When creating a new user and specifying the local filepath of the sam.ldb DB, it's possible to create an account that you can't actually login with. This only happens if the DB is using encrypted secrets and you specify "ldb://" in the sam.ldb path, e.g. "-H ldb://st/ad_dc/private/sam.ldb". The user account will be created, but its secrets will not be encrypted. Attempts to login as the user will then be rejected due to invalid credentials. We think this may also cause replication/joins to break. You do get a warning about "No encrypted secrets key file" when this happens, although the reason behind this message is not obvious. Specifying a "tdb://" prefix, or not specifying a prefix, works fine. Example of the problem below using the ad_dc testenv. timbeale@addc:~/code/clean/samba$ bin/samba-tool user create tdb-user pass12# -H tdb://st/ad_dc/private/sam.ldb User 'tdb-user' created successfully # HERE: using the "ldb://" prefix generates a warning, but the user is still created successfully. timbeale@addc:~/code/clean/samba$ bin/samba-tool user create ldb-user pass12# -H ldb://st/ad_dc/private/sam.ldb No encrypted secrets key file. Secret attributes will not be encrypted or decrypted User 'ldb-user' created successfully timbeale@addc:~/code/clean/samba$ bin/samba-tool user create noprefix-user pass12# -H st/ad_dc/private/sam.ldb User 'noprefix-user' created successfully timbeale@addc:~/code/clean/samba$ bin/ldbsearch -H ldap://$SERVER -Utdb-user%pass12# '(cn=tdb-user)' dn # record 1 dn: CN=tdb-user,CN=Users,DC=addom,DC=samba,DC=example,DC=com # Referral ref: ldap://addom.samba.example.com/CN=Configuration,DC=addom,DC=samba,DC=example,DC=com # Referral ref: ldap://addom.samba.example.com/DC=DomainDnsZones,DC=addom,DC=samba,DC=example,DC=com # Referral ref: ldap://addom.samba.example.com/DC=ForestDnsZones,DC=addom,DC=samba,DC=example,DC=com # returned 4 records # 1 entries # 3 referrals # HERE: can't login as the user created with "ldb://" prefix timbeale@addc:~/code/clean/samba$ bin/ldbsearch -H ldap://$SERVER -Uldb-user%pass12# '(cn=ldb-user)' dn Wrong username or password: kinit for ldb-user@ADDOM.SAMBA.EXAMPLE.COM failed (Client not found in Kerberos database) Failed to bind - LDAP error 49 LDAP_INVALID_CREDENTIALS - <8009030C: LdapErr: DSID-0C0904DC, comment: AcceptSecurityContext error, data 54e, v1db1> <> Failed to connect to 'ldap://addc' with backend 'ldap': LDAP error 49 LDAP_INVALID_CREDENTIALS - <8009030C: LdapErr: DSID-0C0904DC, comment: AcceptSecurityContext error, data 54e, v1db1> <> Failed to connect to ldap://addc - LDAP error 49 LDAP_INVALID_CREDENTIALS - <8009030C: LdapErr: DSID-0C0904DC, comment: AcceptSecurityContext error, data 54e, v1db1> <> timbeale@addc:~/code/clean/samba$ bin/ldbsearch -H ldap://$SERVER -Unoprefix-user%pass12# '(cn=noprefix-user)' dn # record 1 dn: CN=noprefix-user,CN=Users,DC=addom,DC=samba,DC=example,DC=com # Referral ref: ldap://addom.samba.example.com/CN=Configuration,DC=addom,DC=samba,DC=example,DC=com # Referral ref: ldap://addom.samba.example.com/DC=DomainDnsZones,DC=addom,DC=samba,DC=example,DC=com # Referral ref: ldap://addom.samba.example.com/DC=ForestDnsZones,DC=addom,DC=samba,DC=example,DC=com # returned 4 records # 1 entries # 3 referrals
Created attachment 14530 [details] Patch for master. CI results https://gitlab.com/catalyst-samba/samba/pipelines/33050253
Created attachment 14533 [details] Updated patch for master.
Created attachment 14547 [details] Back ported patch for Patch for v4.9 CI results https://gitlab.com/catalyst-samba/samba/pipelines/34609236
Please cherry-pick for 4.9.next Thanks!
(In reply to Andrew Bartlett from comment #4) Pushed to autobuild-v4-9-test.
(In reply to Karolin Seeger from comment #5) Pushed to v4-9-test. Closing out bug report. Thanks!