thr3ads.net - samba - [Samba] 4.8.x domain join warning message [May 2018]

If this information is useful, please help other people find it:
Share via:

d tbsky

2018-May-20 14:38 UTC

[Samba] 4.8.x domain join warning message

Hi:
   I tried to use samba 4.8.1/4.8.2 to join windows domain as DC. and
saw warning message like "Unable to determine the DomainSID, can not
enforce uniqueness constraint on local domainSIDs"

  I didn't get that message when using samba 4.7.7. is the message
safe to ignore?

  the complete join message below:



[root at samba-dc ~]# /usr/local/samba/bin/samba-tool domain join
samdom.example.com DC -U"SAMDOM\administrator"
--dns-backend=SAMBA_INTERNAL
Finding a writeable DC for domain 'samdom.example.com'
Found DC test-dc.samdom.example.com
Password for [SAMDOM\administrator]:
workgroup is SAMDOM
realm is samdom.example.com
Adding CN=SAMBA-DC,OU=Domain Controllers,DC=samdom,DC=example,DC=com
Adding
CN=SAMBA-DC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=samdom,DC=example,DC=com
Adding CN=NTDS
Settings,CN=SAMBA-DC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=samdom,DC=example,DC=com
Adding SPNs to CN=SAMBA-DC,OU=Domain Controllers,DC=samdom,DC=example,DC=com
Setting account password for SAMBA-DC$
Enabling account
Calling bare provision
Looking up IPv4 addresses
Looking up IPv6 addresses
No IPv6 address will be assigned
Setting up share.ldb
Setting up secrets.ldb
Setting up the registry
Setting up the privileges database
Setting up idmap db
Setting up SAM db
Setting up sam.ldb partitions and settings
Setting up sam.ldb rootDSE
Pre-loading the Samba 4 and AD schema
Unable to determine the DomainSID, can not enforce uniqueness
constraint on local domainSIDs

A Kerberos configuration suitable for Samba AD has been generated at
/usr/local/samba/private/krb5.conf
Merge the contents of this file with your system krb5.conf or replace
it with this one. Do not create a symlink!
Provision OK for domain DN DC=samdom,DC=example,DC=com
Starting replication
Schema-DN[CN=Schema,CN=Configuration,DC=samdom,DC=example,DC=com]
objects[402/1449] linked_values[0/0]
Schema-DN[CN=Schema,CN=Configuration,DC=samdom,DC=example,DC=com]
objects[804/1449] linked_values[0/0]
Schema-DN[CN=Schema,CN=Configuration,DC=samdom,DC=example,DC=com]
objects[1206/1449] linked_values[0/0]
Schema-DN[CN=Schema,CN=Configuration,DC=samdom,DC=example,DC=com]
objects[1608/1449] linked_values[0/0]
Schema-DN[CN=Schema,CN=Configuration,DC=samdom,DC=example,DC=com]
objects[1743/1449] linked_values[0/0]
Analyze and apply schema objects
Partition[CN=Configuration,DC=samdom,DC=example,DC=com]
objects[402/2989] linked_values[0/24]
Partition[CN=Configuration,DC=samdom,DC=example,DC=com]
objects[804/2989] linked_values[0/24]
Partition[CN=Configuration,DC=samdom,DC=example,DC=com]
objects[1206/2989] linked_values[0/24]
Partition[CN=Configuration,DC=samdom,DC=example,DC=com]
objects[1608/2989] linked_values[0/24]
Partition[CN=Configuration,DC=samdom,DC=example,DC=com]
objects[1764/2989] linked_values[24/24]
Replicating critical objects from the base DN of the domain
Partition[DC=samdom,DC=example,DC=com] objects[105/104] linked_values[23/26]
Partition[DC=samdom,DC=example,DC=com] objects[371/3307] linked_values[26/26]
Done with always replicated NC (base, config, schema)
Replicating DC=DomainDnsZones,DC=samdom,DC=example,DC=com
Partition[DC=DomainDnsZones,DC=samdom,DC=example,DC=com]
objects[40/40] linked_values[0/0]
Replicating DC=ForestDnsZones,DC=samdom,DC=example,DC=com
Partition[DC=ForestDnsZones,DC=samdom,DC=example,DC=com]
objects[18/18] linked_values[0/0]
Exop on[CN=RID Manager$,CN=System,DC=samdom,DC=example,DC=com]
objects[3] linked_values[0]
Committing SAM database
Adding 1 remote DNS records for SAMBA-DC.samdom.example.com
Adding DNS A record SAMBA-DC.samdom.example.com for IPv4 IP: 10.99.1.223
Adding DNS CNAME record
7d374d0b-74d2-49c1-9969-9a0e87090672._msdcs.samdom.example.com for
SAMBA-DC.samdom.example.com
All other DNS records (like _ldap SRV records) will be created
samba_dnsupdate on first startup
Replicating new DNS records in DC=DomainDnsZones,DC=samdom,DC=example,DC=com
Partition[DC=DomainDnsZones,DC=samdom,DC=example,DC=com] objects[1/40]
linked_values[0/0]
Replicating new DNS records in DC=ForestDnsZones,DC=samdom,DC=example,DC=com
Partition[DC=ForestDnsZones,DC=samdom,DC=example,DC=com] objects[1/18]
linked_values[0/0]
Sending DsReplicaUpdateRefs for all the replicated partitions
Setting isSynchronized and dsServiceName
Setting up secrets database
Joined domain SAMDOM (SID S-1-5-21-3559909774-3968669603-834676815) as a DC

Rowland Penny

2018-May-20 14:58 UTC

head link

[Samba] 4.8.x domain join warning message

On Sun, 20 May 2018 22:38:22 +0800
d tbsky via samba <samba at lists.samba.org> wrote:
> Hi:
>    I tried to use samba 4.8.1/4.8.2 to join windows domain as DC. 
Which one was it, 4.8.1 or 4.8.2 ?

If it was 4.8.1, I suppose you didn't see the warnings about using
4.8.0 or 4.8.1 to upgrade (yes, adding a new DC can be classed as
upgrading). I think you need to run 'sambaundoguididx' (its a script
supplied with Samba), then demote your new DC and then RENAME it and
give it a new ipaddress. Now install 4.8.2 ( it was released early to
deal with this problem) and try again.

Rowland

Andrew Bartlett

2018-May-20 18:44 UTC

head link

[Samba] 4.8.x domain join warning message

On Sun, 2018-05-20 at 22:38 +0800, d tbsky via samba
wrote:> Hi:
>    I tried to use samba 4.8.1/4.8.2 to join windows domain as DC. and
> saw warning message like "Unable to determine the DomainSID, can not
> enforce uniqueness constraint on local domainSIDs"
Sorry about that.  We should sqelch the warning during provision and
the join. 
>   I didn't get that message when using samba 4.7.7. is the message
> safe to ignore?
Entirely safe.  We made some changes in Samba to cope with deleted
foreignSecurityPrincipal objects which meant we had to relax our
uniqueness constraint, but only for things outside our domain.  

It just has a chicken-and-egg situation during the very first setup
(where we won't create duplicates anyway, as we are under the control
of the script) which the lower level module gets a bit grumpy with. 
>   the complete join message below:
> 
> 
> 
> [root at samba-dc ~]# /usr/local/samba/bin/samba-tool domain join
> samdom.example.com DC -U"SAMDOM\administrator"
> --dns-backend=SAMBA_INTERNAL
> Joined domain SAMDOM (SID S-1-5-21-3559909774-3968669603-834676815) as a DC
It is fine.  Worry when you don't get that last line, otherwise it
looks good :-)

Andrew Bartlett

-- 
Andrew Bartlett                       http://samba.org/~abartlet/
Authentication Developer, Samba Team  http://samba.org
Samba Developer, Catalyst IT          http://catalyst.net.nz/services/samba

Andrew Bartlett

2018-May-20 18:48 UTC

head link

[Samba] sambaundoguididx

On Sun, 2018-05-20 at 15:58 +0100, Rowland Penny via samba
wrote:> 
> If it was 4.8.1, I suppose you didn't see the warnings about using
> 4.8.0 or 4.8.1 to upgrade (yes, adding a new DC can be classed as
> upgrading). I think you need to run 'sambaundoguididx' (its a
script
> supplied with Samba), then demote your new DC and then RENAME it and
> give it a new ipaddress. Now install 4.8.2 ( it was released early to
> deal with this problem) and try again.
G'Day Rowland,

Just to fill you in on when we do and do not need this script.

There is no need to run undoguidindex on any working domain.  

The case it is supplied for is for failed upgrades between Samba 4.7
and 4.8, or the case where a downgrade is required.  

Any newly provisioned domain or DC joined using samba-tool running
Samba 4.8 and staying on Samba 4.8 does not need it, (they will have
started with the GUID index mode, and as long as the provision or join
succeeded the danger is past). 

I hope this clarifies things,

Andrew Bartlett

-- 
Andrew Bartlett                       http://samba.org/~abartlet/
Authentication Developer, Samba Team  http://samba.org
Samba Developer, Catalyst IT          http://catalyst.net.nz/services/samba

d tbsky

2018-May-21 03:05 UTC

head link

[Samba] 4.8.x domain join warning message

2018-05-21 2:44 GMT+08:00 Andrew Bartlett <abartlet at
samba.org>:> Entirely safe.  We made some changes in Samba to cope with deleted
> foreignSecurityPrincipal objects which meant we had to relax our
> uniqueness constraint, but only for things outside our domain.
>
> It just has a chicken-and-egg situation during the very first setup
> (where we won't create duplicates anyway, as we are under the control
> of the script) which the lower level module gets a bit grumpy with.
  thanks a lot for the explanation, although I don't really understand
the internal stuff.
  but now I know I can safely use samba 4.8.2 as DC :)

Regards,
tbskyd

Apparently Analagous Threads

Search for more possibly parallel threads

samba - May 2018 - 4.8.x domain join warning message

[Samba] 4.8.x domain join warning message

[Samba] 4.8.x domain join warning message

[Samba] 4.8.x domain join warning message

[Samba] sambaundoguididx

[Samba] 4.8.x domain join warning message

Apparently Analagous Threads