samba - May 2015 - [AD/PDC] Logins with Spaces do not work

Hi,
I've migrated a Windows Server 2003 Active Directory to Samba and am
running both servers in parallel. Samba is run under Debian Linux, Version
is 4.1.17-Debian.

My Problem is, that Client Computers cannot log in when their Logins
contain Spaces. We were able to reproduce this by adding/removing spaces
from a username and making login fail/work with this. Umlauts are not a
problem.

Kerberos works with spaces (tested with kinit).

Any Idea how to solve this?

The error should look similar to this:

[2015/05/26 17:30:19.483033,  3]
../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: AS-REQ name\ surname at DOMAIN.LOCAL from
ipv4:192.168.12.128:49285 for
krbtgt/DOMAIN.LOCAL at DOMAIN.LOCAL
[2015/05/26 17:30:19.484667,  3]
../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: UNKNOWN -- name\ surname at SOMAIN.LOCAL: no such entry found in
hdb
[2015/05/26 17:30:19.484973,  3]
../source4/smbd/service_stream.c:66(stream_terminate_connection)
  Terminating connection - 'kdc_tcp_call_loop: tstream_read_pdu_blob_recv()
- NT_STATUS_CONNECTION_DISCONNECTED'
 s
[2015/05/26 17:30:19.485057,  3]
../source4/smbd/process_single.c:114(single_terminate)
  single_terminate: reason[kdc_tcp_call_loop: tstream_read_pdu_blob_recv()
- NT_STATUS_CONNECTION_DISCONNECTED]
[2015/05/26 17:30:19.485804,  3]
../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: AS-REQ name\ surname at DOMAIN.LOCAL from
ipv4:192.168.12.128:49286 for
krbtgt/DOMAIN.LOCAL at DOMAIN.LOCAL
[2015/05/26 17:30:19.487280,  3]
../source4/auth/kerberos/krb5_init_context.c:80(smb_krb5_debug_wrapper)
  Kerberos: UNKNOWN -- name\ surname at DOMAIN.LOCAL: no such entry found in
hdb
[2015/05/26 17:30:19.487589,  3]
../source4/smbd/service_stream.c:66(stream_terminate_connection)
  Terminating connection - 'kdc_tcp_call_loop: tstream_read_pdu_blob_recv()
- NT_STATUS_CONNECTION_DISCONNECTED'
[2015/05/26 17:30:19.487681,  3]
../source4/smbd/process_single.c:114(single_terminate)
  single_terminate: reason[kdc_tcp_call_loop: tstream_read_pdu_blob_recv()
- NT_STATUS_CONNECTION_DISCONNECTED]

cheers,
Andreas
-- 
GPG-Key-Id: DD436203
Github:     https://github.com/andreashappe
Linked-In:  http://at.linkedin.com/in/andreashappe

On Thu, May 28, 2015 at 04:46:49PM +0200, Andreas Happe
wrote:
> Hi,
> I've migrated a Windows Server 2003 Active Directory to Samba and am
> running both servers in parallel. Samba is run under Debian Linux, Version
> is 4.1.17-Debian.
> 
> My Problem is, that Client Computers cannot log in when their Logins
> contain Spaces. We were able to reproduce this by adding/removing spaces
> from a username and making login fail/work with this. Umlauts are not a
> problem.
> 
> Kerberos works with spaces (tested with kinit).
> 
> Any Idea how to solve this?
It's a really bad idea to have logins with spaces. It can
cause all sorts of security issues in all sorts of subtle
ways. Replace the spaces with '_' (underscoer).

Hi,

On Fri, May 29, 2015 at 7:17 PM, Jeremy Allison <jra at samba.org>
wrote:
>
> It's a really bad idea to have logins with spaces. It can
> cause all sorts of security issues in all sorts of subtle
> ways. Replace the spaces with '_' (underscoer).
>
The usernames are from the legacy system -- I didn't (and wouldn't) set
up
them in that way. I should be able to change them but have to check this
with the customer.

Problem is that I was able to convert the existing Windows 2003 Active
Directory (through the wiki documentation). If spaces within usernames are
not supported it would have been helpful if this would lead to an error
message during conversion or be at least mentioned in the documentation.

(also if samba's goal is to replace a windows ad server it would be nice if
it would support the same usernames).

cheers, Andreas
-- 
GPG-Key-Id: DD436203
Github:     https://github.com/andreashappe
Linked-In:  http://at.linkedin.com/in/andreashappe