Notice: samba 4.0 beta1 and what will be available in Fedora

[Alexander Bokovoy]

Hi!

Samba team has released Samba 4.0 beta 1 today. This is important
milestone in a more than 8 years of Samba 4 development.

This mail attempts to explain what will be and will not be available in
Fedora (Rawhide first, http://koji.fedoraproject.org/koji/taskinfo?taskID=4128906,
we are considering to discuss with all affected maintainers if and how an
update to F17 would be possible).

Sorry for longer than perhaps needed write up as this topic wasn't covered
before apart from discussions in Samba and FreeIPA upstreams.

Samba 4 is a combined set of daemons, client utilities, and Python
bindings that allow communicating using SMB1, SMB2, and soon SMB3
protocols. It also implements Active Directory domain controller (DC)
functionality as an integrated Kerberos DC, LDAP server, DNS server, 
and SMB/CIFS server.

Samba 4 AD DC functionality relies heavily on Heimdal Kerberos
implementation. Samba 4 includes the embedded Heimdal, if your system
misses it, like we have in Fedora. When embedded Heimdal is in use,
all Samba 4 code is compiled against this Kerberos implementation,
including client side libraries and tools, and traditional file serving
smbd daemon we know as 'samba' package in Fedora.

Fedora uses MIT Kerberos implementation, both server and client side.
Heimdal and MIT Kerberos are targetting to implement the same Keberos V
protocol but have their own extensions API and certain semantical
differences. They also have slightly different meaning to Kerberos
credential cache files format where Kerberos-aware applications store
their Kerberos keys. While this is not an issue for client-server 
communication over a network (a Heimdal client does talk the same
Kerberos V protocol that MIT Kerberos server understands and vice
versa), interoperability of the client or server code using the same
credential cache files on the same system is much less supported for
advanced features like S4U2Proxy and S4U2Self.

It is generally not advisable to load two different API implementations
into the same address space either. When the rest of the system
libraries is compiled against MIT Kerberos, use of them within Samba 4
code brings in MIT Kerberos as well. This happens, for example, when
linking against OpenLDAP client libraries and using SASL authentication.

As part of work we are doing on FreeIPA v3, we have made possible to
compile Samba 4 code against MIT Kerberos implementation. Unfortunately,
MIT Kerberos does not give option of embedding Kerebros KDC server within
another process which is required for Samba 4 AD DC functionality. Thus,
when compiled with MIT Kerberos, Samba 4 currently does not provice Active
Directory Domain Controller functionality at all, only client side
libraries and tools to the extent that does not involve AD DC
operations. Also, smbd is compiled against MIT Kerberos and provides
functionality equivalent to what is provided by Samba 3's smbd.

We are intending to make possible use of AD DC functionality with MIT
Kerberos but this is longer term project that requires cooperation
between Samba, MIT, and FreeIPA.

For GNU/Linux-based clients FreeIPA already provides functionality
similar to the one of Active Directory. With FreeIPA v3 we'll have
cross-realm trusts support with Active Directory that will allow
seamlessly integrating GNU/Linux-based machines into existing AD-based
infrastructure. You can get details about implementation from our talk
at SambaXP 2012 conference (http://abbra.fedorapeople.org/freeipa.pdf) and
earlier roadmap talk at Fedora Devconf in Brno in February 2012
(http://blip.tv/fedoracz/dmitripal-idenitymanagementroadmap-6071539)

One consequence of Samba 4 built with MIT Kerberos is that Openchange
server code will not be working in Fedora either. Openchange server code
requires working Samba 4 DC server with proper AD provisioning. This only
affects server side and does not affect Openchange client side support
which is used in Evolution MAPI plugin, which will continue to work.

Rawhide is already providing Samba 4  built with MIT Kerberos,
and Openchange package was modified to include only client side support.
The latter also submitted and merged to Openchange upstream.

What is available in Rawhide right now?

* samba4-* 4.0.0-53beta1 packages are built against system-wide MIT Kerberos 
   libraries. These packages are made conflicting with samba-* packages in areas
   where they provide the same binaries and/or libraries. You don't need
   to install samba4-* packages unless you want to use Evolution MAPI
   plugin and (soon FreeIPA v3 server).

* openchange is built to provide client-side libraries to allow Evolution
   MAPI plugin to work.

* Evolution MAPI plugin is rebuilt against new openchange build.

What will not be available in Rawhide in time for Fedora 18?

* Samba 4 AD DC implementation

What about samba and samba4 packages?

As samba4 is a superset of Samba 3 packages in Fedora, we are also
considering to discuss renaming samba4 back to samba. As all existing
API and ABI for smbd/nmbd/winbindd and libsmbclient library will be the
same, the switch is not going to be problematic. However, there is still
need to stabilize code through beta and pre-releases before doing that.

We also intend to work with upstream and other distributions on making
common set of instructions on configuring and setting up different
facets of Samba (AD DC, file server, member server, ...).

Why update to Fedora 17 would be preferred?

Samba 4 in Fedora 17 release is still built against Heimdal Kerberos
implementation as we haven't finished MIT Kerberos support before
alpha21 and Fedora 17 includes alpha18. Therefore, all kinds of issues
may appear when Samba 4 client code is used in MIT Kerberos environment,
particularly when Evolution MAPI plugin is used together with LDAP.

However, updating Samba 4 to 4.0 beta 1 in Fedora 17 will also require
updating libldb and libtdb and its users, primarily SSSD and Openchange.
We have the rebuild of libtdb, libldb, and SSSD available in IPA development
repository (http://jdennis.fedorapeople.org/ipa-devel/) for Fedora 17
already, no issues are detected.

More detailed description of Samba 4 MIT build and issues of mixing
different Kerberos implementations is available at
https://wiki.samba.org/index.php/MIT_Build

-- 
/ Alexander Bokovoy