Bug 2208273

Summary:	user from one-way trusted domains cannot login by using winbind
Product:	Red Hat Enterprise Linux 8	Reporter:	bobin <bobinjosek>
Component:	samba	Assignee:	Andreas Schneider <asn>
Status:	CLOSED INSUFFICIENT_DATA	QA Contact:	sssd-qe
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	8.4	CC:	aboscatt, asn, dkarpele, pfilipen
Target Milestone:	rc	Flags:	asn: needinfo? (bobinjosek) aboscatt: needinfo? (bobinjosek)
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2023-06-27 11:53:16 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description bobin 2023-05-18 12:54:36 UTC

Description of problem:
Linux servers (RHEL 8) joined to a local Active Directory (AD) forest/domain (windows server 2019)  using samba-winbind. But logins to the Linux servers failed for users who coming in from a trusted(transitive) AD forest(windows server 2019).If we created one way trust.If we create bi-directoional trust, it's working. But we don't want to go for bi-directorional trust.

Version-Release number of selected component (if applicable):
samba-winbind-4.13.3-11.el8_4.x86_64 (Packages are from RHEL 8.4)

How reproducible:
Yes and reproducible

Steps to Reproduce:
1. install samba-winbind-4.13.3-11.el8_4.x86_64
2. join Linux server (RHEL 8.4) into local Active Directory
3. Clear cache and restart winbind: systemctl stop winbind; net cache flush; rm -f /var/lib/samba/*.tdb; systemctl start winbind
3. do a `id <username>` which returns "no such user" for trusted domain user


Actual results:
Trusted domain/forest user information cannot be retrieved on the Linux servers running samba-winbind-4.13.3-11.el8_4.x86_64. Trusted domain users logins failed.

Expected results:
`id` command can returns user info from trusted domain and we could login with trusted domain users in Linux servers

Additional info:

Comment 1 Andreas Schneider 2023-06-01 08:26:55 UTC

Did just the `id` command fail or did you really try to login as the user? The `id` command might not be able to get information about the user until the user actually has been logged in once ...

Comment 2 Andre Boscatto 2023-06-15 08:20:34 UTC

ping