search for: spnmapping

Hi! I'm not sure I understand how SPNs are registered in the AD domain. I know when a regular samba server is joined to an AD domain, a few SPNs are registered - namely, CIFS/$netbios_name and each for CIFS/$netbios_aliases (where netbios name and netbios aliases are the parameters in smb.conf - yes I know these are obsolete, but in this case they're actually used for non-obsolete task).

...> Can one add some principals to smb.conf so it gets registered > automatically, or should it be done by an AD administrator? > > Thanks, > > /mjt > I ask about your SPNs because I do not have any SPNs in AD that start with CIFS or cifs and there is a good reason for this, SPNMapping. If you run on a DC: sudo ldbsearch -P --cross-ncs -H /var/lib/samba/private/sam.ldb -b 'CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,DC=samdom,DC=example,DC=com' -s base sPNMappings That should be all on one line and replace 'DC=samdom,DC=example,DC=com' with...

21.01.2025 13:55, Rowland Penny via samba wrote: > On Tue, 21 Jan 2025 12:51:26 +0300 > Michael Tokarev via samba <samba at lists.samba.org> wrote: > >> Hi! >> >> I'm not sure I understand how SPNs are registered in the AD domain. >> I know when a regular samba server is joined to an AD domain, a few >> SPNs are registered - namely,

...ted: 20150416065542.0Z whenChanged: 20150416065542.0Z uSNCreated: 1723 tombstoneLifetime: 180 uSNChanged: 1723 showInAdvancedViewOnly: TRUE name: Directory Service objectGUID: 638831d2-9190-40ee-b566-248ad6f781fd objectCategory: CN=NTDS-Service,CN=Schema,CN=Configuration,DC=<domain>,DC=c orp sPNMappings: host=alerter,appmgmt,cisvc,clipsrv,browser,dhcp,dnscache,replicat or,eventlog,eventsystem,policyagent,oakley,dmserver,dns,mcsvc,fax,msiserver,i as,messenger,netlogon,netman,netdde,netddedsm,nmagent,plugplay,protectedstora ge,rasman,rpclocator,rpc,rpcss,remoteaccess,rsvp,samss,scardsvr,scesrv,s...

Hai,   I've checked out the log you send and i re-read the complete thread.   Based on thats done and what i did see in you logs now, looks like a  * (wildcard)  entry is giving the problem. But i am not sure of that, the wildcard bugs should be fixed, when i look in bugzilla.  (#10435 #12952 )   I've forwarded the mail to Rowland also before we go throw things at you again. ;-)