samba - Feb 2020 - Mac OS and interpretation of @ in a username. Ex user@mds.xyz doesn't work on Mac OS but does on Win 10

On 2/21/2020 2:24 PM, Rowland penny via samba wrote:
> On 21/02/2020 19:06, torch via samba wrote:
>> Am I missing something?? I don?t see where you are using the ?@? 
>> symbol anywhere.
>> Mac is probably interpreting the parameters ?valid users? and ?write 
>> list" (correctly, I think ;-) as a LIST of 3 users: joe, at,
mds.xyz
>> or bob, at, mds.xyz.
>>
>> torch
>
> My question would be 'why is the OP trying to login using what appears 
> to be a UPN to something (standalone server) that doesn't use kerberos
?'
>
> More info required.
>
> Rowland
>
>
>
Valid question.


The target server, let's call it nfs03.nix.mds.xyz shares a path via 
both CIFS and NFS. The said server, nfs03, is Kerberized via SSSD to a 
set of FreeIPA servers.? The FreeIPA servers in turn have a trust with 
the AD DC domain mds.xyz .

nfs03 <-> FreeIPA <-> AD DC

So joe at mds.xyz is an AD user presented via FreeIPA on nfs03.

[root at nfs03 samba]# id joe at mds.xyz
uid=166602204(joe at mds.xyz) gid=166602204(joe at mds.xyz) 
groups=166602204(joe at mds.xyz),1843300089(domain-users)
[root at nfs03 samba]#

Running

id joe

doesn't work of course.? Doesn't exist.?? mds.xyz is the AD domain.? 
There are other domains and other users on those different domains, such 
as drew at nix.mds.xyz, who doesn't exist in AD and is only local to Linux 
servers.? We also need to distinguish a user1 at mds.xyz vs a 
user1 at nix.mds.xyz for example. So need to use the domain, at least for now.

Using joe won't work in samba since it checks the OS to verify the user 
exists.? So need to use joe at mds.xyz however Samba, rightly so, splits 
this string up into what it things is the user, 'joe' and host 
'mds.xyz'.? I'm looking for a way to suppress this so it doesn't
split
up joe at mds.xyz .


"Sadly this really appears to be is a client issue.  You see there the
string Samba gets, so by the time Samba tries the process it the @ is
already interpreted and the string split.

Sorry!

Andrew Bartlett"

Yeah, wondering if there is a way to tell Samba NOT to split that up and treat
joe at mds.xyz as a single user.  This works fine in Win 10 so I agree, it's
probably a client SMB configuration issue but would like to know exactly what
that config issue is.

-- 
Thx,
TK.

On 2/21/2020 6:10 PM, TomK via samba wrote:
> On 2/21/2020 2:24 PM, Rowland penny via samba wrote:
>> On 21/02/2020 19:06, torch via samba wrote:
>>> Am I missing something?? I don?t see where you are using the ?@? 
>>> symbol anywhere.
>>> Mac is probably interpreting the parameters ?valid users? and
?write
>>> list" (correctly, I think ;-) as a LIST of 3 users: joe, at,
mds.xyz
>>> or bob, at, mds.xyz.
>>>
>>> torch
>>
>> My question would be 'why is the OP trying to login using what
appears
>> to be a UPN to something (standalone server) that doesn't use
kerberos ?'
>>
>> More info required.
>>
>> Rowland
>>
>>
>>
> Valid question.
> 
> 
> The target server, let's call it nfs03.nix.mds.xyz shares a path via 
> both CIFS and NFS. The said server, nfs03, is Kerberized via SSSD to a 
> set of FreeIPA servers.? The FreeIPA servers in turn have a trust with 
> the AD DC domain mds.xyz .
> 
> nfs03 <-> FreeIPA <-> AD DC
> 
> So joe at mds.xyz is an AD user presented via FreeIPA on nfs03.
> 
> [root at nfs03 samba]# id joe at mds.xyz
> uid=166602204(joe at mds.xyz) gid=166602204(joe at mds.xyz) 
> groups=166602204(joe at mds.xyz),1843300089(domain-users)
> [root at nfs03 samba]#
> 
> Running
> 
> id joe
> 
> doesn't work of course.? Doesn't exist.?? mds.xyz is the AD domain.
> There are other domains and other users on those different domains, such 
> as drew at nix.mds.xyz, who doesn't exist in AD and is only local to
Linux
> servers.? We also need to distinguish a user1 at mds.xyz vs a 
> user1 at nix.mds.xyz for example. So need to use the domain, at least for
now.
> 
> Using joe won't work in samba since it checks the OS to verify the user
> exists.? So need to use joe at mds.xyz however Samba, rightly so, splits 
> this string up into what it things is the user, 'joe' and host 
> 'mds.xyz'.? I'm looking for a way to suppress this so it
doesn't split
> up joe at mds.xyz .
Therefore, yes, UPN.
> 
> 
> "Sadly this really appears to be is a client issue.? You see there the
> string Samba gets, so by the time Samba tries the process it the @ is
> already interpreted and the string split.
> 
> Sorry!
> 
> Andrew Bartlett"
> 
> Yeah, wondering if there is a way to tell Samba NOT to split that up and 
> treat joe at mds.xyz as a single user.? This works fine in Win 10 so I 
> agree, it's probably a client SMB configuration issue but would like to
> know exactly what that config issue is.
> 
  + or what paramaters I could change to ensure the string isn't split up.


-- 
Thx,
TK.

On Fri, 2020-02-21 at 20:48 -0500, TomK wrote:
> 
> 
> > 
> > "Sadly this really appears to be is a client issue.  You see
there the
> > string Samba gets, so by the time Samba tries the process it the @ is
> > already interpreted and the string split.
> > 
> > Sorry!
> > 
> > Andrew Bartlett"
> > 
> > Yeah, wondering if there is a way to tell Samba NOT to split that up
and
> > treat joe at mds.xyz as a single user.  This works fine in Win 10 so I
> > agree, it's probably a client SMB configuration issue but would
like to
> > know exactly what that config issue is.
> > 
> 
>   + or what paramaters I could change to ensure the string isn't split
up.
You can't change it on the Samba side, you could try logging in as
SERVER\joe at mds.xyz or see if you can re-map it server-side with the
various username map options.

You need to realise that the protocol has a domain field and a username
one.  Well behaved clients know that user at realm style usernames need to
all be in the username field, not split up client-side (and left to the
DC to interpret), but even Samba got this wrong for quite some time. 

I hope this helps,

Andrew Bartlett

-- 
Andrew Bartlett                       http://samba.org/~abartlet/
Authentication Developer, Samba Team  http://samba.org
Samba Developer, Catalyst IT          http://catalyst.net.nz/services/samba

On 21/02/2020 23:10, TomK wrote:
> On 2/21/2020 2:24 PM, Rowland penny via samba wrote:
>> On 21/02/2020 19:06, torch via samba wrote:
>>> Am I missing something?? I don?t see where you are using the ?@? 
>>> symbol anywhere.
>>> Mac is probably interpreting the parameters ?valid users? and
?write
>>> list" (correctly, I think ;-) as a LIST of 3 users: joe, at,
mds.xyz
>>> or bob, at, mds.xyz.
>>>
>>> torch
>>
>> My question would be 'why is the OP trying to login using what 
>> appears to be a UPN to something (standalone server) that doesn't
use
>> kerberos ?'
>>
>> More info required.
>>
>> Rowland
>>
>>
>>
> Valid question.
>
>
> The target server, let's call it nfs03.nix.mds.xyz shares a path via 
> both CIFS and NFS. The said server, nfs03, is Kerberized via SSSD to a 
> set of FreeIPA servers.? The FreeIPA servers in turn have a trust with 
> the AD DC domain mds.xyz .
>
> nfs03 <-> FreeIPA <-> AD DC
>
> So joe at mds.xyz is an AD user presented via FreeIPA on nfs03.
>
> [root at nfs03 samba]# id joe at mds.xyz
> uid=166602204(joe at mds.xyz) gid=166602204(joe at mds.xyz) 
> groups=166602204(joe at mds.xyz),1843300089(domain-users)
> [root at nfs03 samba]#
>
> Running
>
> id joe
>
> doesn't work of course.? Doesn't exist.?? mds.xyz is the AD
domain.?
> There are other domains and other users on those different domains, 
> such as drew at nix.mds.xyz, who doesn't exist in AD and is only local
to
> Linux servers.? We also need to distinguish a user1 at mds.xyz vs a 
> user1 at nix.mds.xyz for example. So need to use the domain, at least for 
> now.
>
> Using joe won't work in samba since it checks the OS to verify the 
> user exists.? So need to use joe at mds.xyz however Samba, rightly so, 
> splits this string up into what it things is the user, 'joe' and
host
> 'mds.xyz'.? I'm looking for a way to suppress this so it
doesn't split
> up joe at mds.xyz .
>
Using 'joe at mds.xyz' isn't going to work against a standalone
samba
server (well, not unless you create a user called joe at mds.xyz on it) 
because it isn't a domain member.

Rowland