Bug 16028 - Error when using "password hash userPassword schemes = CryptSHA256 CryptSHA512" and enabling "smart card require for logon" on a user entry
Summary: Error when using "password hash userPassword schemes = CryptSHA256 CryptSHA51...
Status: NEW
Alias: None
Product: Samba 4.1 and newer
Classification: Unclassified
Component: AD: LDB/DSDB/SAMDB (show other bugs)
Version: 4.24.0rc*
Hardware: All All
: P5 normal (vote)
Target Milestone: ---
Assignee: Samba QA Contact
QA Contact: Samba QA Contact
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2026-03-11 11:09 UTC by Denis Cardon
Modified: 2026-03-11 21:24 UTC (History)
3 users (show)

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Denis Cardon 2026-03-11 11:09:57 UTC 
Enabling "smart card required for logon" make the account having a very long random password.

If one enabled "password hash userPassword schemes = CryptSHA256 CryptSHA512"  option in samba, then we get the error because crypt has a max password lenght limit lower than the password auto-generated.

{"timestamp": "2025-11-06T10:00:22.831585+0100", "type": "dsdbChange", "dsdbChange": {"version": {"major": 1, "minor": 0}, "statusCode": 1, "status": "Operations error", "operation": "Modify", "remoteAddress": null, "performedAsSystem": false, "userSid": "S-1-5-18", "dn": "CN=user1-smartcard,OU=Generique,OU=srp_hard,OU=users,OU=tranquilit,DC=test,DC=tranquil,DC=it", "transactionId": "47141652-c5d5-4db6-a71a-66c204c3535c", "sessionId": "940441d6-e9e2-446c-901b-f616cc76197a", "attributes": {"userAccountControl": {"actions": [{"action": "replace", "values": [{"value": "262656"}]}]}}}}

ERROR(ldb): Failed to modify user 'user1-smartcard':  - setup_primary_userPassword: generation of a CryptSHA256 password hash failed: (Password exceeds maximum length allowed for crypt() hashing)

Perhaps CryptSHA256 CryptSHA512 hash generation should be disabled for those accounts, since the user doesn't know the password, so CryptSHA256 hashes have no use.