samba - Apr 2004 - Authentication issue still exists in 3.0.3

I wrote about this problem more than a week ago, but got no response.  I 
upgraded to 3.0.3 hoping this issue would go away, but it hasn't.

I am seeing the problem running Samba 3.0.2a or 3.0.3 on both Solaris 8 
and RH Linux ES3.  This problem was not present in Samba 2.2.8a.

The Samba servers are member servers of an Active Directory domain, and 
all other file and print sharing is working well.  Global section of 
smb.conf included below.  I am not running winbindd.

On a Windows XP client that hasn't been added to Active Directory yet, 
domain credentials will not authenticate to the Samba server if the 
credentials are given in the form username@mydomain.com.  The same 
operation against a Windows server works fine.  If the credentials are 
supplied in other forms to the Samba server, they will work (e.g., 
mydomain\username, mydomain.com\username).  If the Windows XP client is 
added to the AD domain, the credentials will work in any of the formats.

 From an auth:10 debug, it appears Samba is using the entire 
username@mydomain.com string as the username rather than breaking it 
into username and domain components.  I have a "log level = 3 auth:10"
log file available on request.

Thank you very much for taking a look at this.

[global]
       realm = MYDOMAIN.COM
       security = ADS
       netbios name = SERVER1
       password server = ADPS1.MYDOMAIN.COM,ADPS2.MYDOMAIN.COM
       interfaces = 166.122.99.1/20 166.122.99.50/20
       encrypt passwords = Yes
       map to guest = Bad User
       username map = /usr/local/samba/lib/users.map
       host msdfs = Yes
       time server = Yes
       deadtime = 5
       socket options = TCP_NODELAY
       local master = No
       dns proxy = No
       workgroup = MYDOMAIN
       name resolve order = host wins bcast
       wins server = 166.122.99.135 166.122.15.103

-- 
---------------------------------------------------------------------
Jay D. Anderson                         John Deere Davenport Works
Jay (at) DW.Deere.com                        P.O. Box 4198
Phone: 563.388.4268 Fax: 563.388.4159   Davenport, Iowa 52808

On Sat, 2004-05-01 at 03:23, Jay D. Anderson wrote:
> I wrote about this problem more than a week ago, but got no response.  I 
> upgraded to 3.0.3 hoping this issue would go away, but it hasn't.
> 
> I am seeing the problem running Samba 3.0.2a or 3.0.3 on both Solaris 8 
> and RH Linux ES3.  This problem was not present in Samba 2.2.8a.
> 
> The Samba servers are member servers of an Active Directory domain, and 
> all other file and print sharing is working well.  Global section of 
> smb.conf included below.  I am not running winbindd.
> 
> On a Windows XP client that hasn't been added to Active Directory yet, 
> domain credentials will not authenticate to the Samba server if the 
> credentials are given in the form username@mydomain.com.  The same 
> operation against a Windows server works fine.  If the credentials are 
> supplied in other forms to the Samba server, they will work (e.g., 
> mydomain\username, mydomain.com\username).  If the Windows XP client is 
> added to the AD domain, the credentials will work in any of the formats.
> 
>  From an auth:10 debug, it appears Samba is using the entire 
> username@mydomain.com string as the username rather than breaking it 
> into username and domain components.  I have a "log level = 3
auth:10"
> log file available on request.
Samba simply does not know how to handle this username format.  If you
forward me that log, I can look at it, but is there any urgent reason
why you cannot use the more traditional username formats?

Also, please file a bug on bugzilla.samba.org

(I intend to fix it, it's just a matter of what urgency this is, if
there is a good workaround).

Andrew Bartlett

-- 
Andrew Bartlett                                 abartlet@pcug.org.au
Manager, Authentication Subsystems, Samba Team  abartlet@samba.org
Student Network Administrator, Hawker College   abartlet@hawkerc.net
http://samba.org     http://build.samba.org     http://hawkerc.net
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
Url :
http://lists.samba.org/archive/samba/attachments/20040501/e05f99b2/attachment.bin