Bug 1703 - for netbios aliases samba should create servicePrincipleName entries
Summary: for netbios aliases samba should create servicePrincipleName entries
Status: RESOLVED FIXED
Alias: None
Product: Samba 4.1 and newer
Classification: Unclassified
Component: Winbind (show other bugs)
Version: 4.1.13
Hardware: All All
: P3 normal (vote)
Target Milestone: ---
Assignee: Karolin Seeger
QA Contact: Samba QA Contact
URL:
Keywords:
: 9129 (view as bug list)
Depends on:
Blocks:
 
Reported: 2004-09-01 06:49 UTC by Tom Lackemann
Modified: 2016-05-11 11:43 UTC (History)
4 users (show)

See Also:

Attachments
Add method to update servicePrincipalName attributes in AD (8.76 KB, patch)
2004-09-01 06:56 UTC, Tom Lackemann 		no flags Details
git-am fix for 4.4.next, 4.3.next. (2.83 KB, patch)
2016-05-04 21:50 UTC, Jeremy Allison 		slow: review+
Details
Show Obsolete (1) View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Tom Lackemann 2004-09-01 06:49:13 UTC 
With netbios aliases defined in the smb.conf, a client can attach to a share 
using the alias machine name but is unable to obtain a ticket from the KDC. The 
client then falls back to NTLMSSP as the authentication method.
The TGS request for the cifs service using the netbios name instance fails with 
the error KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN. This is because the only 
servicePrincipalName attributes assigned within libads/ldap.c:
ads_add_machine_acct() are for the actual machine name. If this is extended to 
included additional entries, HOST/<netbiosN> and CIFS/netbiosN>, for each on N 
netbios aliases then the client is able to obtain and make use of a kerberos 
ticket during the session setup.
Comment 1 Tom Lackemann 2004-09-01 06:56:47 UTC 
Created attachment 629 [details]
Add method to update servicePrincipalName attributes in AD

Create additional servicePrincipalName attributes of HOST/ and CIFS/ for each
netbios alias name in smb.conf. Also, added simple ads command to the net
utility "net ads updatejoin" to refresh these attributes to current "netbios
aliases" list.
Comment 2 Stefan Metzmacher 2010-04-26 03:38:20 UTC 
If it's still broken in 3.5, please reopen.
3.0 isn't supported anymore.
Comment 3 Volker Lendecke 2010-04-26 03:40:57 UTC 
Bugs with patches should be kept open or rejected with a reason.
Comment 4 Björn Jacke 2014-11-26 08:45:30 UTC 
still, with netbios aliased defined samba does not add servicePrincipleName entries in AD for the aliases. Metze, can you have a look at the patch?
Comment 5 Björn Jacke 2015-12-07 13:50:54 UTC 
*** Bug 9129 has been marked as a duplicate of this bug. ***
Comment 6 Jeremy Allison 2016-05-04 21:50:15 UTC 
Created attachment 12069 [details]
git-am fix for 4.4.next, 4.3.next.
Comment 7 Ralph Böhme 2016-05-04 22:11:30 UTC 
Reassigning to Karolin for inclusion in 4.3 and 4.4.
Comment 8 Karolin Seeger 2016-05-09 08:41:36 UTC 
(In reply to Ralph Böhme from comment #7)
Pushed to autobuild-v4-[4|3]-test.
Comment 9 Karolin Seeger 2016-05-11 11:43:59 UTC 
(In reply to Karolin Seeger from comment #8)
Pushed to both branches.
Closing out bug report.

Thanks!