samba - Jul 2016 - Testing a forest trusts in Samba 4.4.5 AD environment

Hi List,

I am currently testing inter-forest trusts between a pair of AD domains. 
All DCs and member servers are using Sernet Samba 4.4.5.

I have set up conditional forwarding in by Bind setup (I'm using 
BIND9_DLZ) and all machines can resolve each other. On the DCs, I can 
see users from the other side of the trust using wbinfo -u 
--domain=<other domain>. In addition if I set up ID mapping in smb.conf 
on the DCs, getent group/password work fine (using winbind in 
nsswitch.conf).

There are two parts I'm struggling to get working. On member servers 
(file servers in my case), even with an ID mapping set up in smb.conf, 
wbinfo -u --domain=<other domain> returns nothing, and I see errors in 
log.wb-<domain>:

[2016/07/11 13:48:25.449458,  0] 
../source3/librpc/crypto/gse.c:341(gse_get_client_auth_token)
   gss_init_sec_context failed with [ Miscellaneous failure (see text): 
Key version is not available]
[2016/07/11 13:48:25.449700,  0] 
../source3/libads/sasl.c:773(ads_sasl_spnego_bind)
   kinit succeeded but ads_sasl_spnego_gensec_bind(KRB5) failed: An 
internal error occurred.
[2016/07/11 13:48:26.015483,  0] 
../source3/librpc/crypto/gse.c:341(gse_get_client_auth_token)
   gss_init_sec_context failed with [ Miscellaneous failure (see text): 
Key version is not available]
[2016/07/11 13:48:26.444479,  0] 
../source3/librpc/crypto/gse.c:341(gse_get_client_auth_token)
   gss_init_sec_context failed with [ Miscellaneous failure (see text): 
Key version is not available]
[2016/07/11 13:48:26.444610,  0] 
../source3/libads/sasl.c:773(ads_sasl_spnego_bind)
   kinit succeeded but ads_sasl_spnego_gensec_bind(KRB5) failed: An 
internal error occurred

Understandably getent fails here too. Here's an example smb.conf from a 
member server:

[global]

         workgroup = AAA_NET
         realm = samba.aaa.net
         netbios name = S4FILES
         security = ADS
         #bind interfaces only = yes
         #interfaces = eth0, lo
         #dedicated keytab file = /etc/krb5.keytab
         #kerberos method = secrets and keytab
         idmap_ldb:use rfc2307 = yes
         clustering = yes
         #private dir = /mfs/ctdb/private


    idmap config *:backend = tdb
    idmap config *:range = 200000-300000
    idmap config AAA_NET:backend = ad
    idmap config AAA_NET:default = yes
    idmap config AAA_NET:schema_mode = rfc2307
    idmap config AAA_NET:range = 500-199999

    idmap config BBB:backend = rid
    idmap config BBB:range = 3000000-3100000

    winbind nss info = rfc2307
    winbind trusted domains only = no
    winbind use default domain = yes
    winbind enum users  = yes
    winbind enum groups = yes
    winbind refresh tickets = Yes

The other issue I have is when trying to work with accounts from the 
other side of the trust within Windows. For instance, when trying to add 
a user from the "other" domain to permissions on a directory, I can 
indeed select the accounts in the picker, get prompted for credentials 
on the other domain, but at the final step get an error: "The Active 
Directory Domain Controllers required to find the selected objects in 
the following domains are not available: samba.bbb.net. Ensure the 
Active Directory Domain Controllers are available, and try to select the 
objects again".

Now I'm aware that it's early days for trusts in AD with Samba, but
I'm
curious if there is something I'm missing here or others may have got 
further than I have.

Many thanks

Alex
--
This message is intended only for the addressee and may contain
confidential information. Unless you are that person, you may not
disclose its contents or use it in any way and are requested to delete
the message along with any attachments and notify us immediately.
This email is not intended to, nor should it be taken to, constitute advice.
The information provided is correct to our knowledge & belief and must not
be used as a substitute for obtaining tax, regulatory, investment, legal or
any other appropriate advice.

"Transact" is operated by Integrated Financial Arrangements Ltd.
29 Clement's Lane, London EC4N 7AE. Tel: (020) 7608 4900 Fax: (020) 7608
5300.
(Registered office: as above; Registered in England and Wales under
number: 3727592). Authorised and regulated by the Financial Conduct
Authority (entered on the Financial Services Register; no. 190856).

On 11/07/16 13:55, Alex Crow wrote:
> Hi List,
>
> I am currently testing inter-forest trusts between a pair of AD
> domains. All DCs and member servers are using Sernet Samba 4.4.5.
>
> I have set up conditional forwarding in by Bind setup (I'm using
> BIND9_DLZ) and all machines can resolve each other. On the DCs, I can
> see users from the other side of the trust using wbinfo -u
> --domain=<other domain>. In addition if I set up ID mapping in
> smb.conf on the DCs, getent group/password work fine (using winbind in
> nsswitch.conf).
>
> There are two parts I'm struggling to get working. On member servers
> (file servers in my case), even with an ID mapping set up in smb.conf,
> wbinfo -u --domain=<other domain> returns nothing, and I see errors
in
> log.wb-<domain>:
>
> [2016/07/11 13:48:25.449458,  0]
> ../source3/librpc/crypto/gse.c:341(gse_get_client_auth_token)
>   gss_init_sec_context failed with [ Miscellaneous failure (see text):
> Key version is not available]
> [2016/07/11 13:48:25.449700,  0]
> ../source3/libads/sasl.c:773(ads_sasl_spnego_bind)
>   kinit succeeded but ads_sasl_spnego_gensec_bind(KRB5) failed: An
> internal error occurred.
> [2016/07/11 13:48:26.015483,  0]
> ../source3/librpc/crypto/gse.c:341(gse_get_client_auth_token)
>   gss_init_sec_context failed with [ Miscellaneous failure (see text):
> Key version is not available]
> [2016/07/11 13:48:26.444479,  0]
> ../source3/librpc/crypto/gse.c:341(gse_get_client_auth_token)
>   gss_init_sec_context failed with [ Miscellaneous failure (see text):
> Key version is not available]
> [2016/07/11 13:48:26.444610,  0]
> ../source3/libads/sasl.c:773(ads_sasl_spnego_bind)
>   kinit succeeded but ads_sasl_spnego_gensec_bind(KRB5) failed: An
> internal error occurred
>
> Understandably getent fails here too. Here's an example smb.conf from
> a member server:
>
> [global]
>
>         workgroup = AAA_NET
>         realm = samba.aaa.net
>         netbios name = S4FILES
>         security = ADS
>         #bind interfaces only = yes
>         #interfaces = eth0, lo
>         #dedicated keytab file = /etc/krb5.keytab
>         #kerberos method = secrets and keytab
>         idmap_ldb:use rfc2307 = yes
>         clustering = yes
>         #private dir = /mfs/ctdb/private
>
>
>    idmap config *:backend = tdb
>    idmap config *:range = 200000-300000
>    idmap config AAA_NET:backend = ad
>    idmap config AAA_NET:default = yes
>    idmap config AAA_NET:schema_mode = rfc2307
>    idmap config AAA_NET:range = 500-199999
>
>    idmap config BBB:backend = rid
>    idmap config BBB:range = 3000000-3100000
>
>    winbind nss info = rfc2307
>    winbind trusted domains only = no
>    winbind use default domain = yes
>    winbind enum users  = yes
>    winbind enum groups = yes
>    winbind refresh tickets = Yes
>
> The other issue I have is when trying to work with accounts from the
> other side of the trust within Windows. For instance, when trying to
> add a user from the "other" domain to permissions on a directory,
I
> can indeed select the accounts in the picker, get prompted for
> credentials on the other domain, but at the final step get an error:
> "The Active Directory Domain Controllers required to find the selected
> objects in the following domains are not available: samba.bbb.net.
> Ensure the Active Directory Domain Controllers are available, and try
> to select the objects again".
>
> Now I'm aware that it's early days for trusts in AD with Samba, but
> I'm curious if there is something I'm missing here or others may
have
> got further than I have.
>
> Many thanks
>
> Alex
> -- 
I've have another go at this by deleting and recreating the trust
without --type=forest. It makes a slight improvement, in that:

1) I can assign permissions on files/directories served up by DCs
without the "DCs not available" issue, whereas with --type=forest I
got
it even on DCs.
2) I can log in to a domain client W7 VM with an account from the trust
domain

However, I still can't see any accounts on Samba member servers via
wbinfo -u --domain=<otherdom>, or with getent, and now after adding
permissions on a directory in domain "AAA" to a user in
"BBB", when I
check the properties->Security from a windows machine in domain BBB, the
ACL entry shows "Unknown SID", even though it is clearly a SID in
Domain
"BBB".

I hope this helps...

Thanks again

Alex


--
This message is intended only for the addressee and may contain
confidential information. Unless you are that person, you may not
disclose its contents or use it in any way and are requested to delete
the message along with any attachments and notify us immediately.
This email is not intended to, nor should it be taken to, constitute advice.
The information provided is correct to our knowledge & belief and must not
be used as a substitute for obtaining tax, regulatory, investment, legal or
any other appropriate advice.

"Transact" is operated by Integrated Financial Arrangements Ltd.
29 Clement's Lane, London EC4N 7AE. Tel: (020) 7608 4900 Fax: (020) 7608
5300.
(Registered office: as above; Registered in England and Wales under
number: 3727592). Authorised and regulated by the Financial Conduct
Authority (entered on the Financial Services Register; no. 190856).

Hi Alex,

Nice information about forest type.
Regarding listing domain users, have you tried to set up samba with:
   winbind use default domain = no?

2016-07-11 19:50 GMT+02:00 Alex Crow <acrow at integrafin.co.uk>:
>
>
> On 11/07/16 13:55, Alex Crow wrote:
> > Hi List,
> >
> > I am currently testing inter-forest trusts between a pair of AD
> > domains. All DCs and member servers are using Sernet Samba 4.4.5.
> >
> > I have set up conditional forwarding in by Bind setup (I'm using
> > BIND9_DLZ) and all machines can resolve each other. On the DCs, I can
> > see users from the other side of the trust using wbinfo -u
> > --domain=<other domain>. In addition if I set up ID mapping in
> > smb.conf on the DCs, getent group/password work fine (using winbind in
> > nsswitch.conf).
> >
> > There are two parts I'm struggling to get working. On member
servers
> > (file servers in my case), even with an ID mapping set up in smb.conf,
> > wbinfo -u --domain=<other domain> returns nothing, and I see
errors in
> > log.wb-<domain>:
> >
> > [2016/07/11 13:48:25.449458,  0]
> > ../source3/librpc/crypto/gse.c:341(gse_get_client_auth_token)
> >   gss_init_sec_context failed with [ Miscellaneous failure (see text):
> > Key version is not available]
> > [2016/07/11 13:48:25.449700,  0]
> > ../source3/libads/sasl.c:773(ads_sasl_spnego_bind)
> >   kinit succeeded but ads_sasl_spnego_gensec_bind(KRB5) failed: An
> > internal error occurred.
> > [2016/07/11 13:48:26.015483,  0]
> > ../source3/librpc/crypto/gse.c:341(gse_get_client_auth_token)
> >   gss_init_sec_context failed with [ Miscellaneous failure (see text):
> > Key version is not available]
> > [2016/07/11 13:48:26.444479,  0]
> > ../source3/librpc/crypto/gse.c:341(gse_get_client_auth_token)
> >   gss_init_sec_context failed with [ Miscellaneous failure (see text):
> > Key version is not available]
> > [2016/07/11 13:48:26.444610,  0]
> > ../source3/libads/sasl.c:773(ads_sasl_spnego_bind)
> >   kinit succeeded but ads_sasl_spnego_gensec_bind(KRB5) failed: An
> > internal error occurred
> >
> > Understandably getent fails here too. Here's an example smb.conf
from
> > a member server:
> >
> > [global]
> >
> >         workgroup = AAA_NET
> >         realm = samba.aaa.net
> >         netbios name = S4FILES
> >         security = ADS
> >         #bind interfaces only = yes
> >         #interfaces = eth0, lo
> >         #dedicated keytab file = /etc/krb5.keytab
> >         #kerberos method = secrets and keytab
> >         idmap_ldb:use rfc2307 = yes
> >         clustering = yes
> >         #private dir = /mfs/ctdb/private
> >
> >
> >    idmap config *:backend = tdb
> >    idmap config *:range = 200000-300000
> >    idmap config AAA_NET:backend = ad
> >    idmap config AAA_NET:default = yes
> >    idmap config AAA_NET:schema_mode = rfc2307
> >    idmap config AAA_NET:range = 500-199999
> >
> >    idmap config BBB:backend = rid
> >    idmap config BBB:range = 3000000-3100000
> >
> >    winbind nss info = rfc2307
> >    winbind trusted domains only = no
> >    winbind use default domain = yes
> >    winbind enum users  = yes
> >    winbind enum groups = yes
> >    winbind refresh tickets = Yes
> >
> > The other issue I have is when trying to work with accounts from the
> > other side of the trust within Windows. For instance, when trying to
> > add a user from the "other" domain to permissions on a
directory, I
> > can indeed select the accounts in the picker, get prompted for
> > credentials on the other domain, but at the final step get an error:
> > "The Active Directory Domain Controllers required to find the
selected
> > objects in the following domains are not available: samba.bbb.net.
> > Ensure the Active Directory Domain Controllers are available, and try
> > to select the objects again".
> >
> > Now I'm aware that it's early days for trusts in AD with
Samba, but
> > I'm curious if there is something I'm missing here or others
may have
> > got further than I have.
> >
> > Many thanks
> >
> > Alex
> > --
>
> I've have another go at this by deleting and recreating the trust
> without --type=forest. It makes a slight improvement, in that:
>
> 1) I can assign permissions on files/directories served up by DCs
> without the "DCs not available" issue, whereas with --type=forest
I got
> it even on DCs.
> 2) I can log in to a domain client W7 VM with an account from the trust
> domain
>
> However, I still can't see any accounts on Samba member servers via
> wbinfo -u --domain=<otherdom>, or with getent, and now after adding
> permissions on a directory in domain "AAA" to a user in
"BBB", when I
> check the properties->Security from a windows machine in domain BBB, the
> ACL entry shows "Unknown SID", even though it is clearly a SID in
Domain
> "BBB".
>
> I hope this helps...
>
> Thanks again
>
> Alex
>
>
> --
> This message is intended only for the addressee and may contain
> confidential information. Unless you are that person, you may not
> disclose its contents or use it in any way and are requested to delete
> the message along with any attachments and notify us immediately.
> This email is not intended to, nor should it be taken to, constitute
> advice.
> The information provided is correct to our knowledge & belief and must
not
> be used as a substitute for obtaining tax, regulatory, investment, legal or
> any other appropriate advice.
>
> "Transact" is operated by Integrated Financial Arrangements Ltd.
> 29 Clement's Lane, London EC4N 7AE. Tel: (020) 7608 4900 Fax: (020)
7608
> 5300.
> (Registered office: as above; Registered in England and Wales under
> number: 3727592). Authorised and regulated by the Financial Conduct
> Authority (entered on the Financial Services Register; no. 190856).
>
> --
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba
>