I have some serious problems with samba 3.0.21c ...
Samba is configured "security = ads" and I am also using winbind so
that
the AD accounts also exist on the unix system.
"wbinfo -t" succeeds, and "wbinfo -m" gives a list of the
trusted
domains. However, the only users this system knows about are the ones in
the primary domain, i.e., the one set by "workgroup = " in smb.conf.
"wbinfo -u --domain OTHER" does not work, where "OTHER" is a
trusted
domain. (This worked fine with "security = domain", BTW).
"password
server" is set to "*".
Wbinfo -u --domain OTHER returns "Error looking up domain users"
wbinfo --domain-info=OTHER returns "Could not get domain info"
All this works fine for the primary domain.
The ADS side is all windows; unix systems running samba are all either
domain members or ADS.
As far as I can tell, Kerberos works fine, and kinit
user@BLAH.SOME.OTHER.REALM works fine and I get a ticket.
Whenever a user from a foreign domain tries to access a share on the
samba server, I get:
[2006/05/23 14:13:43, 3] smbd/sesssetup.c:reply_spnego_kerberos(202)
Ticket name is [someuser@SOME.OTHER.REALM]
[2006/05/23 14:13:43, 3] smbd/sesssetup.c:reply_spnego_kerberos(224)
Ticket for foreign realm someuser@SOME.OTHER.REALM
[2006/05/23 14:13:43, 1] smbd/sesssetup.c:reply_spnego_kerberos(303)
Username OTHER+curranj is invalid on this system
[2006/05/23 14:13:43, 3] smbd/error.c:error_packet(146)
error packet at smbd/sesssetup.c(308) cmd=115 (SMBsesssetupX)
NT_STATUS_LOGON_FAILURE
I'm not sure what is wrong here ...
The output (sanitized) of testparm -v can be found at:
http://pastebin.com/734897
It should be there until June 24 06.
