Bug 15777 - net offlinejoin not working correctly
Summary: net offlinejoin not working correctly
Status: RESOLVED FIXED
Alias: None
Product: Samba 4.1 and newer
Classification: Unclassified
Component: Tools (show other bugs)
Version: 4.21.2
Hardware: All All
: P5 normal (vote)
Target Milestone: ---
Assignee: Jule Anger
QA Contact: Samba QA Contact
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2025-01-06 17:09 UTC by Stefan Kania
Modified: 2025-02-17 15:52 UTC (History)
4 users (show)

See Also:


Attachments
patch from master for v4-21-test (6.24 KB, patch)
2025-01-30 11:55 UTC, Guenther Deschner
asn: review+
gd: ci-passed+
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Stefan Kania 2025-01-06 17:09:34 UTC
Normally with "net offlinejoin" you creat an machine account on any machine inside the domain copy the safefile to the new client and then join the client as local administrator. When I try to creat the safefile and add the machine accout to the domain I go the following error:

---------------
root@client01:~# net offlinejoin provision -U administrator%Passw0rd domain=example.net machine_name=win11b savefile=provisioning.txt
ads_print_error: AD LDAP ERROR: 19 (Constraint violation): 0000202F: samldb: spn[HOST/client01.example.net] would cause a conflict
Failed to provision computer account: Invalid configuration ("netbios name" set to 'CLIENT01', should be 'win11b') and configuration modification was not requested 
---------------
So "net offlinejoin" expected the hostname of the client I'm executing the command and not any new name of a client I want to join. I tested it with:

----------------
root@client01:~# net offlinejoin provision -U administrator%Passw0rd domain=example.net machine_name=client01 savefile=provisioning.txt
Successfully provisioned computer 'client01' in domain 'example.net'
----------------  
Here you see, that now the account will be created (but it is allredy there) and the safefile will be created too.

On any Windows-Client, loged in as domain administrator, I can do:
-----------
H:\>djoin /provision /domain example.net /machine win11a /savefile win1a.txt 
-----------
And it works. I choose a new client name and NOT the name of the client I'm working on.

It makes absolutly no sens at  all to do an offlinejoin on the client I would like to join. 

One more thing. The manpage is wrong:
--------------------
 SAVEFILE is an optional parameter to store the generated provisioning data on disk.
--------------------
The SAVEFILE must be requried, because the file will be copied to the new client  and then used to join the client as local administrator
Comment 1 Jennifer Sutton 2025-01-07 01:21:39 UTC
(In reply to Stefan Kania from comment #0)
> ads_print_error: AD LDAP ERROR: 19 (Constraint violation): 0000202F: samldb: spn[HOST/client01.example.net] would cause a conflict

This is part of some security hardening we did for Samba 4.15.2 (https://bugzilla.samba.org/show_bug.cgi?id=14564). I’m not familiar enough with ‘net offlinejoin’ to give a proper answer to the problem though.
Comment 2 Guenther Deschner 2025-01-13 23:25:38 UTC
I can repdroduce it now and that hostname "client" is certainly not supposed to be added as part of one of the SPNs, This is a regression, if you revert commit 0e96092c1895ecb41d4064111566b4ada71fe457 it will work again. I'll look into providing a fix soon.
Comment 3 Samba QA Contact 2025-01-30 07:36:04 UTC
This bug was referenced in samba master:

f02a4002d5c3cfcd7f36b3bcf13310ffd155de90
6d4ad4d6824e81ef85dd924d550222dd6a322a15
062dc07e9b9c8e260548d0bca4d02819bdc60326
Comment 4 Guenther Deschner 2025-01-30 11:55:23 UTC
Created attachment 18545 [details]
patch from master for v4-21-test
Comment 5 Guenther Deschner 2025-01-30 11:57:50 UTC
No other backports required, issue exist only in v4-21 branch.
Comment 6 Andreas Schneider 2025-02-12 08:16:35 UTC
Comment on attachment 18545 [details]
patch from master for v4-21-test

lgtm
Comment 7 Andreas Schneider 2025-02-12 08:17:10 UTC
Jule, please apply the patch to 4.21. Thanks!
Comment 8 Jule Anger 2025-02-12 09:22:22 UTC
Pushed to autobuild-v4-21-test.
Comment 9 Samba QA Contact 2025-02-12 10:38:03 UTC
This bug was referenced in samba v4-21-test:

33edcf2cadb92a19c8e3a99effca178617f114da
6e4c35f800764bd633d50724c57aedb72ba99f33
512514bbae46f668e075b52af4f87bfcc148042b
Comment 10 Jule Anger 2025-02-12 13:08:49 UTC
Closing out bug report.

Thanks!
Comment 11 Samba QA Contact 2025-02-17 15:52:08 UTC
This bug was referenced in samba v4-21-stable (Release samba-4.21.4):

33edcf2cadb92a19c8e3a99effca178617f114da
6e4c35f800764bd633d50724c57aedb72ba99f33
512514bbae46f668e075b52af4f87bfcc148042b