Hi, in contrast to an AD DC a Samba DC currently allows to create computer objects with names (sAMAccountName) longer than 15 or 20 characters. E.g. samba-tool computer add 'THISNAMEISTOOLONG123THISNAMEISTOOLONG123THISNAMEISTOOLONG123$' creates a computer object with sAMAccountName: THISNAMEISTOOLONG123THISNAMEISTOOLONG123THISNAMEISTOOLONG123$ The same works with e.g. adcli adcli join -v --domain=samba.test --computer-name='THISNAMEISTOOLONG123THISNAMEISTOOLONG123THISNAMEISTOOLONG123' When running the same adcli command against an AD DC the request is rejected with 00000523: SysErr: DSID-031A1262, problem 22 (Invalid argument), data 0 if the given computer name is 20 characters or longer which is in agreement with e.g. https://learn.microsoft.com/en-us/windows/win32/adschema/a-samaccountname which says "must be 20 characters or fewer" Btw, `net ads join` complains if the name is too long as well. Is is expected that a Samba DC accepts computer objects where the sAMAccountName is longer then 15 or 20 characters? If yes, then maybe `net ads join` should accept them as well? If not, I think it would be good if the Samba DC will reject request with longer names like an AD DC does. bye, Sumit
Did you try this?: samba-tool computer add -H ldap://the-windows-dc I guess if adcli is using ldap it will be the same. It seems MS-ADA3 has been saying "less than 20 characters to support older clients" for as long as MS-ADA3 has existed, while the schema has always had a maximum length of 256.
(In reply to Douglas Bagnall from comment #1) Hi, yes, it shows the same error: # samba-tool computer add --use-kerberos=required -H ldap://dc.ad.test 'THISNAMEISTOOLONG123THISNAMEISTOOLONG123THISNAMEISTOOLONG123$' GENSEC backend 'gssapi_spnego' registered GENSEC backend 'gssapi_krb5' registered GENSEC backend 'gssapi_krb5_sasl' registered GENSEC backend 'spnego' registered GENSEC backend 'schannel' registered GENSEC backend 'ncalrpc_as_system' registered GENSEC backend 'sasl-EXTERNAL' registered GENSEC backend 'ntlmssp' registered GENSEC backend 'ntlmssp_resume_ccache' registered GENSEC backend 'http_basic' registered GENSEC backend 'http_ntlm' registered GENSEC backend 'http_negotiate' registered GENSEC backend 'krb5' registered GENSEC backend 'fake_gssapi_krb5' registered Starting GENSEC mechanism spnego Starting GENSEC submechanism gssapi_krb5 ERROR(ldb): Failed to add computer 'THISNAMEISTOOLONG123THISNAMEISTOOLONG123THISNAMEISTOOLONG123$': - LDAP error 80 LDAP_OTHER - <00000523: SysErr: DSID-031A1262, problem 22 (Invalid argument), data 0 > <> Test was run with Windows 2022. bye, Sumit
(In reply to Sumit Bose from comment #2) The fix is trivial, add something like these lines to computer.py (at line 257): # check length of computermame if len(computername) > 20: raise CommandError('Computername "%s" is too long' % computername)
Hi, this would fix the tool, but wouldn't it be better to reject long names on the server side like AD does? bye, Sumit
here, https://learn.microsoft.com/en-us/archive/technet-wiki/11216.active-directory-requirements-for-creating-objects#objects-with-samaccountname-attribute sAMAccountName is said to be limited to "20 characters for user objects and 16 characters for computer objects".
(In reply to Douglas Bagnall from comment #5) Typical Microsoft, 20 characters for a user, but only 16 for a computer, but then a computer is also a user. From the way I read it, it is the tool that is being used to create the user or computer that needs to check the sAMAccountName length, not the server.
(In reply to Rowland Penny from comment #6) Hi, as I mentioned in the description an AD DC is rejecting a name too long, so at least AD is doing server side checking. bye, Sumit