Bug 1663064 - AD Permissions required to join Linux computer to domain using realmd with samba in an hardened AD environment.
Summary: AD Permissions required to join Linux computer to domain using realmd with sa...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: samba
Version: 7.6
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: rc
: ---
Assignee: Andreas Schneider
QA Contact: dkarpele
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2019-01-03 01:39 UTC by Mohammed Shakir Ali
Modified: 2020-03-31 19:57 UTC (History)
11 users (show)

Fixed In Version: samba-4.10.4-7.el7
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2020-03-31 19:56:34 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2020:1084 None None None 2020-03-31 19:57:08 UTC
Samba Project 13884 None None None 2019-08-06 14:43:33 UTC

Description Mohammed Shakir Ali 2019-01-03 01:39:40 UTC
Description of problem:


In a hardened AD environment, what AD Permissions required to join Linux computer to domain using realmd with samba.


Version-Release number of selected component (if applicable):


How reproducible:


# realm join DOMAIN.FQDN --membership-software=samba --user=SERVICEACCOUNT -v
 * Resolving: _ldap._tcp.domain.fqdn
 * Performing LDAP DSE lookup on: XXX.XXX.XXX.XXX
 * Performing LDAP DSE lookup on: XXX.XXX.XXX.XXX
 * Successfully discovered: domain.fqdn
Password for serviceaccount:
 * Required files: /usr/sbin/oddjobd, /usr/libexec/oddjob/mkhomedir, /usr/sbin/sssd, /usr/bin/net
 * LANG=C LOGNAME=root /usr/bin/net -s /var/cache/realmd/realmd-smb-conf.KY1RLZ -U serviceaccount ads join domain.fqdn createcomputer=Folder/Subfolder1/Subfolder2 osName=RedHat osVer=7
Enter serviceaccount's password:
Failed to join domain: failed to join domain 'domain.fqdn' over rpc: {Access Denied} A process has requested access to an object but has not been granted those access rights.
 ! Joining the domain domain.fqdn failed
realm: Couldn't join realm: Joining the domain domain.fqdn failed



Steps to Reproduce:
1.
2.
3.

Actual results:


Failed to join domain: failed to join domain 'domain.fqdn' over rpc: {Access Denied} A process has requested access to an object but has not been granted those access rights.


Expected results:


Additional info:


The service account has the following permissions in AD:

* Create/Delete computer objects
* Reset password (computer objects)
* Validated write to DNS host name (computer objects)
* Validated write to service principal name (computer objects)
* Read/Write all properties (computer objects)

Comment 31 Andreas Schneider 2019-03-29 10:40:55 UTC
According to the 'net ads join -d10' output the user is not allowed to modify LDAP objects in that OU.

It looks like there are steps missing to gran the user the required permissions.

You can find details here:

https://support.microsoft.com/en-us/help/932455/error-message-when-non-administrator-users-who-have-been-delegated-con

I guess step 7. is missing.

Comment 34 Andreas Schneider 2019-04-04 13:16:51 UTC
I'm working on a fix. This is something we never supported in Samba so it needs quite a few code changes!

Comment 35 Andreas Schneider 2019-04-10 07:38:55 UTC
I'm not sure if we will be able to address this in RHEL 7.7 as the Windows Protocol documentation doesn't document the implementation details. We are in contact with Microsoft to get this probably documented but they need time to investigate this.

Comment 37 Andreas Schneider 2019-04-12 08:35:37 UTC
'net ads join' uses DCERPC to join the domain an setup the machine account. In order to do that over a sealed connection there are changes needed in Samba. We found that the Microsoft documentation in that area doesn't documented how to do that. Also there are differences between Windows versions.

You can follow the discussion with Microsoft here:

https://lists.samba.org/archive/cifs-protocol/2019-April/thread.html

Comment 40 Andreas Schneider 2019-05-29 06:26:13 UTC
This is still under investigation and work in progress. Moving to RHEL 7.8.0.

Comment 51 errata-xmlrpc 2020-03-31 19:56:34 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2020:1084


Note You need to log in before you can comment on or make changes to this bug.