Bug 13653 - Adding user to local DB with "ldb://" prefix creates invalid account
Adding user to local DB with "ldb://" prefix creates invalid account
Status: RESOLVED FIXED
Product: Samba 4.1 and newer
Classification: Unclassified
Component: AD: LDB/DSDB/SAMDB
4.9.0
All All
: P5 normal
: ---
Assigned To: Karolin Seeger
Samba QA Contact
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2018-10-11 22:01 UTC by Tim Beale
Modified: 2018-11-06 08:13 UTC (History)
1 user (show)

See Also:


Attachments
Patch for master. (18.37 KB, patch)
2018-10-16 02:40 UTC, Gary Lockyer
no flags Details
Updated patch for master. (24.28 KB, text/plain)
2018-10-18 20:09 UTC, Gary Lockyer
no flags Details
Back ported patch for Patch for v4.9 (24.98 KB, text/plain)
2018-10-29 01:23 UTC, Gary Lockyer
abartlet: review+
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Tim Beale 2018-10-11 22:01:45 UTC
When creating a new user and specifying the local filepath of the sam.ldb DB, it's possible to create an account that you can't actually login with.

This only happens if the DB is using encrypted secrets and you specify "ldb://" in the sam.ldb path, e.g. "-H ldb://st/ad_dc/private/sam.ldb". The user account will be created, but its secrets will not be encrypted. Attempts to login as the user will then be rejected due to invalid credentials.

We think this may also cause replication/joins to break.

You do get a warning about "No encrypted secrets key file" when this happens, although the reason behind this message is not obvious. Specifying a "tdb://" prefix, or not specifying a prefix, works fine.

Example of the problem below using the ad_dc testenv.

timbeale@addc:~/code/clean/samba$ bin/samba-tool user create tdb-user pass12# -H tdb://st/ad_dc/private/sam.ldb 
User 'tdb-user' created successfully

# HERE: using the "ldb://" prefix generates a warning, but the user is still created successfully.

timbeale@addc:~/code/clean/samba$ bin/samba-tool user create ldb-user pass12# -H ldb://st/ad_dc/private/sam.ldb 
No encrypted secrets key file. Secret attributes will not be encrypted or decrypted

User 'ldb-user' created successfully
timbeale@addc:~/code/clean/samba$ bin/samba-tool user create noprefix-user pass12# -H st/ad_dc/private/sam.ldb 
User 'noprefix-user' created successfully
timbeale@addc:~/code/clean/samba$ bin/ldbsearch -H ldap://$SERVER -Utdb-user%pass12# '(cn=tdb-user)' dn  
# record 1
dn: CN=tdb-user,CN=Users,DC=addom,DC=samba,DC=example,DC=com

# Referral
ref: ldap://addom.samba.example.com/CN=Configuration,DC=addom,DC=samba,DC=example,DC=com

# Referral
ref: ldap://addom.samba.example.com/DC=DomainDnsZones,DC=addom,DC=samba,DC=example,DC=com

# Referral
ref: ldap://addom.samba.example.com/DC=ForestDnsZones,DC=addom,DC=samba,DC=example,DC=com

# returned 4 records
# 1 entries
# 3 referrals

# HERE: can't login as the user created with "ldb://" prefix

timbeale@addc:~/code/clean/samba$ bin/ldbsearch -H ldap://$SERVER -Uldb-user%pass12# '(cn=ldb-user)' dn  
Wrong username or password: kinit for ldb-user@ADDOM.SAMBA.EXAMPLE.COM failed (Client not found in Kerberos database)

Failed to bind - LDAP error 49 LDAP_INVALID_CREDENTIALS -  <8009030C: LdapErr: DSID-0C0904DC, comment: AcceptSecurityContext error, data 54e, v1db1> <>
Failed to connect to 'ldap://addc' with backend 'ldap': LDAP error 49 LDAP_INVALID_CREDENTIALS -  <8009030C: LdapErr: DSID-0C0904DC, comment: AcceptSecurityContext error, data 54e, v1db1> <>
Failed to connect to ldap://addc - LDAP error 49 LDAP_INVALID_CREDENTIALS -  <8009030C: LdapErr: DSID-0C0904DC, comment: AcceptSecurityContext error, data 54e, v1db1> <>
timbeale@addc:~/code/clean/samba$ bin/ldbsearch -H ldap://$SERVER -Unoprefix-user%pass12# '(cn=noprefix-user)' dn  
# record 1
dn: CN=noprefix-user,CN=Users,DC=addom,DC=samba,DC=example,DC=com

# Referral
ref: ldap://addom.samba.example.com/CN=Configuration,DC=addom,DC=samba,DC=example,DC=com

# Referral
ref: ldap://addom.samba.example.com/DC=DomainDnsZones,DC=addom,DC=samba,DC=example,DC=com

# Referral
ref: ldap://addom.samba.example.com/DC=ForestDnsZones,DC=addom,DC=samba,DC=example,DC=com

# returned 4 records
# 1 entries
# 3 referrals
Comment 1 Gary Lockyer 2018-10-16 02:40:27 UTC
Created attachment 14530 [details]
Patch for master.

CI results https://gitlab.com/catalyst-samba/samba/pipelines/33050253
Comment 2 Gary Lockyer 2018-10-18 20:09:07 UTC
Created attachment 14533 [details]
Updated patch for master.
Comment 3 Gary Lockyer 2018-10-29 01:23:04 UTC
Created attachment 14547 [details]
Back ported patch for Patch for v4.9

CI results https://gitlab.com/catalyst-samba/samba/pipelines/34609236
Comment 4 Andrew Bartlett 2018-11-04 22:04:03 UTC
Please cherry-pick for 4.9.next

Thanks!
Comment 5 Karolin Seeger 2018-11-05 11:41:34 UTC
(In reply to Andrew Bartlett from comment #4)
Pushed to autobuild-v4-9-test.
Comment 6 Karolin Seeger 2018-11-06 08:13:34 UTC
(In reply to Karolin Seeger from comment #5)
Pushed to v4-9-test.
Closing out bug report.

Thanks!