samba - Aug 2020 - accessing foreign AD users to NT domain

Mandi! Rowland penny via samba
  In chel di` si favelave...
> You have 'allow trusted domains = No' in 'global' and from
'man smb.conf':
I've had not noted that.


I can confirm that my working setup had NOT 'allow trusted domains No'.

-- 
dott. Marco Gaiarin				        GNUPG Key ID: 240A3D66
  Associazione ``La Nostra Famiglia''         
http://www.lanostrafamiglia.it/
  Polo FVG   -   Via della Bont?, 7 - 33078   -   San Vito al Tagliamento (PN)
  marco.gaiarin(at)lanostrafamiglia.it   t +39-0434-842711   f +39-0434-842797

		Dona il 5 PER MILLE a LA NOSTRA FAMIGLIA!
      http://www.lanostrafamiglia.it/index.php/it/sostienici/5x1000
	(cf 00307430132, categoria ONLUS oppure RICERCA SANITARIA)

On 26/08/2020 14:40, Marco Gaiarin via samba wrote:
> Mandi! Rowland penny via samba
>    In chel di` si favelave...
>
>> You have 'allow trusted domains = No' in 'global' and
from 'man smb.conf':
> I've had not noted that.
>
>
> I can confirm that my working setup had NOT 'allow trusted domains >
No'.
>
A further perusal of Piviul's log file produced this:

No such user psala [CSATEST] - using guest account

And as the only share that allows guest access is 'tuning', coupling 
this with the fact that Piviul said that the connection wasn't to 
'tuning', leads to access being denied.

Rowland

Rowland penny via samba ha scritto il 26/08/20 alle
15:49:
> [...] No such user psala [CSATEST] - using guest account
in effect from logs I can read:
> [2020/08/26 09:53:02.432488,  5, pid=2553, effective(0, 0), real(0, 0)]
../source3/auth/auth_ntlmssp.c:188(auth3_check_password)
>   Checking NTLMSSP password for CSATEST\psala failed:
NT_STATUS_NO_SUCH_USER
> [2020/08/26 09:53:02.432504,  3, pid=2553, effective(0, 0), real(0, 0),
class=auth] ../source3/auth/auth_util.c:1611(do_map_to_guest_server_info)
>   No such user psala [CSATEST] - using guest account
but that's ok because the samba server (ZIZI) doesn't know the CSATEST 
domain he knows only DOMINIOCSA domain that's the joined domain... I 
don't know how samba should authenticate the CSATEST (ADdomain) users 
perhaps mapping AD users to NT users? That's the problem? From logs I 
can read[?] that samba try to map CSATEST users to ZIZI users but should 
map CSATEST users to DOMINIOCA, didn't it?

Any way in all log file I've sent I can't find an authentication attempt
to DOMINIOCSA\psala that's the only way to successfully authenticate the 
CSATEST\psala user, that's the problem... and probably the bug that 
caused this change in behaviour.

My best regards

Piviul

[?] Mapped domain from [CSATEST] to [ZIZI] for user [psala] from 
workstation [WIN7PRO-V01]