ============================================
# SAMBA ACTIVE DIRECTORY DOMAIN CONTROLLER
# This creates a full AD DC in Docker
# ============================================

version: "3.8"

services:
  # ============================================
  # SAMBA AD DC
  # Full Active Directory Domain Controller
  # ============================================
  samba-ad:
    image: nowsci/samba-domain
    container_name: samba-ad
    hostname: dc1
    # Privileged mode required for AD to work properly
    privileged: true
    restart: unless-stopped
    
    # Environment variables configure the AD domain
    environment:
      # Your AD domain name (e.g., corp.local)
      - DOMAIN=corp.local
      
      # NetBIOS name (short name, max 15 chars)
      - DOMAINPASS=YourSecureP@ssw0rd!
      
      # Administrator password (CHANGE THIS!)
      - DNSFORWARDER=8.8.8.8
      
      # Don't join existing domain - create new one
      - HOSTIP=172.20.0.10
    
    # Expose AD-related ports
    ports:
      # DNS - Required for AD
      - "53:53/udp"
      - "53:53/tcp"
      # LDAP - Directory queries
      - "389:389/tcp"
      - "389:389/udp"
      # LDAPS - Secure LDAP
      - "636:636/tcp"
      # Kerberos - Authentication
      - "88:88/tcp"
      - "88:88/udp"
      # Global Catalog
      - "3268:3268/tcp"
      - "3269:3269/tcp"
    
    # Persistent storage for AD database
    volumes:
      - ./config:/etc/samba/external
      - ./data:/var/lib/samba
    
    # Static IP for reliable LDAP connections
    networks:
      ad-network:
        ipv4_address: 172.20.0.10

# Create isolated network for AD
networks:
  ad-network:
    driver: bridge
    ipam:
      config:
        - subnet: 172.20.0.0/24

# Start the Samba AD container
docker compose up -d

# Wait for domain provisioning (takes 2-3 minutes first time)
echo "Waiting for AD provisioning..."
sleep 60

# Check if container is running
docker ps | grep samba-ad
# Should show: samba-ad ... Up ...

# View logs to confirm domain is ready
docker logs samba-ad 2>&1 | tail -20
# Look for: "Domain provisioned" or similar

# Install LDAP utilities if not present
sudo apt install -y ldap-utils

# Test LDAP connection to Samba AD
# This searches for the domain base
ldapsearch -x -H ldap://localhost:389 \
  -D "Administrator@corp.local" \
  -w "YourSecureP@ssw0rd!" \
  -b "DC=corp,DC=local" \
  "(objectClass=domain)"

# You should see output like:
# dn: DC=corp,DC=local
# objectClass: domain
# ...

# Enter the Samba container
docker exec -it samba-ad bash

# Inside container: Create Organizational Units
# OU for regular users
samba-tool ou create "OU=Employees,DC=corp,DC=local"

# OU for groups
samba-tool ou create "OU=Security Groups,DC=corp,DC=local"

# OU for IT staff
samba-tool ou create "OU=IT,OU=Employees,DC=corp,DC=local"

# OU for Engineering
samba-tool ou create "OU=Engineering,OU=Employees,DC=corp,DC=local"

# Verify OUs created
samba-tool ou list
# Should show: Employees, Security Groups, IT, Engineering

# Still inside samba-ad container

# Create IT Admin user
samba-tool user create itadmin "ITAdmin@123" \
  --given-name="IT" \
  --surname="Admin" \
  --mail-address="itadmin@corp.local" \
  --userou="OU=IT,OU=Employees"

# Create Developer user
samba-tool user create jsmith "DevUser@123" \
  --given-name="John" \
  --surname="Smith" \
  --mail-address="jsmith@corp.local" \
  --userou="OU=Engineering,OU=Employees"

# Create another Developer
samba-tool user create mjones "DevUser@123" \
  --given-name="Mary" \
  --surname="Jones" \
  --mail-address="mjones@corp.local" \
  --userou="OU=Engineering,OU=Employees"

# Verify users created
samba-tool user list
# Should show: Administrator, itadmin, jsmith, mjones, ...

# Still inside samba-ad container

# Create Cloud Apps Access group
samba-tool group add "Cloud-Apps-Users" \
  --groupou="OU=Security Groups" \
  --description="Users allowed to access cloud applications"

# Create IT Admins group
samba-tool group add "IT-Admins" \
  --groupou="OU=Security Groups" \
  --description="IT Administrators with elevated access"

# Create Developers group
samba-tool group add "Developers" \
  --groupou="OU=Security Groups" \
  --description="Software developers"

# Add users to groups
samba-tool group addmembers "Cloud-Apps-Users" itadmin,jsmith,mjones
samba-tool group addmembers "IT-Admins" itadmin
samba-tool group addmembers "Developers" jsmith,mjones

# Verify group membership
samba-tool group listmembers "Cloud-Apps-Users"
# Should show: itadmin, jsmith, mjones

# Exit the container
exit

# List all users in the Employees OU
ldapsearch -x -H ldap://localhost:389 \
  -D "Administrator@corp.local" \
  -w "YourSecureP@ssw0rd!" \
  -b "OU=Employees,DC=corp,DC=local" \
  "(objectClass=user)" \
  cn mail sAMAccountName

# Expected output:
# dn: CN=IT Admin,OU=IT,OU=Employees,DC=corp,DC=local
# cn: IT Admin
# mail: itadmin@corp.local
# sAMAccountName: itadmin
# ...

# List all groups and their members
ldapsearch -x -H ldap://localhost:389 \
  -D "Administrator@corp.local" \
  -w "YourSecureP@ssw0rd!" \
  -b "OU=Security Groups,DC=corp,DC=local" \
  "(objectClass=group)" \
  cn member description

# Expected output shows groups with members:
# dn: CN=Cloud-Apps-Users,OU=Security Groups,DC=corp,DC=local
# cn: Cloud-Apps-Users
# member: CN=IT Admin,OU=IT,OU=Employees,DC=corp,DC=local
# member: CN=John Smith,OU=Engineering,OU=Employees,DC=corp,DC=local
# ...

# Enter the Samba container
docker exec -it samba-ad bash

# Change jsmith's password
samba-tool user setpassword jsmith --newpassword="NewP@ssw0rd123"

# Exit container
exit

# Now try logging into Authentik with the NEW password
# The old password should fail immediately!