samba - May 2020 - Failed to commit objects: DOS code 0x000021bf attempting to add DC to Zentyal 3.2 domain (samba 4.1.7)

----- On May 25, 2020, at 5:22 PM, Andrew Bartlett abartlet at samba.org wrote:
> On Mon, 2020-05-25 at 10:26 -0400, Rich Webb via samba wrote:
>> ----- On May 24, 2020, at 11:30 PM, samba samba at lists.samba.org
>> wrote:
>> 
>> > On Sun, 2020-05-24 at 23:01 -0400, Rich Webb via samba wrote:
>> > > Hello,
>> > > 
>> > > I'm attempting to join a new samba 4 server version
4.12.3 to an
>> > > existing samba 4 domain running on Zentyal 3.2 (samba version
>> > > 4.1.7).
>> > > 
>> > > I'm getting the error in the subject line: Failed to
commit
>> > > objects:
>> > > DOS code 0x000021bf
>> > 
>> > If you turn up the log level is there more information?  (eg -d4)?
>> > 
>> > But yes, Samba 4.1.7 is before we fixed a number of issues in the
>> > replication protocol, and I'm not surprised you have issues.
>> > 
>> > Andrew Bartlett
>> > 
>> > --
>> 
>> Also I am currently using 4.10.15 as I tried to backrev to a version
>> that would join properly. The -d4 produced a ton of output... Let me
>> know if you need more but here is the final pieces that would likely
>> give a clue.  I have no idea what mail-fs1 is.. that may have been an
>> old host name possibly left hanging around in DNS?  The DC's name
is
>> fs1:
>> 
>> Missing parent while attempting to apply records: No parent with GUID
>> fe34e0f7-7c0d-415d-af6e-d564e2b1cdb4 found for object remotely known
>> as CN=mail-fs1,OU=Kerberos,DC=tca,DC=local
>> 
> 
>> ERROR(runtime): uncaught exception - (8460, "Failed to process
>> 'chunk' of DRS replicated objects:
WERR_DS_DRA_MISSING_PARENT")
> 
> Thanks, this gives us the information we need.
> 
> What has happened here is that Samba 4.1, indeed all Samba versions
> sort the returned results by the order of last change.  However, before
> 4.4 did not know about the GET_ANC flag, to sort the results tree-wise,
> which we need in this situation, so we can find the parent objects
> before we replicate the children.
> 
> This means that, to replicate from Samba 4.1, you need to carefully
> change a unimportant attribute in all the child objects of OU=Kerberos
> 'later' than the last change of OU=Kerberos itself.
> 
> The only other alternative is an in-place upgrade, so the sending Samba
> version gains this capability.
> 
> If this makes sense, then have a go.  Otherwise (or if this is a large
> or critical network) this might be a job for a commercial support
> provider who will probably write a script to assist.
> 
> How big is your domain?
> 
> (Dreaming, with unlimited development time I would love to have Samba
> cope with this natively, by sorting the results on the new DC and using
> REPL_SINGLE_OBJECT to fill in the gaps, but this is a much bigger
> task).
> 
> I hope this gives you a way forward.
> 
> Andrew Bartlett
Not a huge domain - maybe 8 users or so.  When you say in place upgrade are you
talking about upgrading Zentyal so that Samba gets upgraded to at least 4.5 or
above?

Rich

On Mon, 2020-05-25 at 17:45 -0400, Rich Webb via samba
wrote:
> ----- On May 25, 2020, at 5:22 PM, Andrew Bartlett abartlet at samba.org
>  wrote:
> 
> > On Mon, 2020-05-25 at 10:26 -0400, Rich Webb via samba wrote:
> > > ----- On May 24, 2020, at 11:30 PM, samba samba at
lists.samba.org
> > > wrote:
> > > 
> > > > On Sun, 2020-05-24 at 23:01 -0400, Rich Webb via samba
wrote:
> > > > > Hello,
> > > > > 
> > > > > I'm attempting to join a new samba 4 server version
4.12.3 to
> > > > > an
> > > > > existing samba 4 domain running on Zentyal 3.2 (samba
version
> > > > > 4.1.7).
> > > > > 
> > > > > I'm getting the error in the subject line: Failed
to commit
> > > > > objects:
> > > > > DOS code 0x000021bf
> > > > 
> > > > If you turn up the log level is there more information?  (eg
> > > > -d4)?
> > > > 
> > > > But yes, Samba 4.1.7 is before we fixed a number of issues
in
> > > > the
> > > > replication protocol, and I'm not surprised you have
issues.
> > > > 
> > > > Andrew Bartlett
> > > > 
> > > > --
> > > 
> > > Also I am currently using 4.10.15 as I tried to backrev to a
> > > version
> > > that would join properly. The -d4 produced a ton of output... Let
> > > me
> > > know if you need more but here is the final pieces that would
> > > likely
> > > give a clue.  I have no idea what mail-fs1 is.. that may have
> > > been an
> > > old host name possibly left hanging around in DNS?  The DC's
name
> > > is
> > > fs1:
> > > 
> > > Missing parent while attempting to apply records: No parent with
> > > GUID
> > > fe34e0f7-7c0d-415d-af6e-d564e2b1cdb4 found for object remotely
> > > known
> > > as CN=mail-fs1,OU=Kerberos,DC=tca,DC=local
> > > 
> > > ERROR(runtime): uncaught exception - (8460, "Failed to
process
> > > 'chunk' of DRS replicated objects:
WERR_DS_DRA_MISSING_PARENT")
> > 
> > Thanks, this gives us the information we need.
> > 
> > What has happened here is that Samba 4.1, indeed all Samba versions
> > sort the returned results by the order of last change.  However,
> > before
> > 4.4 did not know about the GET_ANC flag, to sort the results tree-
> > wise,
> > which we need in this situation, so we can find the parent objects
> > before we replicate the children.
> > 
> > This means that, to replicate from Samba 4.1, you need to carefully
> > change a unimportant attribute in all the child objects of
> > OU=Kerberos
> > 'later' than the last change of OU=Kerberos itself.
> > 
> > The only other alternative is an in-place upgrade, so the sending
> > Samba
> > version gains this capability.
> > 
> > If this makes sense, then have a go.  Otherwise (or if this is a
> > large
> > or critical network) this might be a job for a commercial support
> > provider who will probably write a script to assist.
> > 
> > How big is your domain?
> > 
> > (Dreaming, with unlimited development time I would love to have
> > Samba
> > cope with this natively, by sorting the results on the new DC and
> > using
> > REPL_SINGLE_OBJECT to fill in the gaps, but this is a much bigger
> > task).
> > 
> > I hope this gives you a way forward.
> > 
> > Andrew Bartlett
> 
> Not a huge domain - maybe 8 users or so.  When you say in place
> upgrade are you talking about upgrading Zentyal so that Samba gets
> upgraded to at least 4.5 or above?
Yes, or Samba on the Zentyal appliance - even if built manually and
just pointed at the right directories (after forcefully disabling the
installed Samba).  I'm not sure how well a modern Samba would build
there, you might have to build 4.5.

But if just 8 users, the simplest approach might be to just make your
domain as 'flat' as possible then try replication again, and fix it up
later. 

All the best,

Andrew Bartlett

-- 
Andrew Bartlett                       https://samba.org/~abartlet/
Authentication Developer, Samba Team  https://samba.org
Samba Developer, Catalyst IT          
https://catalyst.net.nz/services/samba

On 25/05/2020 23:08, Andrew Bartlett via samba wrote:
> On Mon, 2020-05-25 at 17:45 -0400, Rich Webb via samba wrote:
>> ----- On May 25, 2020, at 5:22 PM, Andrew Bartlett abartlet at
samba.org
>>   wrote:
>>
>>> On Mon, 2020-05-25 at 10:26 -0400, Rich Webb via samba wrote:
>>>> ----- On May 24, 2020, at 11:30 PM, samba samba at
lists.samba.org
>>>> wrote:
>>>>
>>>>> On Sun, 2020-05-24 at 23:01 -0400, Rich Webb via samba
wrote:
>>>>>> Hello,
>>>>>>
>>>>>> I'm attempting to join a new samba 4 server version
4.12.3 to
>>>>>> an
>>>>>> existing samba 4 domain running on Zentyal 3.2 (samba
version
>>>>>> 4.1.7).
>>>>>>
>>>>>> I'm getting the error in the subject line: Failed
to commit
>>>>>> objects:
>>>>>> DOS code 0x000021bf
>>>>> If you turn up the log level is there more information? 
(eg
>>>>> -d4)?
>>>>>
>>>>> But yes, Samba 4.1.7 is before we fixed a number of issues
in
>>>>> the
>>>>> replication protocol, and I'm not surprised you have
issues.
>>>>>
>>>>> Andrew Bartlett
>>>>>
>>>>> --
>>>> Also I am currently using 4.10.15 as I tried to backrev to a
>>>> version
>>>> that would join properly. The -d4 produced a ton of output...
Let
>>>> me
>>>> know if you need more but here is the final pieces that would
>>>> likely
>>>> give a clue.  I have no idea what mail-fs1 is.. that may have
>>>> been an
>>>> old host name possibly left hanging around in DNS?  The
DC's name
>>>> is
>>>> fs1:
>>>>
>>>> Missing parent while attempting to apply records: No parent
with
>>>> GUID
>>>> fe34e0f7-7c0d-415d-af6e-d564e2b1cdb4 found for object remotely
>>>> known
>>>> as CN=mail-fs1,OU=Kerberos,DC=tca,DC=local
>>>>
>>>> ERROR(runtime): uncaught exception - (8460, "Failed to
process
>>>> 'chunk' of DRS replicated objects:
WERR_DS_DRA_MISSING_PARENT")
>>> Thanks, this gives us the information we need.
>>>
>>> What has happened here is that Samba 4.1, indeed all Samba versions
>>> sort the returned results by the order of last change.  However,
>>> before
>>> 4.4 did not know about the GET_ANC flag, to sort the results tree-
>>> wise,
>>> which we need in this situation, so we can find the parent objects
>>> before we replicate the children.
>>>
>>> This means that, to replicate from Samba 4.1, you need to carefully
>>> change a unimportant attribute in all the child objects of
>>> OU=Kerberos
>>> 'later' than the last change of OU=Kerberos itself.
>>>
>>> The only other alternative is an in-place upgrade, so the sending
>>> Samba
>>> version gains this capability.
>>>
>>> If this makes sense, then have a go.  Otherwise (or if this is a
>>> large
>>> or critical network) this might be a job for a commercial support
>>> provider who will probably write a script to assist.
>>>
>>> How big is your domain?
>>>
>>> (Dreaming, with unlimited development time I would love to have
>>> Samba
>>> cope with this natively, by sorting the results on the new DC and
>>> using
>>> REPL_SINGLE_OBJECT to fill in the gaps, but this is a much bigger
>>> task).
>>>
>>> I hope this gives you a way forward.
>>>
>>> Andrew Bartlett
>> Not a huge domain - maybe 8 users or so.  When you say in place
>> upgrade are you talking about upgrading Zentyal so that Samba gets
>> upgraded to at least 4.5 or above?
> Yes, or Samba on the Zentyal appliance - even if built manually and
> just pointed at the right directories (after forcefully disabling the
> installed Samba).  I'm not sure how well a modern Samba would build
> there, you might have to build 4.5.
>
> But if just 8 users, the simplest approach might be to just make your
> domain as 'flat' as possible then try replication again, and fix it
up
> later.
>
> All the best,
>
> Andrew Bartlett
>
Sorry Andrew, but I do not agree, in my opinion the best option would be 
to start again. With only 8 users (and presumably a similar number of 
computers), it will be quicker and easier to create a new domain.

Zentyal 3.2 is based on Ubuntu 12.04, so I am unsure whether 4.5 will 
build on it, even if it does, there is is still the problem of the early 
dns schema.

The amount of work involved in getting the Zentyal domain upgraded will 
be far more than setting up a new domain.

Rowland