Bug 8393 - Allow domain == realm in provision
Summary: Allow domain == realm in provision
Status: REOPENED
Alias: None
Product: Samba 4.0
Classification: Unclassified
Component: Other (show other bugs)
Version: unspecified
Hardware: All All
: P5 normal (vote)
Target Milestone: ---
Assignee: Andrew Bartlett
QA Contact: samba4-qa@samba.org
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2011-08-22 09:28 UTC by Arvid Requate
Modified: 2013-04-09 08:00 UTC (History)
1 user (show)

See Also:


Attachments
Allow realm equal windows domain (839 bytes, patch)
2011-08-22 09:48 UTC, Arvid Requate
no flags Details
proposed, but unsted patch to fix this in a different way (2.53 KB, patch)
2013-04-05 01:16 UTC, Andrew Bartlett
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description Arvid Requate 2011-08-22 09:28:21 UTC
Currently the provision code does not allow using realms (and DNS domainnames) that do not contain a dot. The error message is:

 ProvisioningError: guess_names: Realm 'LOCAL' must not be equal to short domain
 name 'LOCAL'!

The origin of this error message is a check to assure realm != (windows) domain. This check seems to be obsolete.
Comment 1 Arvid Requate 2011-08-22 09:48:29 UTC
Created attachment 6796 [details]
Allow realm equal windows domain
Comment 2 Andrew Bartlett 2011-08-22 09:55:54 UTC
Do you have a particular use case that requires this?

This is an important protection to first-time users, and I would be very hesitant to allow this kind of possibly-valid but very unusual configuration.  

If it really must be allowed for a real-world use case, I would suggest that it be behind a '--i-really-know-what-i-am-doing', because it will break so many other things (assumptions about AD domains being proper DNS names are embedded in many applications that use AD). 

Andrew Bartlett
Comment 3 Arvid Requate 2011-08-22 10:01:45 UTC
Is it the case that DNS domains without a dot are invalid?
Comment 4 Andrew Bartlett 2011-08-22 10:22:39 UTC
I've heard rumour of domains where the realm and the netbios domain name are identical, either with or without dots. 

However, it's a really bad idea, and I'm keen to make it hard to create such domains with Samba.  If someone can make these domains with windows (ie, this part needs testing), then we need to be able to make them with Samba.  I just want it to be hard to do.
Comment 5 Arvid Requate 2011-08-22 11:49:38 UTC
Your are right, at least 2k8R2 dcpromo enforces a dot. We probably will use the same policy in UCS, to avoid compatibility issus, so I would at least cancel my request.
Comment 6 Matthias Dieter Wallnöfer 2011-09-12 17:52:51 UTC
Arvid, should I close your request with "WONTFIX"?
Comment 7 Arvid Requate 2011-09-19 11:15:13 UTC
Ok.
Comment 8 Andrew Bartlett 2013-04-05 01:16:44 UTC
Created attachment 8730 [details]
proposed, but unsted patch to fix this in a different way

This patch allows one specific case:  Where we join an existing domain that has domain == realm, we should allow it.