similar to: Samba AD DC: users cannot change expired passwords

Hi Andrew, Op 27-10-2023 om 02:22 schreef Andrew Bartlett: > I'm sorry to say that from here you really need to work closely with a > Samba developer (eg via a commercial support provider) or do a deep > dive into debugging yourself. > > Ideally if you have time, do a git bisect between the last known > working version and the first failing one. ?That may find the >

On Fri, 2023-10-27 at 10:44 +0200, Kees van Vloten wrote: > Hi Andrew, > > > Op 27-10-2023 om 02:22 schreef Andrew > Bartlett: > > > > > > > I'm sorry to say that from here you really need to work > > closely with a Samba developer (eg via a commercial support > > provider) or do a deep

Op 07-02-2024 om 12:27 schreef Rowland Penny via samba: > On Wed, 7 Feb 2024 11:57:28 +0100 > Kees van Vloten via samba <samba at lists.samba.org> wrote: > >> Op 07-02-2024 om 11:34 schreef Rowland Penny via samba: >>> On Wed, 7 Feb 2024 10:34:15 +0100 >>> Kees van Vloten via samba <samba at lists.samba.org> wrote: >>> >>>> Op

Op 27-10-2023 om 11:49 schreef Rowland Penny via samba: > On Fri, 27 Oct 2023 10:44:51 +0200 > Kees van Vloten via samba <samba at lists.samba.org> wrote: > >> Hi Andrew, >> >> Op 27-10-2023 om 02:22 schreef Andrew Bartlett: >>> I'm sorry to say that from here you really need to work closely >>> with a Samba developer (eg via a commercial

On Fri, 2023-10-27 at 20:31 +0200, Kees van Vloten via samba wrote: > Op 27-10-2023 om 11:49 schreef Rowland Penny via samba: > > On Fri, 27 Oct 2023 10:44:51 +0200Kees van Vloten via samba < > > samba at lists.samba.org> wrote: > > > Hi Andrew, > > > Op 27-10-2023 om 02:22 schreef Andrew Bartlett: > > > > I'm sorry to say that from here you

Op 28-10-2023 om 17:19 schreef Rowland Penny via samba: > On Sat, 28 Oct 2023 16:22:23 +0200 > Kees van Vloten via samba <samba at lists.samba.org> wrote: > >> Op 28-10-2023 om 14:21 schreef Rowland Penny via samba: >>> On Sat, 28 Oct 2023 13:50:31 +0200 >>> Kees van Vloten via samba <samba at lists.samba.org> wrote: >>>

On Sun, 29 Oct 2023 18:10:52 +0100 Kees van Vloten via samba <samba at lists.samba.org> wrote: > > Op 28-10-2023 om 17:19 schreef Rowland Penny via samba: > > On Sat, 28 Oct 2023 16:22:23 +0200 > > Kees van Vloten via samba <samba at lists.samba.org> wrote: > > > >> Op 28-10-2023 om 14:21 schreef Rowland Penny via samba: > >>> On Sat, 28

Op 28-10-2023 om 17:19 schreef Rowland Penny via samba: > On Sat, 28 Oct 2023 16:22:23 +0200 > Kees van Vloten via samba <samba at lists.samba.org> wrote: > >> Op 28-10-2023 om 14:21 schreef Rowland Penny via samba: >>> On Sat, 28 Oct 2023 13:50:31 +0200 >>> Kees van Vloten via samba <samba at lists.samba.org> wrote: >>>

On Sat, 28 Oct 2023 16:22:23 +0200 Kees van Vloten via samba <samba at lists.samba.org> wrote: > > Op 28-10-2023 om 14:21 schreef Rowland Penny via samba: > > On Sat, 28 Oct 2023 13:50:31 +0200 > > Kees van Vloten via samba <samba at lists.samba.org> wrote: > > > >>>> I consider this a big security omission: if? Samba is the source >

Op 28-10-2023 om 09:37 schreef Rowland Penny via samba: > On Fri, 27 Oct 2023 23:48:22 +0200 > Kees van Vloten via samba <samba at lists.samba.org> wrote: > >> Hi Team, >> >> Is it possible to make a LDAP-query that returns whether an account >> is expired or not? >> >> I am aware that it is possible to do the maths against the >>

On Sat, 28 Oct 2023 11:54:34 +0200 Kees van Vloten via samba <samba at lists.samba.org> wrote: > > Op 28-10-2023 om 09:37 schreef Rowland Penny via samba: > > On Fri, 27 Oct 2023 23:48:22 +0200 > > Kees van Vloten via samba <samba at lists.samba.org> wrote: > > > >> Hi Team, > >> > >> Is it possible to make a LDAP-query that returns

Op 28-10-2023 om 14:21 schreef Rowland Penny via samba: > On Sat, 28 Oct 2023 13:50:31 +0200 > Kees van Vloten via samba <samba at lists.samba.org> wrote: > >>>> I consider this a big security omission: if? Samba is the source of >>>> information but not the the authenticator of the user, that >>>> application cannot block expired users !

On Fri, 27 Oct 2023 23:48:22 +0200 Kees van Vloten via samba <samba at lists.samba.org> wrote: > Hi Team, > > Is it possible to make a LDAP-query that returns whether an account > is expired or not? > > I am aware that it is possible to do the maths against the > "accountExpires" attribute, but that requires some scripting around > the query. > >

Good day please excuse my delayed response. Thanks for the hint with the machine account. I will try this. I realised I can also manually refresh Kerberos tickets. I have the following: $ klist Valid starting Expires Service principal 02/12/2024 08:39:44 02/12/2024 18:39:44 krbtgt/CAMPUS renew until 02/13/2024 08:39:40 so this ticket is valid until 12. February 18:39.

Op 28-10-2023 om 13:22 schreef Rowland Penny via samba: > On Sat, 28 Oct 2023 11:54:34 +0200 > Kees van Vloten via samba <samba at lists.samba.org> wrote: > >> Op 28-10-2023 om 09:37 schreef Rowland Penny via samba: >>> On Fri, 27 Oct 2023 23:48:22 +0200 >>> Kees van Vloten via samba <samba at lists.samba.org> wrote: >>> >>>> Hi

Op 06-11-2023 om 14:58 schreef Jonathan Hunter: > Thank you Kees. > > On Mon, 6 Nov 2023 at 09:37, Kees van Vloten via samba > <samba at lists.samba.org> wrote: >> I am currently running at 4.19.2 but I have run 4.18.6 and 4.18.5. I did >> not experience any issues with nested group lookups, which many of the >> filters rely on. > Interestingly, I've now

Hi Team, Is it possible to make a LDAP-query that returns whether an account is expired or not? I am aware that it is possible to do the maths against the "accountExpires" attribute, but that requires some scripting around the query. - Kees.

Op 20-10-2023 om 18:35 schreef Luis Peromarta via samba: > This is very interesting. Could you share your setup ? Here is a first version of the collected bits and pieces: https://github.com/kvvloten/samba_integrations/tree/main/authentication/enterprise_wifi - Kees. > > All the best. > On 20 Oct 2023 at 17:41 +0200, Kees van Vloten <keesvanvloten at gmail.com>, wrote:

On Sat, 28 Oct 2023 13:50:31 +0200 Kees van Vloten via samba <samba at lists.samba.org> wrote: > >> I consider this a big security omission: if? Samba is the source of > >> information but not the the authenticator of the user, that > >> application cannot block expired users ! > > But, Samba when running as an AD DC is the source of information AND >

This is very interesting. Could you share your setup ? All the best. On 20 Oct 2023 at 17:41 +0200, Kees van Vloten <keesvanvloten at gmail.com>, wrote: > > I have the configuration setup on the Samba-side and indeed it works on > Windows with machine-account authentication. It connects to wifi before > a user logs in and there is no chance of lockout due to an expired user >