Bug 1703 - for netbios aliases samba should create servicePrincipleName entries
Summary: for netbios aliases samba should create servicePrincipleName entries
Alias: None
Product: Samba 4.1 and newer
Classification: Unclassified
Component: Winbind (show other bugs)
Version: 4.1.13
Hardware: All All
: P3 normal (vote)
Target Milestone: ---
Assignee: Karolin Seeger
QA Contact: Samba QA Contact
: 9129 (view as bug list)
Depends on:
Reported: 2004-09-01 06:49 UTC by Tom Lackemann
Modified: 2016-05-11 11:43 UTC (History)
4 users (show)

See Also:

Add method to update servicePrincipalName attributes in AD (8.76 KB, patch)
2004-09-01 06:56 UTC, Tom Lackemann
no flags Details
git-am fix for 4.4.next, 4.3.next. (2.83 KB, patch)
2016-05-04 21:50 UTC, Jeremy Allison
slow: review+

Note You need to log in before you can comment on or make changes to this bug.
Description Tom Lackemann 2004-09-01 06:49:13 UTC
With netbios aliases defined in the smb.conf, a client can attach to a share 
using the alias machine name but is unable to obtain a ticket from the KDC. The 
client then falls back to NTLMSSP as the authentication method.
The TGS request for the cifs service using the netbios name instance fails with 
the error KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN. This is because the only 
servicePrincipalName attributes assigned within libads/ldap.c:
ads_add_machine_acct() are for the actual machine name. If this is extended to 
included additional entries, HOST/<netbiosN> and CIFS/netbiosN>, for each on N 
netbios aliases then the client is able to obtain and make use of a kerberos 
ticket during the session setup.
Comment 1 Tom Lackemann 2004-09-01 06:56:47 UTC
Created attachment 629 [details]
Add method to update servicePrincipalName attributes in AD

Create additional servicePrincipalName attributes of HOST/ and CIFS/ for each
netbios alias name in smb.conf. Also, added simple ads command to the net
utility "net ads updatejoin" to refresh these attributes to current "netbios
aliases" list.
Comment 2 Stefan Metzmacher 2010-04-26 03:38:20 UTC
If it's still broken in 3.5, please reopen.
3.0 isn't supported anymore.
Comment 3 Volker Lendecke 2010-04-26 03:40:57 UTC
Bugs with patches should be kept open or rejected with a reason.
Comment 4 Björn Jacke 2014-11-26 08:45:30 UTC
still, with netbios aliased defined samba does not add servicePrincipleName entries in AD for the aliases. Metze, can you have a look at the patch?
Comment 5 Björn Jacke 2015-12-07 13:50:54 UTC
*** Bug 9129 has been marked as a duplicate of this bug. ***
Comment 6 Jeremy Allison 2016-05-04 21:50:15 UTC
Created attachment 12069 [details]
git-am fix for 4.4.next, 4.3.next.
Comment 7 Ralph Böhme 2016-05-04 22:11:30 UTC
Reassigning to Karolin for inclusion in 4.3 and 4.4.
Comment 8 Karolin Seeger 2016-05-09 08:41:36 UTC
(In reply to Ralph Böhme from comment #7)
Pushed to autobuild-v4-[4|3]-test.
Comment 9 Karolin Seeger 2016-05-11 11:43:59 UTC
(In reply to Karolin Seeger from comment #8)
Pushed to both branches.
Closing out bug report.