Bug 2148943

Summary: Samba with Winbind can not retrieve user groups from Active Directory
Product: Red Hat Enterprise Linux 8 Reporter: ediazten
Component: sambaAssignee: Andreas Schneider <asn>
Status: CLOSED ERRATA QA Contact: shridhar <sgadekar>
Severity: high Docs Contact:
Priority: unspecified    
Version: 8.7CC: abokovoy, aboscatt, asn, bthekkep, cave, dchen, dkarpele, gdeschner, msugaya, pfilipen, pjasbuti, pratshar, tscherf
Target Milestone: rcKeywords: Triaged, ZStream
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: samba-4.17.4-0.el8 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
: 2154885 2170468 (view as bug list) Environment:
Last Closed: 2023-05-16 09:08:22 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2154885, 2170468    

Description ediazten 2022-11-28 12:03:56 UTC 
Description of problem:
Using Samba with Winbind to join an Active Directory Domain, the system doesn't get any group information back from the AD. id only shows the main group (normally "domain users") but none of the secondary groups. As many times those secondary groups are used for managing security permissions, this causes many problems.

Version-Release number of selected component (if applicable):
RHEL 8.7, but also RHEL 9.1 (probably 9.0, but I've not tested it). In RHEL 8.6 works perfectly.

These are the relevant packages in 8.7:
adcli-0.8.2-12.el8.x86_64
samba-client-libs-4.16.4-2.el8.x86_64
samba-winbind-krb5-locator-4.16.4-2.el8.x86_64
samba-common-libs-4.16.4-2.el8.x86_64
samba-libs-4.16.4-2.el8.x86_64
samba-common-tools-4.16.4-2.el8.x86_64
samba-winbind-clients-4.16.4-2.el8.x86_64
oddjob-mkhomedir-0.34.7-2.el8.x86_64
samba-common-4.16.4-2.el8.noarch
oddjob-0.34.7-2.el8.x86_64
samba-winbind-modules-4.16.4-2.el8.x86_64
samba-winbind-4.16.4-2.el8.x86_64
realmd-0.16.3-25.el8.x86_64

The same list for 8.6, which is the one working:
adcli-0.8.2-12.el8.x86_64
samba-client-libs-4.15.5-5.el8.x86_64
samba-winbind-krb5-locator-4.15.5-5.el8.x86_64
samba-common-libs-4.15.5-5.el8.x86_64
samba-libs-4.15.5-5.el8.x86_64
samba-4.15.5-5.el8.x86_64
samba-common-tools-4.15.5-5.el8.x86_64
samba-winbind-clients-4.15.5-5.el8.x86_64
oddjob-mkhomedir-0.34.7-1.el8.x86_64
samba-common-4.15.5-5.el8.noarch
samba-winbind-modules-4.15.5-5.el8.x86_64
samba-winbind-4.15.5-5.el8.x86_64
oddjob-0.34.7-1.el8.x86_64
realmd-0.16.3-25.el8.x86_64

How reproducible:
Easy, happens each time.

Steps to Reproduce:
1- In a fresh install of RHEL 8.7 or 9.1, follow the instructions to join AD using Samba + Winbind: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/integrating_rhel_systems_directly_with_windows_active_directory/connecting-rhel-systems-directly-to-ad-using-samba-winbind_integrating-rhel-systems-directly-with-active-directory#proc_joining-samba-to-a-domain_connecting-rhel-systems-directly-to-ad-using-samba-winbind
2- Tested on Windows Server 2016 and 2019, both fail.
3- Do an id for an AD user that has at least one extra group assigned. The secondary group(s) won't show up.

Actual results:
No secondary user groups show up.

Expected results:
Should retrieve all the user's groups.

Additional info:
Actual case: https://access.redhat.com/support/cases/#/case/03365756
Comment 1 Andreas Schneider 2022-11-28 14:05:24 UTC 
What if you set 'winbind expand groups = 1'?
Comment 2 ediazten 2022-11-28 15:15:23 UTC 
(In reply to Andreas Schneider from comment #1)
> What if you set 'winbind expand groups = 1'?

Tried on my test environment, and the problem is still present, both in 8.7 and in 9.1.
Comment 3 Andreas Schneider 2022-11-29 13:00:59 UTC 
Note that you have to restart winbind and relogin as the user in order to get the correct information.
Comment 4 ediazten 2022-11-29 13:11:27 UTC 
(In reply to Andreas Schneider from comment #3)
> Note that you have to restart winbind and relogin as the user in order to
> get the correct information.

I did a full reboot, as those test VMs have no other service and the reboot is only 15 seconds.
Comment 10 Alexander Bokovoy 2022-12-08 10:00:18 UTC 
In the description a non-working case has no 'samba' package installed while working environment has 'samba' package installed. Can you please try with the environments using the same set of the packages?
Comment 11 ediazten 2022-12-12 15:36:03 UTC 
Customer has confirmed that installing 'samba' package solves the issue.
But they want to have this working without the package, as up until RHEL 8.6 it was working, and also because having Samba installed, even unconfigured and not running, could cause potential security and compliance problems.
Comment 12 cave 2022-12-13 09:32:15 UTC 
We have the same situation.
Without the "samba" package, the AD groups are not returned.
With the package installed, the AD groups are returned.

We would prefer not to install samba to have winbind working correctly.
Comment 13 Pavel Filipensky 2022-12-13 14:52:23 UTC 
I was able to reproduce the issue and will investigate the proper fix.
Comment 14 Pavel Filipensky 2022-12-13 21:28:26 UTC 
If only winbind package is installed, following executables are missing, since they belong to samba package:

# rpm -qf /usr/libexec/samba/samba-dcerpcd /usr/libexec/samba/rpcd_lsad 
samba-4.16.4-2.el8.x86_64
samba-4.16.4-2.el8.x86_64

And winbind fails to open pipe for SAMR connection:


[2022/12/13 09:39:35.770827, 10, pid=38352, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_dual_ndr.c:490(winbindd_dual_ndrcmd)
    winbindd_dual_ndrcmd: Running command wbint_LookupUserAliases (domain 'IP-10-0-198-155')
  [2022/12/13 09:39:35.770844,  1, pid=38352, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:484(ndr_print_function_debug)
         wbint_LookupUserAliases: struct wbint_LookupUserAliases
            in: struct wbint_LookupUserAliases
                sids                     : *
                    sids: struct wbint_SidArray
                        num_sids                 : 0x00000008 (8)
                        sids: ARRAY(8)
                            sids                     : S-1-5-21-1776223824-959228081-484330324-1111
                            sids                     : S-1-5-21-1776223824-959228081-484330324-513
                            sids                     : S-1-5-21-1776223824-959228081-484330324-1108
                            sids                     : S-1-5-21-1776223824-959228081-484330324-1107
                            sids                     : S-1-5-21-1776223824-959228081-484330324-1106
                            sids                     : S-1-5-21-1776223824-959228081-484330324-1105
                            sids                     : S-1-5-21-1776223824-959228081-484330324-1110
                            sids                     : S-1-5-21-1776223824-959228081-484330324-1109
  [2022/12/13 09:39:35.770898, 10, pid=38352, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:2489(wb_cache_lookup_useraliases)
    lookup_usergroups: [Cached] - doing backend query for info for domain IP-10-0-198-155
  [2022/12/13 09:39:35.770913,  3, pid=38352, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_samr.c:1252(sam_lookup_useraliases)
    sam_lookup_useraliases
  [2022/12/13 09:39:35.770976, 10, pid=38352, effective(0, 0), real(0, 0)] ../../source3/rpc_client/local_np.c:172(np_sock_connect_connected)
    np_sock_connect_connected: async_connect_recv returned Connection refused
  [2022/12/13 09:39:35.770988, 10, pid=38352, effective(0, 0), real(0, 0)] ../../source3/rpc_client/local_np.c:622(local_np_connect_connected)
    local_np_connect_connected: np_sock_connect failed: Connection refused
  [2022/12/13 09:39:35.771152, 10, pid=38352, effective(0, 0), real(0, 0)] ../../source3/rpc_client/local_np.c:373(start_rpc_host_send)
    start_rpc_host_send: posix_spawn() failed: No such file or directory
  [2022/12/13 09:39:35.771164, 10, pid=38352, effective(0, 0), real(0, 0)] ../../source3/rpc_client/local_np.c:664(local_np_connect_started)
    local_np_connect_started: start_rpc_host_recv failed: No such file or directory
  [2022/12/13 09:39:35.771174, 10, pid=38352, effective(0, 0), real(0, 0), class=rpc_cli] ../../source3/rpc_client/cli_pipe.c:3110(rpc_pipe_open_local_np)
    rpc_pipe_open_local_np: local_np_connect for samr and user NT AUTHORITY\SYSTEM failed: No such file or directory
  [2022/12/13 09:39:35.771181,  0, pid=38352, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_samr.c:72(open_internal_samr_conn)
    open_internal_samr_conn: Could not connect to samr pipe: NT_STATUS_OBJECT_NAME_NOT_FOUND
  [2022/12/13 09:39:35.771211, 10, pid=38352, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:3487(get_global_winbindd_state_offline)
    get_global_winbindd_state_offline: Offline state not set.
  [2022/12/13 09:39:35.771230, 10, pid=38352, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:503(wcache_store_seqnum)
    wcache_store_seqnum: success [IP-10-0-198-155][1670942375 @ 1670942375]
  [2022/12/13 09:39:35.771236, 10, pid=38352, effective(0, 0), real(0, 0), class=winbind] ../../source3/winbindd/winbindd_cache.c:561(refresh_sequence_number)
    refresh_sequence_number: IP-10-0-198-155 seq number is now 1670942375
  [2022/12/13 09:39:35.771241,  1, pid=38352, effective(0, 0), real(0, 0), class=rpc_parse] ../../librpc/ndr/ndr.c:484(ndr_print_function_debug)
         wbint_LookupUserAliases: struct wbint_LookupUserAliases
            out: struct wbint_LookupUserAliases
                rids                     : *
                    rids: struct wbint_RidArray
                        num_rids                 : 0x00000000 (0)
                        rids: ARRAY(0)
                result                   : NT_STATUS_OBJECT_NAME_NOT_FOUND


===========

So we need to redesign the package content. Probably move samba-dcerpcd & friends out of the samba package into a new package and to 'Require' this new package in both samba and winbind.
Comment 15 Andreas Schneider 2022-12-19 14:14:37 UTC 
We will create a 'samba-dcerpc' sub-package. For now please install the 'samba' package.
Comment 27 Andreas Schneider 2023-03-28 11:51:49 UTC 
*** Bug 2158245 has been marked as a duplicate of this bug. ***
Comment 29 errata-xmlrpc 2023-05-16 09:08:22 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Low: samba security, bug fix, and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2023:2987