Bug 1179787
| Summary: | Authentication fails against pure Kerberos domains | ||||||
|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Francois Marabelle <francois.marabelle> | ||||
| Component: | samba | Assignee: | Andreas Schneider <asn> | ||||
| Status: | CLOSED ERRATA | QA Contact: | Robin Hack <rhack> | ||||
| Severity: | unspecified | Docs Contact: | |||||
| Priority: | unspecified | ||||||
| Version: | 7.2 | CC: | asn, francois.marabelle, gdeschner, jarrpa, jscotka, ovasik, rhack, sbose | ||||
| Target Milestone: | rc | ||||||
| Target Release: | --- | ||||||
| Hardware: | Unspecified | ||||||
| OS: | Unspecified | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | Doc Type: | Bug Fix | |||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2015-03-05 09:23:09 UTC | Type: | Bug | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Attachments: |
|
||||||
|
Description
Francois Marabelle
2015-01-07 14:57:07 UTC
Description of problem: when using samba4 and mit kerberos, we get authentification error: [2015/01/06 17:11:47.766311, 1] ../source3/auth/server_info.c:550(passwd_to_SamInfo3) The primary group domain sid(S-1-5-21-1682775123-2964376381-780467917-513) does not match the domain sid(S-1-22-1) for xxx(S-1-22-1-1102) [2015/01/06 17:11:47.766399, 1] ../source3/auth/user_krb5.c:254(make_session_info_krb5) make_server_info_[sam|pw] failed: NT_STATUS_INVALID_SID! [2015/01/06 17:11:47.766457, 1] ../source3/auth/auth_generic.c:119(auth3_generate_session_info_pac) Failed to map kerberos pac to server info (NT_STATUS_INVALID_SID) [2015/01/06 17:12:04.399775, 0] ../auth/kerberos/gssapi_pac.c:116(gssapi_obtain_pac_blob) obtaining PAC via GSSAPI gss_get_name_attribute failed: The operation or option is not available or unsupported: No such file or directory [2015/01/06 17:12:04.400201, 1] ../auth/gensec/gensec_util.c:51(gensec_generate_session_info_pac) Unable to find PAC for xxx, resorting to local user lookup Version-Release number of selected component (if applicable): How reproducible: Allways Steps to Reproduce: 1. 2. 3. Actual results: Authenfication error, cannot acces the share Expected results: Additional info: - Same config works on Redhat EL6 and samba3 - Recompile samba-4.1.14 works perfectly well smb.conf: [global] kerberos method = system keytab realm = MYDOMAIN.COM security = ads Changed component to samba. Please read the following document and be more precise about what is exactly going wrong: https://www.samba.org/~asn/reporting_samba_bugs.txt Created attachment 980400 [details] samba log files with debug samba tar file with debug information. Looks like this: https://lists.samba.org/archive/samba/2013-January/171091.html So you have a Kerberos domain, not a AD domain? Please be more precise about your setup and how to reproduce the issue! > - Recompile samba-4.1.14 works perfectly well
Do you mean this is already fixed with Samba 4.1.14 and you're using 4.1.12 where it is broken?
Yes I have a kerberos domain I use samba 4.1.14 because the rpms give me this error. I do not use 4.1.12 I think I have a patch for that. We have reproducer: For QA: make test TESTS="samba3.blackbox.smbclient_auth.plain" Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHBA-2015-0409.html |