samba - Mar 2016 - Failed to modify SPNs on error in module acl: Constraint violation during LDB_MODIFY (19)

Hi,

sometimes I see following in the logs:
/source4/rpc_server/drsuapi/writespn.c:234(dcesrv_drsuapi_DsWriteAccountSpn)
Failed to modify SPNs on 
CN=PCNAME,CN=Computers,DC=DOMAIN,DC=NAME,DC=NAME,DC=de: error in module acl: 
Constraint violation during LDB_MODIFY (19)

In the net i found this "explanation":

"LDAP_CONSTRAINT_VIOLATION 
Indicates that the attribute value specified in a modify, add, or modify DN 
operation violates constraints placed on the attribute. The constraint can be 
one of size or content (string only, no binary)." 

Hm, is this triggerd by dns-updates?
I see this only with two clients
How can I "debug" this ?

I am using samba 4.3.4 with bind-dlz
clients are win7

Thank you for your thoughts!

Markus

On Tue, 2016-02-02 at 23:38 +0100, Markus Dellermann
wrote:
> sometimes I see following in the logs:
> /source4/rpc_server/drsuapi/writespn.c:234(dcesrv_drsuapi_DsWriteAcco
> untSpn)
> Failed to modify SPNs on 
> CN=PCNAME,CN=Computers,DC=DOMAIN,DC=NAME,DC=NAME,DC=de: error in
> module acl: 
> Constraint violation during LDB_MODIFY (19)
I am seeing a very similar message - Failed to modify SPNs on
CN=TERRINE-WHITE,OU=Terminal Servers,DC=example,DC=com: error in module
acl: Constraint violation (19)
> In the net i found this "explanation":
> 
> "LDAP_CONSTRAINT_VIOLATION 
> Indicates that the attribute value specified in a modify, add, or
> modify DN 
> operation violates constraints placed on the attribute. The
> constraint can be 
> one of size or content (string only, no binary)." 
> 
> Hm, is this triggerd by dns-updates?
> I see this only with two clients
> How can I "debug" this ?
> 
> I am using samba 4.3.4 with bind-dlz
> clients are win7
> 
> Thank you for your thoughts!
> 
> Markus
> 
-- 
Adam Tauno Williams <mailto:awilliam at whitemice.org> GPG D95ED383
Systems Administrator, Python Developer, LPI / NCLA

Hi all,

SPN = servicePrincipalName

A simple search returning all servicePrincipalName declared in your AD:
ldbsearch -H $sam serviceprincipalname=* serviceprincipalname

An extract from result concerning a lambda client:
# record 41
dn: CN=win-client345,OU=Machines,DC=ad,DC=domain,DC=tld
servicePrincipalName: HOST/MB38W746-0009
servicePrincipalName: HOST/MB38W746-0009.ad.domain.tld
servicePrincipalName: TERMSRV/MB38W746-0009.ad.domain.tld
servicePrincipalName: TERMSRV/MB38W746-0009

I would start checking rights using security tab of your client machine
into ADUC tool to verify "SELF" is well configured (comparing with
some
other machine not generating these logs).

When this kind of message happens? When you add new client or when client
boots or randomly?

Not sure that helps, I tried ;)


2016-03-08 18:01 GMT+01:00 Adam Tauno Williams <awilliam at
whitemice.org>:
> On Tue, 2016-02-02 at 23:38 +0100, Markus Dellermann wrote:
> > sometimes I see following in the logs:
> > /source4/rpc_server/drsuapi/writespn.c:234(dcesrv_drsuapi_DsWriteAcco
> > untSpn)
> > Failed to modify SPNs on
> > CN=PCNAME,CN=Computers,DC=DOMAIN,DC=NAME,DC=NAME,DC=de: error in
> > module acl:
> > Constraint violation during LDB_MODIFY (19)
>
> I am seeing a very similar message - Failed to modify SPNs on
> CN=TERRINE-WHITE,OU=Terminal Servers,DC=example,DC=com: error in module
> acl: Constraint violation (19)
>
> > In the net i found this "explanation":
> >
> > "LDAP_CONSTRAINT_VIOLATION
> > Indicates that the attribute value specified in a modify, add, or
> > modify DN
> > operation violates constraints placed on the attribute. The
> > constraint can be
> > one of size or content (string only, no binary)."
> >
> > Hm, is this triggerd by dns-updates?
> > I see this only with two clients
> > How can I "debug" this ?
> >
> > I am using samba 4.3.4 with bind-dlz
> > clients are win7
> >
> > Thank you for your thoughts!
> >
> > Markus
> >
> --
> Adam Tauno Williams <mailto:awilliam at whitemice.org> GPG D95ED383
> Systems Administrator, Python Developer, LPI / NCLA
>
>
>
> --
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba
>