samba - Nov 2021 - Orphan SPN

On Thu, 2021-11-25 at 01:34 +0300, Oljas Kuzembaev via samba
wrote:
> On 25.11.2021 1:22, Andrew Bartlett via samba wrote:
> > Look for host/omu.su
> > 
> > There is an attribute sPNMappings that controls the mapping between
> > host and the services it implicitly aliases, so the cifs/ entry
> > (and
> > http/ along with many others) don't need to be listed explicitly
on
> > every service.
> 
> Thats it!
> 
> CN=Directory Service,CN=Windows
> NT,CN=Services,CN=Configuration,DC=oml,DC=su
> 
> sPNMappings was modified with addition of "cifs", which was
giving
> me 
> trouble.
cifs is in there by default, remove it if you want to break AD badly...

;-)

Andrew,

-- 
Andrew Bartlett (he/him)       https://samba.org/~abartlet/
Samba Team Member (since 2001) https://samba.org
Samba Team Lead, Catalyst IT   https://catalyst.net.nz/services/samba

Samba Development and Support, Catalyst IT - Expert Open Source
Solutions

On 25.11.2021 1:36, Andrew Bartlett via samba wrote:
> cifs is in there by default, remove it if you want to break AD badly...
>
> ;-)
>
> Andrew,
Yes, now I see. I`ve compared with sPNMappings on other domain with same 
environment and they are the same.

But if I run this line on other domain:

samba-tool domain exportkeytab cifs.keytab --principal=cifs/other.domain

it gives no keytab file in output.

But somehow keytab is created on domain in question.

I got trouble on access to smb://oml.su directly by domain name. No 
problem with smb://home.oml.su, which is my dc dns name.

I can access smb://other.domain. The only difference i`ve between them 
is a lack of cifs/other.domain SPN on other domain.

There is records in debug log.samba mention key cifs/oml.su and I did 
not found this lines on other domain.

So I thought if I could make them identical that would help.