samba - May 2013 - Domain Join

Hello,


I would like to join my samba4 to my existing samba4 DC.
The existing samba4 is a fresh, default install, every tests worked fine,
provisioned like this:
samba-tool domain provision --realm=test.domain.lan --domain=test.domain
--host-ip=10.48.16.150 --adminpass='password' --dns-backend=BIND9_DLZ
--ldapadminpass='password' --server-role=dc --use-xattrs=yes
--use-rfc2307
--function-level=2008_R2

When I run:  samba-tool domain join test.domain.lan DC -UAdministrator
--realm=test.domain.lan --dns-backend=BIND9_DLZ

I got this error message when i wrote the correct LDAP password, if I wrote
the incorrect password it just keep asking for the password.

Finding a writeable DC for domain 'test.domain.lan'
Found DC domainc01.test.domain.lan
Password for [WORKGROUP\Administrator]:
Failed to bind - LDAP error 49 LDAP_INVALID_CREDENTIALS -
<SASL:[GSS-SPNEGO]: NT_STATUS_LOGON_FAILURE> <>
Failed to connect to 'ldap://domainc01.test.domain.lan' with backend
'ldap': (null)
ERROR(ldb): uncaught exception - None
  File
"/opt/samba4/lib/python2.7/site-packages/samba/netcmd/__init__.py",
line 175, in _run
    return self.run(*args, **kwargs)
  File
"/opt/samba4/lib/python2.7/site-packages/samba/netcmd/domain.py",
line 552, in run
    machinepass=machinepass, use_ntvfs=use_ntvfs, dns_backend=dns_backend)
  File "/opt/samba4/lib/python2.7/site-packages/samba/join.py", line
1082,
in join_DC
    machinepass, use_ntvfs, dns_backend, promote_existing)
  File "/opt/samba4/lib/python2.7/site-packages/samba/join.py", line
78, in
__init__
    credentials=ctx.creds, lp=ctx.lp)
  File "/opt/samba4/lib/python2.7/site-packages/samba/samdb.py", line
56,
in __init__
    options=options)
  File "/opt/samba4/lib/python2.7/site-packages/samba/__init__.py",
line
114, in __init__
    self.connect(url, flags, options)
  File "/opt/samba4/lib/python2.7/site-packages/samba/samdb.py", line
71,
in connect
    options=options)

Did I miss someting?


Thanks, Robert

Hello Robert,

Am 22.05.2013 15:56, schrieb Sandbox:
> Finding a writeable DC for domain 'test.domain.lan'
> Found DC domainc01.test.domain.lan
> Password for [WORKGROUP\Administrator]:
> Failed to bind - LDAP error 49 LDAP_INVALID_CREDENTIALS -
> <SASL:[GSS-SPNEGO]: NT_STATUS_LOGON_FAILURE> <>
> Failed to connect to 'ldap://domainc01.test.domain.lan' with
backend
> 'ldap': (null)
> ...

Just some toughts on that:

* Do you have any special characters in your password? E. g. german 
umlauts are making trouble here if set on windows and when the password 
is validated from unix services against AD.



* Can you do a ldapsearch from the new machine in the existing directory 
or is the access there also denied?

# ldapsearch -h domainc01.test.domain.lan -b dc=test,dc=domain,dc=lan 
-LLL -D cn=Administrator,..... -W



* Kerberos settings are all fine and you can get a ticket?

https://wiki.samba.org/index.php/Samba4/HOWTO/Join_a_domain_as_a_DC#Getting_ready_for_joining_Samba_as_a_DC_to_an_existing_domain


Regards,
Marc