samba - Jun 2009 - samba-3.3.4 AD/krb5/pam build failure on AIX 5.3/6.1 UNKNOWN_CREATE_KEY_FUNCTIONS

Hi all!

Perhaps someone here could tell me if this has been seen before.
We're trying to build samba-3.3.4 for IBM AIX with support for PAM, Active
Directory, and Kerberos.
The end goal is to be able to join the AIX system to our Active Directory domain
so that users can log in via their AD username/password, and have access to
their home directory via the Windows pass-through authentication system.
We are building as STATIC on the latest AIX 5.3 with gcc 3.3.2, and deploying on
AIX 6.1.  We have IBM's Kerberos installed in /usr/krb5, where it is
properly found by the configure script.

Here are the errors from 'make':

Compiling libsmb/clikrb5.c
libsmb/clikrb5.c:258:2: #error UNKNOWN_CREATE_KEY_FUNCTIONS
libsmb/clikrb5.c:1011:2: #error UNKNOWN_KRB5_VERIFY_CHECKSUM_FUNCTION
libsmb/clikrb5.c: In function `handle_krberror_packet':
libsmb/clikrb5.c:1527: error: `ERROR_TABLE_BASE_krb5' undeclared (first use
in t
his function)
libsmb/clikrb5.c:1527: error: (Each undeclared identifier is reported only once
libsmb/clikrb5.c:1527: error: for each function it appears in.)
libsmb/clikrb5.c:1608:2: #error UNKNOWN_KRB5_ENCTYPE_TO_STRING_FUNCTION
The following command failed:
gcc -I. -I/bk/compile/samba-3.3.4/build/source  -I/bk/compile/samba-3.3.4/openld
ap/include -O -D_SAMBA_BUILD_=3 -I/bk/compile/samba-3.3.4/build/source/popt -I/b
k/compile/samba-3.3.4/build/source/iniparser/src -Iinclude -I./include  -I. -I. 
-I./lib/replace -I./lib/talloc -I./lib/tdb/include -I./libaddns -I./librpc -DHAV
E_CONFIG_H  -Iinclude -I./include -I. -I. -I./lib/replace -I./lib/talloc -I./lib
/tdb/include -I./libaddns -I./librpc -I./popt -DLDAP_DEPRECATED   -I/include -I/
bk/compile/samba-3.3.4/build/source/lib -D_SAMBA_BUILD_=3  -c libsmb/clikrb5.c -
o libsmb/clikrb5.o
make: 1254-004 The error code from the last command is 1.


And, here are the options to configure that we're using:

./configure --prefix=/opt/samba-3.3.4 \
--sysconfdir=/etc/samba-3.3.4 \
--localstatedir=/var/adm/samba-3.3.4 \
--enable-static=yes \
--enable-shared=no \
--with-privatedir=/etc/samba-3.3.4/private \
--with-lockdir=/var/adm/samba-3.3.4/locks \
--with-piddir=/var/adm/samba-3.3.4/locks \
--with-swatdir=/opt/samba-3.3.4/swat \
--with-configdir=/etc/samba-3.3.4/conf \
--with-logfilebase=/var/adm/samba-3.3.4/logs \
--with-localedir=/etc/samba-3.3.4/locale \
--with-aio-support \
--without-winbind \
--with-ldap \
--with-ads \
--with-krb5 \
--with-pam \

Can anyone spot why the errors are occurring?  I don't have much experience
with Samba or Kerberos, but it would seem to me that the IBM Kerberos won't
cut it.  Has anyone here successfully compiled samba with Active Directory
support on AIX with IBM's Kerberos?

Many thanks to all in advance!

-Ben

Benjamin Huntsman wrote:
> Hi all!
>
> Perhaps someone here could tell me if this has been seen before.
> We're trying to build samba-3.3.4 for IBM AIX with support for PAM,
Active Directory, and Kerberos.
> The end goal is to be able to join the AIX system to our Active Directory
domain so that users can log in via their AD username/password, and have access
to their home directory via the Windows pass-through authentication system.
> We are building as STATIC on the latest AIX 5.3 with gcc 3.3.2, and
deploying on AIX 6.1.  We have IBM's Kerberos installed in /usr/krb5, where
it is properly found by the configure script.
>
>   
If it's found by the script, why isn't it listed in the any of the -I 
options below?

> Here are the errors from 'make':
>
> Compiling libsmb/clikrb5.c
> libsmb/clikrb5.c:258:2: #error UNKNOWN_CREATE_KEY_FUNCTIONS
> libsmb/clikrb5.c:1011:2: #error UNKNOWN_KRB5_VERIFY_CHECKSUM_FUNCTION
> libsmb/clikrb5.c: In function `handle_krberror_packet':
> libsmb/clikrb5.c:1527: error: `ERROR_TABLE_BASE_krb5' undeclared (first
use in t
> his function)
> libsmb/clikrb5.c:1527: error: (Each undeclared identifier is reported only
once
> libsmb/clikrb5.c:1527: error: for each function it appears in.)
> libsmb/clikrb5.c:1608:2: #error UNKNOWN_KRB5_ENCTYPE_TO_STRING_FUNCTION
> The following command failed:
> gcc -I. -I/bk/compile/samba-3.3.4/build/source 
-I/bk/compile/samba-3.3.4/openld
> ap/include -O -D_SAMBA_BUILD_=3 -I/bk/compile/samba-3.3.4/build/source/popt
-I/b
> k/compile/samba-3.3.4/build/source/iniparser/src -Iinclude -I./include  -I.
-I.
> -I./lib/replace -I./lib/talloc -I./lib/tdb/include -I./libaddns -I./librpc
-DHAV
> E_CONFIG_H  -Iinclude -I./include -I. -I. -I./lib/replace -I./lib/talloc
-I./lib
> /tdb/include -I./libaddns -I./librpc -I./popt -DLDAP_DEPRECATED  
-I/include -I/
> bk/compile/samba-3.3.4/build/source/lib -D_SAMBA_BUILD_=3  -c
libsmb/clikrb5.c -
> o libsmb/clikrb5.o
> make: 1254-004 The error code from the last command is 1.
>
>
> And, here are the options to configure that we're using:
>
> ./configure --prefix=/opt/samba-3.3.4 \
> --sysconfdir=/etc/samba-3.3.4 \
> --localstatedir=/var/adm/samba-3.3.4 \
> --enable-static=yes \
> --enable-shared=no \
> --with-privatedir=/etc/samba-3.3.4/private \
> --with-lockdir=/var/adm/samba-3.3.4/locks \
> --with-piddir=/var/adm/samba-3.3.4/locks \
> --with-swatdir=/opt/samba-3.3.4/swat \
> --with-configdir=/etc/samba-3.3.4/conf \
> --with-logfilebase=/var/adm/samba-3.3.4/logs \
> --with-localedir=/etc/samba-3.3.4/locale \
> --with-aio-support \
> --without-winbind \
> --with-ldap \
> --with-ads \
> --with-krb5 \
> --with-pam \
>
>   
If you're using AD, you're likely going to want winbindd (and maybe 
WINBIND LAM) unless there is another way you plan on mapping SIDs to 
Unix user/group id values.

Also, I would prefix the configure command with something similar to:

env CFLAGS="-I/usr/krb5/include ..." \
LDFLAGS="-L/usr/krb5/lib ..." \
configure ... \

Assuming, of course, that those paths are correct. :-)

Personally, I've never been successful with much that IBM put out with 
respect to Kerberos or libiconv.

If you are unsuccessful in your venture, you can always try my site:

http://pware.hvcc.edu/

And follow the links for Downloads until you get to the bundles 
directory. There's 32- and 64-bit options and a few of us are testing 
some Clustered Samba patches for AIX, which hopefully we can pass back 
upstream soon.


Cheers,
Bill
> Can anyone spot why the errors are occurring?  I don't have much
experience with Samba or Kerberos, but it would seem to me that the IBM Kerberos
won't cut it.  Has anyone here successfully compiled samba with Active
Directory support on AIX with IBM's Kerberos?
>
> Many thanks to all in advance!
>
> -Ben
>

Hi Benjamin,

On 2009-06-09 at 15:48 -0700 Benjamin Huntsman sent off:
> Perhaps someone here could tell me if this has been seen before.
can you please file a bug at bugzilla.samba.org including what you wrote here
and in addition to that the config.log?

Thanks!
Bj?rn