similar to: Error with samba update in debian.

Hai Rowland, Simply put, - UPN: An entity performing client requests to some service. Entity may be human or machine. Source : https://msdn.microsoft.com/en-us/library/windows/desktop/ms721629(v=vs.85).aspx#_security_user_principal_name_gly - SPN: An entity processing requests for a specific service, e.g., HTTP, LDAP, SSH, etc. Entity is Machine only. Source:

Hai   After my squid group adventure, i have a remaining question here.   The problem was as followed. ( and this probely dont applie to squid kerberos helpers only. )   samba-tool setup for squid i used, was as followed.   samba-tool user create squid1-service --description="Unprivileged user for SQUID1-Proxy Services" --random-password samba-tool user setexpiry

2016-08-30 16:10 GMT+02:00 Rowland Penny via samba <samba at lists.samba.org>: > On Tue, 30 Aug 2016 15:58:13 +0200 > mathias dufresne via samba <samba at lists.samba.org> wrote: > > > And reading last mails comforts me in believing the filter used by > > client side to retrieve user is not correct, that filter should use > > SPN then you won't need to

And reading last mails comforts me in believing the filter used by client side to retrieve user is not correct, that filter should use SPN then you won't need to set up SPN into UPN field. 2016-08-30 15:55 GMT+02:00 mathias dufresne <infractory at gmail.com>: > Hi Louis, > > > 2016-08-29 16:18 GMT+02:00 L.P.H. van Belle via samba < > samba at lists.samba.org>: >

> Does it work if you manually add userPrincipalName=CLIENT02.DOMAIN.TLD to your clients ldap entry and reexport the keytab? I already thought about trying that. So by now, I tried tweaking the client's LDAP entry. Adding userPrincipalName=CLIENT02.DOMAIN.TLD does not succeeed, however, after reviewing the ldap filter once again, I added userPrincipalName=nfs/client02.domain.tld at

Thank you for input! UPN is set OK - client.base.example.com (as it is specified in join command). SPN is not. And it is as well confusing - I can provide UPN, but cannot say what will be in SPN. But if this is working as designed, I cease any questions. The DNS setup is done to easily distinguish between servers and cliens mainly as well as other services. J. On Tue, 2020-10-13 at 09:32

OS is Centos 7; FreeRADIUS Version 3.0.13; Samba version 4.9.1; I'm building a FreeRADIUS box for Eduroam authentication for both SP & IDP, and have hit a stumbling block I can?t figure or Google my way out of. The issue is the local AD domain is along the lines of ?example.campus?, but users have a UPN of ?user at example.com? which was added for Skype for Business as prior the UPN

Short story: cannot get Kerberized NFSv4 to work. I've googled a great deal and cannot find where I have goofed (and there sure is a lot of misleading and just plain incorrect information out there), so would appreciate another pair of eyes. NFSv4 without Kerberos does work fine, as does ID mapping. We're using NFSv4 in production with sec=sys, but I'm not happy with that. My

Short story: cannot get Kerberized NFSv4 to work. I've googled a great deal and cannot find where I have goofed (and there sure is a lot of misleading and just plain incorrect information out there), so would appreciate another pair of eyes. NFSv4 without Kerberos does work fine, as does ID mapping. We're using NFSv4 in production with sec=sys, but I'm not happy with that. My

Hi, during my tests to use Samba4 as a kdc for kerberized NFS, I found a bug in the KDC code, when generating a principal without pac (e.g. with msktutil and option --no-pac), that causes Samba4 to crash: Running the following command on one of the client machines msktutil -c --upn nfs/testa.linex.org -h testa.linex.org --computer-name testa-service-nfs --server s4-dc1.linex.org --no-pac

Hi Rowland, Apologies for the tardy reply, I mistakenly set the mailing list to digest... Thanks for the suggestion, I'll ask the AD guys about this but I have a feeling it is an unlikely solution as Office 365 & Skype for Business apparently relies on the UPN. Unfortunately the local domain is a result of following Microsoft's "Best Practice" in the early 2000's which

On Tue, 2023-04-04 at 09:37 +0200, Kees van Vloten wrote: > Op 04-04-2023 om 00:32 schreef Andrew Bartlett: > > > > > On Mon, 2023-04-03 at 15:08 +0000, Tim ODriscoll via samba wrote: > > > > > Unfortunately it's still erroring out: > > > (7) mschap: Creating challenge hash with username: host/SL-6S4BBS3.MYDOMAIN.co.uk > > > (7) mschap:

Hi, I'm seeing this error on 3.0.24, 3.0.28, 3.0.32 and 3.2.6: Failed to join domain: failed to set machine spn: Constraint violation [Sanitised] First Run: net ads join createupn=HOST/FQDN@DOM.REALM.DOMAIN.COM createcomputer="OU/OU/OU/Services" -U username -d1 Enter username's password: [2008/12/11 17:02:32, 1] libnet/libnet_join.c:libnet_Join(1770) libnet_Join:

Le 09/03/2020 ? 16:43, Rowland penny via samba a ?crit?: > On 09/03/2020 15:18, Yvan Masson via samba wrote: >> Thanks for your help! >> >> Le 09/03/2020 ? 15:39, L.P.H. van Belle via samba a ?crit?: >>> Did you "deleated the computer object" to allow kerberos services. >>> And did you add the CIFS/spn to the computer and keytab ? >>>

Hi, i would like to use on Centos 5 Microsoft kerberos tickets for authentication for some applications. LDAP FDS for example. For that I have to add some spn to Active Directory. And afterwards to export this to local keytab. --------- kadmin -q "add_principal -randkey ldap/${INSTANCE}.${fully-qualified-domain}" Then, export that key to a keytab file. If you've deployed

Hi all, I’m looking to add in a kerberos principal on my server for the AD domain. I see there are ways to do this for user(s), but I don’t see how to add a principal for hosts. In general, I’ld like to add something like the following to me 4.3.4 Domain: ktpass -princ afpserver/fqdn at REALM -mapuser mapuser at domain +rndPass -out afpserver.keytab This is for a netatalk server. I’ve never

hello Achim, yes, if you change the  userPrincipalName LDAP attributethats suffient, thats what i changed through the windows tool. greetz, Louis Op 29 aug. 2016 om 19:42 heeft Achim Gottinger via samba <samba at lists.samba.org> het volgende geschreven: Am 29.08.2016 um 17:17 schrieb L.P.H. van Belle via samba: No, That was not sufficient, i had to use the windows tool to

No, That was not sufficient, i had to use the windows tool to change it. The is the explanation from the developer of squid helper. /snap I would say they are bugs. The first “issue” is as you say more about understanding the difference between UPN and SPN and how the tools use them. The helper tries to “authenticate” squid to AD as a user with the found SPN name, so the UPN must be the same

Le 10/03/2020 ? 11:21, Rowland penny via samba a ?crit?: > On 10/03/2020 10:10, Yvan Masson via samba wrote: >> Le 10/03/2020 ? 10:37, Rowland penny via samba a ?crit?: >>> On 10/03/2020 09:18, Yvan Masson via samba wrote: >>>> If think I did not properly explain my setup, sorry for that: Samba >>>> here is not sharing anything. It is just used for

I am trying to reconfigure a samba server to use authentication from the University domain. * smbd seems to start OK * net ads testjoin is fine * net ads join -U xxUSERNAME createcomputer="xxCOMPUTER" fails with: Failed to join domain: failed to set machine spn: Constraint violation (where xxTEXT indicates redaction - sorry I'm not sure what's confidential and what isn't)