samba - Mar 2018 - Unable to successfully join Samba 4.8.0 or Windows 2008 R2 to a Samba 4.6.7 DC

On Wed, 2018-03-14 at 16:55 -0400, Justin Foreman wrote:
> Note that I turned up to -d5 but the relevant output didn't seem to
change. I just cleaned up my obfuscation for clarity (all referenced DNs were
identical):
> 
> DRS replication add DN of aca72580-587e-4dab-adee-07a5f8027dfa is
CN=foo,OU=bar,DC=baz
> Failed to apply records: Failed to locally apply remote add of
CN=foo,OU=bar,DC=baz: ../lib/ldb/ldb_tdb/ldb_index.c:2012: Failed to re-index
servicePrincipalName in CN=foo,OU=bar,DC=baz - (null): Operations error
> Failed to commit objects: WERR_GEN_FAILURE
This suggests an issue creating an index for servicePrincipalName on
that record, which is odd.  Is there anything unusual about that
record?

Andrew Bartlett
-- 
Andrew Bartlett                       http://samba.org/~abartlet/
Authentication Developer, Samba Team  http://samba.org
Samba Developer, Catalyst IT          http://catalyst.net.nz/services/samba

No. If I delete that record, the process breaks in the same way on another
record in the same OU. I could try deleting all records in that OU to see if
it’s something wrong there.
> On Mar 15, 2018, at 2:14 AM, Andrew Bartlett <abartlet at samba.org>
wrote:
> 
> On Wed, 2018-03-14 at 16:55 -0400, Justin Foreman wrote:
>> Note that I turned up to -d5 but the relevant output didn't seem to
change. I just cleaned up my obfuscation for clarity (all referenced DNs were
identical):
>> 
>> DRS replication add DN of aca72580-587e-4dab-adee-07a5f8027dfa is
CN=foo,OU=bar,DC=baz
>> Failed to apply records: Failed to locally apply remote add of
CN=foo,OU=bar,DC=baz: ../lib/ldb/ldb_tdb/ldb_index.c:2012: Failed to re-index
servicePrincipalName in CN=foo,OU=bar,DC=baz - (null): Operations error
>> Failed to commit objects: WERR_GEN_FAILURE
> 
> This suggests an issue creating an index for servicePrincipalName on
> that record, which is odd.  Is there anything unusual about that
> record?
> 
> Andrew Bartlett
> -- 
> Andrew Bartlett                       http://samba.org/~abartlet/
> Authentication Developer, Samba Team  http://samba.org
> Samba Developer, Catalyst IT          http://catalyst.net.nz/services/samba
>

samba-tool dbcheck --cross-ncs --fix
Unable to determine the DomainSID, can not enforce uniqueness constraint on
local domainSIDs

Searching for dsServiceName in rootDSE failed: operations error at
../source4/dsdb/samdb/ldb_modules/rootdse.c:516
Failed to find our own NTDS Settings DN in the ldb!
Searching for dsServiceName in rootDSE failed: operations error at
../source4/dsdb/samdb/ldb_modules/rootdse.c:516
Failed to find our own NTDS Settings DN in the ldb!
ERROR(ldb): uncaught exception - operations error at
../source4/dsdb/samdb/ldb_modules/rootdse.c:516
  File
"/usr/local/samba/lib64/python2.7/site-packages/samba/netcmd/__init__.py",
line 176, in _run
    return self.run(*args, **kwargs)
  File
"/usr/local/samba/lib64/python2.7/site-packages/samba/netcmd/dbcheck.py",
line 135, in run
    reset_well_known_acls=reset_well_known_acls)
  File
"/usr/local/samba/lib64/python2.7/site-packages/samba/dbchecker.py",
line 95, in __init__
    self.ntds_dsa = ldb.Dn(samdb, samdb.get_dsServiceName())
  File
"/usr/local/samba/lib64/python2.7/site-packages/samba/samdb.py",
line 943, in get_dsServiceName
    res = self.search(base="", scope=ldb.SCOPE_BASE,
attrs=["dsServiceName"])


2018-03-15 13:48 GMT+03:00 Justin Foreman via samba <samba at
lists.samba.org>:
> No. If I delete that record, the process breaks in the same way on another
> record in the same OU. I could try deleting all records in that OU to see
> if it’s something wrong there.
>
> > On Mar 15, 2018, at 2:14 AM, Andrew Bartlett <abartlet at
samba.org> wrote:
> >
> > On Wed, 2018-03-14 at 16:55 -0400, Justin Foreman wrote:
> >> Note that I turned up to -d5 but the relevant output didn't
seem to
> change. I just cleaned up my obfuscation for clarity (all referenced DNs
> were identical):
> >>
> >> DRS replication add DN of aca72580-587e-4dab-adee-07a5f8027dfa is
> CN=foo,OU=bar,DC=baz
> >> Failed to apply records: Failed to locally apply remote add of
> CN=foo,OU=bar,DC=baz: ../lib/ldb/ldb_tdb/ldb_index.c:2012: Failed to
> re-index servicePrincipalName in CN=foo,OU=bar,DC=baz - (null): Operations
> error
> >> Failed to commit objects: WERR_GEN_FAILURE
> >
> > This suggests an issue creating an index for servicePrincipalName on
> > that record, which is odd.  Is there anything unusual about that
> > record?
> >
> > Andrew Bartlett
> > --
> > Andrew Bartlett                       http://samba.org/~abartlet/
> > Authentication Developer, Samba Team  http://samba.org
> > Samba Developer, Catalyst IT          http://catalyst.net.nz/
> services/samba
> >
>
>
> --
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba
>

After deleting the entire OU the failure happens on a different computer
account in a different OU and so on. I don't think that there's anything
unusual about my computer accounts.

On Thu, Mar 15, 2018 at 2:14 AM, Andrew Bartlett <abartlet at samba.org>
wrote:
> On Wed, 2018-03-14 at 16:55 -0400, Justin Foreman wrote:
> > Note that I turned up to -d5 but the relevant output didn't seem
to
> change. I just cleaned up my obfuscation for clarity (all referenced DNs
> were identical):
> >
> > DRS replication add DN of aca72580-587e-4dab-adee-07a5f8027dfa is
> CN=foo,OU=bar,DC=baz
> > Failed to apply records: Failed to locally apply remote add of
> CN=foo,OU=bar,DC=baz: ../lib/ldb/ldb_tdb/ldb_index.c:2012: Failed to
> re-index servicePrincipalName in CN=foo,OU=bar,DC=baz - (null): Operations
> error
> > Failed to commit objects: WERR_GEN_FAILURE
>
> This suggests an issue creating an index for servicePrincipalName on
> that record, which is odd.  Is there anything unusual about that
> record?
>
> Andrew Bartlett
> --
> Andrew Bartlett                       http://samba.org/~abartlet/
> Authentication Developer, Samba Team  http://samba.org
> Samba Developer, Catalyst IT          http://catalyst.net.nz/
> services/samba
>
>

On Thu, 2018-03-15 at 10:36 -0400, Justin Foreman wrote:
> After deleting the entire OU the failure happens on a different computer
account in a different OU and so on. I don't think that there's anything
unusual about my computer accounts.
Does it happen when you re-create the domain from scratch with 4.6 or
4.7 and join to 4.8?  What about a join of 4.8?  What if the source is
upgraded in place first?

Can you pin anything down in particular about it?

I would be very surprised if a 4.8 -> 4.8 join fails, as that is
extensively tested in the selftest, but the more clues we get and the
shorter the steps to reproduce the easier it will be to work this out. 

Thanks,

Andrew Bartlett

-- 
Andrew Bartlett                       http://samba.org/~abartlet/
Authentication Developer, Samba Team  http://samba.org
Samba Developer, Catalyst IT          http://catalyst.net.nz/services/samba