problem allowing Windows Active Directory users to access SMB shares on IPA client machine (IPA has trust with AD)

[Thomas Handler]

Hi all,

I am facing a problem I got stuck upon.

We have the following setup:

+-----------+            
                       |           |            
                       |    AD     |            
                       |           |            
                       +-----------+            
+--------------+          ^                     
|              +----------+                     
|    ums012    |                                
|              |                                
|     IPA      |                                
+--------------+                                
       ^                                        
       |                        +--------------+
       |                        |              |
       |                        |    ums029    |
       |                        |              |
       |                        |   smbclient  |
       |                        +---+----------+
+------+--------+                   |           
|               |                   |           
|    ums025     |                   |           
|               |<------------------+           
|    samba      |                               
+---------------+

IPA has a trust established with AD which is working fine. Active Directory users can logon on Linux machines which are connected to IPA, `id some-ad-user` properly shows the AD groups.

ums012 and ums025 are running RHEL 9.3, ums029 is running RHEL 8.9.

ums029 is used as a test client via smbclient.

ums025 was setup following the instructions in https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/htm...

Setup worked fine, all steps went ok.

But when i switch over to ums029 and try to verify with an ad user I get

kinit <ad user>
smbclient -L ums025.idm.example.com -U <ad user> --use-kerberos=required
Password for [<ad user>@EXAMPLE.COM]:
gensec_spnego_client_negTokenInit_step: gse_krb5: creating NEG_TOKEN_INIT for cifs/ums025.idm.example.com failed (next[(null)]): NT_STATUS_INVALID_PARAMETER
session setup failed: NT_STATUS_INVALID_PARAMETER

whereas this is working fine when running the verification as IPA user.

I tried finding hints in the logs but was unsuccessful, thus I’m writing to the list.

Best regards,

Thomas

[Alexander Bokovoy]

On Срд, 28 лют 2024, Thomas Handler via FreeIPA-users wrote:
> Hi all,
>
> I am facing a problem I got stuck upon.
>
> We have the following setup:
>
> +-----------+            
>                        |           |            
>                        |    AD     |            
>                        |           |            
>                        +-----------+            
> +--------------+          ^                     
> |              +----------+                     
> |    ums012    |                                
> |              |                                
> |     IPA      |                                
> +--------------+                                
>        ^                                        
>        |                        +--------------+
>        |                        |              |
>        |                        |    ums029    |
>        |                        |              |
>        |                        |   smbclient  |
>        |                        +---+----------+
> +------+--------+                   |           
> |               |                   |           
> |    ums025     |                   |           
> |               |<------------------+           
> |    samba      |                               
> +---------------+
>
> IPA has a trust established with AD which is working fine. Active Directory users can logon on Linux machines which are connected to IPA, `id some-ad-user` properly shows the AD groups.
>
> ums012 and ums025 are running RHEL 9.3, ums029 is running RHEL 8.9.
>
> ums029 is used as a test client via smbclient.
>
> ums025 was setup following the instructions in https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/htm...
>
> Setup worked fine, all steps went ok.
>
> But when i switch over to ums029 and try to verify with an ad user I get
>
> kinit <ad user>
> smbclient -L ums025.idm.example.com -U <ad user> --use-kerberos=required
> Password for [<ad user>@EXAMPLE.COM]:
> gensec_spnego_client_negTokenInit_step: gse_krb5: creating NEG_TOKEN_INIT for cifs/ums025.idm.example.com failed (next[(null)]): NT_STATUS_INVALID_PARAMETER
> session setup failed: NT_STATUS_INVALID_PARAMETER

Can you get more details?

It would help to collect debug logs from the samba server as well as the
client at the same time, with 'log level = 10' in smb.conf.

Use something like the following on the client:

kinit -c ./file.ccache <ad user>
KRB5_TRACE=/dev/stderr smbclient -d10 -L ... -U <ad user> --use-kerberos=required --use-krb5-ccache=./file.ccache

This will collect information from the client side.

[Thomas Handler]

Dear Alexander,

thank you for your assistance this is greatly appreciated.

Regarding the logs - the got quite big, not sure if I can attach them here as a .tgz as I have 972k uncompressed.

But on the client I got an error message that might explain he problem better (I have obfuscated the domain but not IP addresses):

smb_gss_krb5_import_cred ccache[KCM:1624200005] failed with [Unspecified GSS failure.  Minor code may provide more information: No credentials cache found] -the caller may retry after a kinit.
Failed to start GENSEC client mech gse_krb5: NT_STATUS_INTERNAL_ERROR
gensec_spnego_client_negTokenInit_step: Could not find a suitable mechtype in NEG_TOKEN_INIT

kinit for the domain user with the credential file worked fine, as the attempt logged below was done with my user I also retried the same kinit/smbclient call as root with the same result.

Thank you,

best regards 
Thomas

—— log for smbclient —

$ KRB5_TRACE=/dev/stderr smbclient -d10 -L ums025.example.com -U [e-mail] --use-kerberos=required --use-krb5-ccache=./file.ccache
Initialising global parameters
rlimit_max: increasing rlimit_max (1024) to minimum Windows limit (16384)
INFO: Current debug levels:
  all: 10
  tdb: 10
  printdrivers: 10
  lanman: 10
  smb: 10
  rpc_parse: 10
…
  dsdb_group_audit: 10
  dsdb_group_json_audit: 10
Processing section "[global]"
doing parameter workgroup = SAMBA
doing parameter security = user
doing parameter passdb backend = tdbsam
doing parameter printing = cups
doing parameter printcap name = cups
doing parameter load printers = yes
doing parameter cups options = raw
doing parameter include = /etc/samba/usershares.conf
Can't find include file /etc/samba/usershares.conf
pm_process() returned Yes
lp_servicenumber: couldn't find homes
added interface virbr0 ip=192.168.122.1 bcast=192.168.122.255 netmask=255.255.255.0
added interface ens192 ip=10.130.103.38 bcast=10.130.103.255 netmask=255.255.255.0
Client started (version 4.18.6).
Opening cache file at /var/lib/samba/lock/gencache.tdb
tdb(/var/lib/samba/lock/gencache.tdb): tdb_open_ex: could not open file /var/lib/samba/lock/gencache.tdb: Permission denied
gencache_init: Opening user cache file /home/tha/.cache/samba/gencache.tdb.
sitename_fetch: No stored sitename for realm ''
internal_resolve_name: looking up ums025.example.com#20 (sitename (null))
gencache_set_data_blob: Adding cache entry with key=[NBT/UMS025.EXAMPLE.COM#20] and timeout=[Thu Jan  1 01:00:00 AM 1970 CET] (-1709223544 seconds in the past)
namecache_fetch: no entry for ums025.example.com#20 found.
resolve_hosts: Attempting host lookup for name ums025.example.com<0x20>
remove_duplicate_addrs2: looking for duplicate address/port pairs
namecache_store: storing 1 address for ums025.example.com#20: 10.130.103.25
gencache_set_data_blob: Adding cache entry with key=[NBT/UMS025.EXAMPLE.COM#20] and timeout=[Thu Feb 29 05:30:04 PM 2024 CET] (660 seconds ahead)
internal_resolve_name: returning 1 addresses: 10.130.103.25
Connecting to 10.130.103.25 at port 445
socket options: SO_KEEPALIVE=0, SO_REUSEADDR=0, SO_BROADCAST=0, TCP_NODELAY=1, TCP_KEEPCNT=9, TCP_KEEPIDLE=7200, TCP_KEEPINTVL=75, IPTOS_LOWDELAY=0, IPTOS_THROUGHPUT=0, SO_REUSEPORT=0, SO_SNDBUF=87040, SO_RCVBUF=367360, SO_SNDLOWAT=1, SO_RCVLOWAT=1, SO_SNDTIMEO=0, SO_RCVTIMEO=0, TCP_QUICKACK=1, TCP_DEFER_ACCEPT=0, TCP_USER_TIMEOUT=0
 session request ok
 negotiated dialect[SMB3_11] against server[ums025.example.com]
cli_session_setup_spnego_send: Connect to ums025.example.com as [e-mail] using SPNEGO
GENSEC backend 'gssapi_spnego' registered
GENSEC backend 'gssapi_krb5' registered
GENSEC backend 'gssapi_krb5_sasl' registered
GENSEC backend 'spnego' registered
GENSEC backend 'schannel' registered
GENSEC backend 'ncalrpc_as_system' registered
GENSEC backend 'sasl-EXTERNAL' registered
GENSEC backend 'ntlmssp' registered
GENSEC backend 'ntlmssp_resume_ccache' registered
GENSEC backend 'http_basic' registered
GENSEC backend 'http_ntlm' registered
GENSEC backend 'http_negotiate' registered
Starting GENSEC mechanism spnego
Starting GENSEC submechanism gse_krb5
smb_gss_krb5_import_cred ccache[KCM:1624200005] failed with [Unspecified GSS failure.  Minor code may provide more information: No credentials cache found] -the caller may retry after a kinit.
Failed to start GENSEC client mech gse_krb5: NT_STATUS_INTERNAL_ERROR
gensec_spnego_client_negTokenInit_step: Could not find a suitable mechtype in NEG_TOKEN_INIT
gensec_update_send: spnego[0x55f8e36a9910]: subreq: 0x55f8e36e5de0
gensec_update_done: spnego[0x55f8e36a9910]: NT_STATUS_INVALID_PARAMETER tevent_req[0x55f8e36e5de0/../../auth/gensec/spnego.c:1632]: state[3] error[-7963671676338569203 (0x917B5ACDC000000D)]  state[struct gensec_spnego_update_state (0x55f8e36e5fa0)] timer[(nil)] finish[../../auth/gensec/spnego.c:1947]
SPNEGO login failed: An invalid parameter was passed to a service or function.
session setup failed: NT_STATUS_INVALID_PARAMETER

-----Original Message-----
From: Alexander Bokovoy 
Reply: Alexander Bokovoy 
Date: 29. February 2024 at 14:11:30
To: FreeIPA users list 
Cc: Thomas Handler 
Subject:  Re: [Freeipa-users] problem allowing Windows Active Directory users to access SMB shares on IPA client machine (IPA has trust with AD)
> On Срд, 28 лют 2024, Thomas Handler via FreeIPA-users wrote:
> > Hi all,
> >
> > I am facing a problem I got stuck upon.
> >
> > We have the following setup:
> >
> > +-----------+
> > | |
> > | AD |
> > | |
> > +-----------+
> > +--------------+ ^
> > | +----------+
> > | ums012 |
> > | |
> > | IPA |
> > +--------------+
> > ^
> > | +--------------+
> > | | |
> > | | ums029 |
> > | | |
> > | | smbclient |
> > | +---+----------+
> > +------+--------+ |
> > | | |
> > | ums025 | |
> > | |<------------------+
> > | samba |
> > +---------------+
> >
> > IPA has a trust established with AD which is working fine. Active Directory users can
>
> logon on Linux machines which are connected to IPA, `id some-ad-user` properly shows  
> the AD groups.
> > ums012 and ums025 are running RHEL 9.3, ums029 is running RHEL 8.9.
> >
> > ums029 is used as a test client via smbclient.
> >
> > ums025 was setup following the instructions in https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/htm...
> >
> > Setup worked fine, all steps went ok.
> >
> > But when i switch over to ums029 and try to verify with an ad user I get
> >
> > kinit  
> > smbclient -L ums025.idm.example.com -U --use-kerberos=required
> > Password for [@EXAMPLE.COM]:
> > gensec_spnego_client_negTokenInit_step: gse_krb5: creating NEG_TOKEN_INIT
>
> for cifs/ums025.idm.example.com failed (next[(null)]): NT_STATUS_INVALID_PARAMETER
> > session setup failed: NT_STATUS_INVALID_PARAMETER
>
> Can you get more details?
>
> It would help to collect debug logs from the samba server as well as the
> client at the same time, with 'log level = 10' in smb.conf.
>
> Use something like the following on the client:
>
> kinit -c ./file.ccache  
> KRB5_TRACE=/dev/stderr smbclient -d10 -L ... -U --use-kerberos=required  
> --use-krb5-ccache=./file.ccache
>
> This will collect information from the client side.
>
> --
> / Alexander Bokovoy
> Sr. Principal Software Engineer
> Security / Identity Management Engineering
> Red Hat Limited, Finland

[Alexander Bokovoy]

On Чцв, 29 лют 2024, Thomas Handler wrote:
> Dear Alexander,
>
> thank you for your assistance this is greatly appreciated.
>
> Regarding the logs - the got quite big, not sure if I can attach them
> here as a .tgz as I have 972k uncompressed.

You can send to me directly or upload somewhere and send a link.
> But on the client I got an error message that might explain he problem
> better (I have obfuscated the domain but not IP addresses):
>
> smb_gss_krb5_import_cred ccache[KCM:1624200005] failed with [Unspecified GSS failure.  Minor code may provide more information: No credentials cache found] -the caller may retry after a kinit.
> Failed to start GENSEC client mech gse_krb5: NT_STATUS_INTERNAL_ERROR
> gensec_spnego_client_negTokenInit_step: Could not find a suitable mechtype in NEG_TOKEN_INIT
>
> kinit for the domain user with the credential file worked fine, as the
> attempt logged below was done with my user I also retried the same
> kinit/smbclient call as root with the same result.
>
> Thank you,
>
> best regards 
> Thomas
>
> —— log for smbclient —
>
> $ KRB5_TRACE=/dev/stderr smbclient -d10 -L ums025.example.com -U [e-mail] --use-kerberos=required --use-krb5-ccache=./file.ccache
> Initialising global parameters
> rlimit_max: increasing rlimit_max (1024) to minimum Windows limit (16384)
> INFO: Current debug levels:
>   all: 10
>   tdb: 10
>   printdrivers: 10
>   lanman: 10
>   smb: 10
>   rpc_parse: 10
> …
>   dsdb_group_audit: 10
>   dsdb_group_json_audit: 10
> Processing section "[global]"
> doing parameter workgroup = SAMBA
> doing parameter security = user
> doing parameter passdb backend = tdbsam
> doing parameter printing = cups
> doing parameter printcap name = cups
> doing parameter load printers = yes
> doing parameter cups options = raw
> doing parameter include = /etc/samba/usershares.conf
> Can't find include file /etc/samba/usershares.conf
> pm_process() returned Yes
> lp_servicenumber: couldn't find homes
> added interface virbr0 ip=192.168.122.1 bcast=192.168.122.255 netmask=255.255.255.0
> added interface ens192 ip=10.130.103.38 bcast=10.130.103.255 netmask=255.255.255.0
> Client started (version 4.18.6).
> Opening cache file at /var/lib/samba/lock/gencache.tdb
> tdb(/var/lib/samba/lock/gencache.tdb): tdb_open_ex: could not open file /var/lib/samba/lock/gencache.tdb: Permission denied
> gencache_init: Opening user cache file /home/tha/.cache/samba/gencache.tdb.
> sitename_fetch: No stored sitename for realm ''
> internal_resolve_name: looking up ums025.example.com#20 (sitename (null))
> gencache_set_data_blob: Adding cache entry with key=[NBT/UMS025.EXAMPLE.COM#20] and timeout=[Thu Jan  1 01:00:00 AM 1970 CET] (-1709223544 seconds in the past)
> namecache_fetch: no entry for ums025.example.com#20 found.
> resolve_hosts: Attempting host lookup for name ums025.example.com<0x20>
> remove_duplicate_addrs2: looking for duplicate address/port pairs
> namecache_store: storing 1 address for ums025.example.com#20: 10.130.103.25
> gencache_set_data_blob: Adding cache entry with key=[NBT/UMS025.EXAMPLE.COM#20] and timeout=[Thu Feb 29 05:30:04 PM 2024 CET] (660 seconds ahead)
> internal_resolve_name: returning 1 addresses: 10.130.103.25
> Connecting to 10.130.103.25 at port 445
> socket options: SO_KEEPALIVE=0, SO_REUSEADDR=0, SO_BROADCAST=0, TCP_NODELAY=1, TCP_KEEPCNT=9, TCP_KEEPIDLE=7200, TCP_KEEPINTVL=75, IPTOS_LOWDELAY=0, IPTOS_THROUGHPUT=0, SO_REUSEPORT=0, SO_SNDBUF=87040, SO_RCVBUF=367360, SO_SNDLOWAT=1, SO_RCVLOWAT=1, SO_SNDTIMEO=0, SO_RCVTIMEO=0, TCP_QUICKACK=1, TCP_DEFER_ACCEPT=0, TCP_USER_TIMEOUT=0
>  session request ok
>  negotiated dialect[SMB3_11] against server[ums025.example.com]
> cli_session_setup_spnego_send: Connect to ums025.example.com as [e-mail] using SPNEGO
> GENSEC backend 'gssapi_spnego' registered
> GENSEC backend 'gssapi_krb5' registered
> GENSEC backend 'gssapi_krb5_sasl' registered
> GENSEC backend 'spnego' registered
> GENSEC backend 'schannel' registered
> GENSEC backend 'ncalrpc_as_system' registered
> GENSEC backend 'sasl-EXTERNAL' registered
> GENSEC backend 'ntlmssp' registered
> GENSEC backend 'ntlmssp_resume_ccache' registered
> GENSEC backend 'http_basic' registered
> GENSEC backend 'http_ntlm' registered
> GENSEC backend 'http_negotiate' registered
> Starting GENSEC mechanism spnego
> Starting GENSEC submechanism gse_krb5
> smb_gss_krb5_import_cred ccache[KCM:1624200005] failed with [Unspecified GSS failure.  Minor code may provide more information: No credentials cache found] -the caller may retry after a kinit.
> Failed to start GENSEC client mech gse_krb5: NT_STATUS_INTERNAL_ERROR
> gensec_spnego_client_negTokenInit_step: Could not find a suitable mechtype in NEG_TOKEN_INIT
> gensec_update_send: spnego[0x55f8e36a9910]: subreq: 0x55f8e36e5de0
> gensec_update_done: spnego[0x55f8e36a9910]: NT_STATUS_INVALID_PARAMETER tevent_req[0x55f8e36e5de0/../../auth/gensec/spnego.c:1632]: state[3] error[-7963671676338569203 (0x917B5ACDC000000D)]  state[struct gensec_spnego_update_state (0x55f8e36e5fa0)] timer[(nil)] finish[../../auth/gensec/spnego.c:1947]
> SPNEGO login failed: An invalid parameter was passed to a service or function.
> session setup failed: NT_STATUS_INVALID_PARAMETER
>
> -----Original Message-----
> From: Alexander Bokovoy 
> Reply: Alexander Bokovoy 
> Date: 29. February 2024 at 14:11:30
> To: FreeIPA users list 
> Cc: Thomas Handler 
> Subject:  Re: [Freeipa-users] problem allowing Windows Active Directory users to access SMB shares on IPA client machine (IPA has trust with AD)
> > On Срд, 28 лют 2024, Thomas Handler via FreeIPA-users wrote:
> > > Hi all,
> > >
> > > I am facing a problem I got stuck upon.
> > >
> > > We have the following setup:
> > >
> > > +-----------+
> > > | |
> > > | AD |
> > > | |
> > > +-----------+
> > > +--------------+ ^
> > > | +----------+
> > > | ums012 |
> > > | |
> > > | IPA |
> > > +--------------+
> > > ^
> > > | +--------------+
> > > | | |
> > > | | ums029 |
> > > | | |
> > > | | smbclient |
> > > | +---+----------+
> > > +------+--------+ |
> > > | | |
> > > | ums025 | |
> > > | |<------------------+
> > > | samba |
> > > +---------------+
> > >
> > > IPA has a trust established with AD which is working fine. Active Directory users can
> >
> > logon on Linux machines which are connected to IPA, `id some-ad-user` properly shows
> > the AD groups.
> > > ums012 and ums025 are running RHEL 9.3, ums029 is running RHEL 8.9.
> > >
> > > ums029 is used as a test client via smbclient.
> > >
> > > ums025 was setup following the instructions in https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/htm...
> > >
> > > Setup worked fine, all steps went ok.
> > >
> > > But when i switch over to ums029 and try to verify with an ad user I get
> > >
> > > kinit
> > > smbclient -L ums025.idm.example.com -U --use-kerberos=required
> > > Password for [@EXAMPLE.COM]:
> > > gensec_spnego_client_negTokenInit_step: gse_krb5: creating NEG_TOKEN_INIT
> >
> > for cifs/ums025.idm.example.com failed (next[(null)]): NT_STATUS_INVALID_PARAMETER
> > > session setup failed: NT_STATUS_INVALID_PARAMETER
> >
> > Can you get more details?
> >
> > It would help to collect debug logs from the samba server as well as the
> > client at the same time, with 'log level = 10' in smb.conf.
> >
> > Use something like the following on the client:
> >
> > kinit -c ./file.ccache
> > KRB5_TRACE=/dev/stderr smbclient -d10 -L ... -U --use-kerberos=required
> > --use-krb5-ccache=./file.ccache
> >
> > This will collect information from the client side.
> >
> > --
> > / Alexander Bokovoy
> > Sr. Principal Software Engineer
> > Security / Identity Management Engineering
> > Red Hat Limited, Finland

[Thomas Handler]

Dear Alexander,

thank you for your great support, I have sent the logs directly to you by e-mail.

Best regards,

Thomas

-----Original Message-----
From: Alexander Bokovoy 
Reply: Alexander Bokovoy 
Date: 1. March 2024 at 08:29:34
To: Thomas Handler 
Cc: FreeIPA users list 
Subject:  Re: [Freeipa-users] problem allowing Windows Active Directory users to access SMB shares on IPA client machine (IPA has trust with AD)
> On Чцв, 29 лют 2024, Thomas Handler wrote:
> > Dear Alexander,
> >
> > thank you for your assistance this is greatly appreciated.
> >
> > Regarding the logs - the got quite big, not sure if I can attach them
> > here as a .tgz as I have 972k uncompressed.
>
> You can send to me directly or upload somewhere and send a link.
> > But on the client I got an error message that might explain he problem
> > better (I have obfuscated the domain but not IP addresses):
> >
> > smb_gss_krb5_import_cred ccache[KCM:1624200005] failed with [Unspecified GSS
>
> failure. Minor code may provide more information: No credentials cache found] -the  
> caller may retry after a kinit.
> > Failed to start GENSEC client mech gse_krb5: NT_STATUS_INTERNAL_ERROR
> > gensec_spnego_client_negTokenInit_step: Could not find a suitable mechtype in
>
> NEG_TOKEN_INIT
> > kinit for the domain user with the credential file worked fine, as the
> > attempt logged below was done with my user I also retried the same
> > kinit/smbclient call as root with the same result.
> >
> > Thank you,
> >
> > best regards
> > Thomas
> >
> > —— log for smbclient —
> >
> > $ KRB5_TRACE=/dev/stderr smbclient -d10 -L ums025.example.com -U [e-mail]
>
> --use-kerberos=required --use-krb5-ccache=./file.ccache
> > Initialising global parameters
> > rlimit_max: increasing rlimit_max (1024) to minimum Windows limit (16384)
> > INFO: Current debug levels:
> > all: 10
> > tdb: 10
> > printdrivers: 10
> > lanman: 10
> > smb: 10
> > rpc_parse: 10
> > …
> > dsdb_group_audit: 10
> > dsdb_group_json_audit: 10
> > Processing section "[global]"
> > doing parameter workgroup = SAMBA
> > doing parameter security = user
> > doing parameter passdb backend = tdbsam
> > doing parameter printing = cups
> > doing parameter printcap name = cups
> > doing parameter load printers = yes
> > doing parameter cups options = raw
> > doing parameter include = /etc/samba/usershares.conf
> > Can't find include file /etc/samba/usershares.conf
> > pm_process() returned Yes
> > lp_servicenumber: couldn't find homes
> > added interface virbr0 ip=192.168.122.1 bcast=192.168.122.255 netmask=255.255.255.0  
> > added interface ens192 ip=10.130.103.38 bcast=10.130.103.255 netmask=255.255.255.0  
> > Client started (version 4.18.6).
> > Opening cache file at /var/lib/samba/lock/gencache.tdb
> > tdb(/var/lib/samba/lock/gencache.tdb): tdb_open_ex: could not open file /var/lib/samba/lock/gencache.tdb:
>
> Permission denied
> > gencache_init: Opening user cache file /home/tha/.cache/samba/gencache.tdb.  
> > sitename_fetch: No stored sitename for realm ''
> > internal_resolve_name: looking up ums025.example.com#20 (sitename (null))
> > gencache_set_data_blob: Adding cache entry with key=[NBT/UMS025.EXAMPLE.COM#20]
>
> and timeout=[Thu Jan 1 01:00:00 AM 1970 CET] (-1709223544 seconds in the past)
> > namecache_fetch: no entry for ums025.example.com#20 found.
> > resolve_hosts: Attempting host lookup for name ums025.example.com<0x20>
> > remove_duplicate_addrs2: looking for duplicate address/port pairs
> > namecache_store: storing 1 address for ums025.example.com#20: 10.130.103.25
> > gencache_set_data_blob: Adding cache entry with key=[NBT/UMS025.EXAMPLE.COM#20]
>
> and timeout=[Thu Feb 29 05:30:04 PM 2024 CET] (660 seconds ahead)
> > internal_resolve_name: returning 1 addresses: 10.130.103.25
> > Connecting to 10.130.103.25 at port 445
> > socket options: SO_KEEPALIVE=0, SO_REUSEADDR=0, SO_BROADCAST=0, TCP_NODELAY=1,
>
> TCP_KEEPCNT=9, TCP_KEEPIDLE=7200, TCP_KEEPINTVL=75, IPTOS_LOWDELAY=0, IPTOS_THROUGHPUT=0,  
> SO_REUSEPORT=0, SO_SNDBUF=87040, SO_RCVBUF=367360, SO_SNDLOWAT=1, SO_RCVLOWAT=1,  
> SO_SNDTIMEO=0, SO_RCVTIMEO=0, TCP_QUICKACK=1, TCP_DEFER_ACCEPT=0, TCP_USER_TIMEOUT=0
> > session request ok
> > negotiated dialect[SMB3_11] against server[ums025.example.com]
> > cli_session_setup_spnego_send: Connect to ums025.example.com as [e-mail]
>
> using SPNEGO
> > GENSEC backend 'gssapi_spnego' registered
> > GENSEC backend 'gssapi_krb5' registered
> > GENSEC backend 'gssapi_krb5_sasl' registered
> > GENSEC backend 'spnego' registered
> > GENSEC backend 'schannel' registered
> > GENSEC backend 'ncalrpc_as_system' registered
> > GENSEC backend 'sasl-EXTERNAL' registered
> > GENSEC backend 'ntlmssp' registered
> > GENSEC backend 'ntlmssp_resume_ccache' registered
> > GENSEC backend 'http_basic' registered
> > GENSEC backend 'http_ntlm' registered
> > GENSEC backend 'http_negotiate' registered
> > Starting GENSEC mechanism spnego
> > Starting GENSEC submechanism gse_krb5
> > smb_gss_krb5_import_cred ccache[KCM:1624200005] failed with [Unspecified GSS
>
> failure. Minor code may provide more information: No credentials cache found] -the  
> caller may retry after a kinit.
> > Failed to start GENSEC client mech gse_krb5: NT_STATUS_INTERNAL_ERROR
> > gensec_spnego_client_negTokenInit_step: Could not find a suitable mechtype in
>
> NEG_TOKEN_INIT
> > gensec_update_send: spnego[0x55f8e36a9910]: subreq: 0x55f8e36e5de0
> > gensec_update_done: spnego[0x55f8e36a9910]: NT_STATUS_INVALID_PARAMETER tevent_req[0x55f8e36e5de0/../../auth/gensec/spnego.c:1632]:
>
> state[3] error[-7963671676338569203 (0x917B5ACDC000000D)] state[struct gensec_spnego_update_state  
> (0x55f8e36e5fa0)] timer[(nil)] finish[../../auth/gensec/spnego.c:1947]
> > SPNEGO login failed: An invalid parameter was passed to a service or function.
> > session setup failed: NT_STATUS_INVALID_PARAMETER
> >
> > -----Original Message-----
> > From: Alexander Bokovoy  
> > Reply: Alexander Bokovoy  
> > Date: 29. February 2024 at 14:11:30
> > To: FreeIPA users list  
> > Cc: Thomas Handler  
> > Subject: Re: [Freeipa-users] problem allowing Windows Active Directory users to
>
> access SMB shares on IPA client machine (IPA has trust with AD)
> > > On Срд, 28 лют 2024, Thomas Handler via FreeIPA-users wrote:
> > > > Hi all,
> > > >
> > > > I am facing a problem I got stuck upon.
> > > >
> > > > We have the following setup:
> > > >
> > > > +-----------+
> > > > | |
> > > > | AD |
> > > > | |
> > > > +-----------+
> > > > +--------------+ ^
> > > > | +----------+
> > > > | ums012 |
> > > > | |
> > > > | IPA |
> > > > +--------------+
> > > > ^
> > > > | +--------------+
> > > > | | |
> > > > | | ums029 |
> > > > | | |
> > > > | | smbclient |
> > > > | +---+----------+
> > > > +------+--------+ |
> > > > | | |
> > > > | ums025 | |
> > > > | |<------------------+
> > > > | samba |
> > > > +---------------+
> > > >
> > > > IPA has a trust established with AD which is working fine. Active Directory users
>
> can
> > > logon on Linux machines which are connected to IPA, `id some-ad-user` properly shows  
> > > the AD groups.
> > > > ums012 and ums025 are running RHEL 9.3, ums029 is running RHEL 8.9.
> > > >
> > > > ums029 is used as a test client via smbclient.
> > > >
> > > > ums025 was setup following the instructions in https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/htm...
> > > >
> > > > Setup worked fine, all steps went ok.
> > > >
> > > > But when i switch over to ums029 and try to verify with an ad user I get
> > > >
> > > > kinit
> > > > smbclient -L ums025.idm.example.com -U --use-kerberos=required
> > > > Password for [@EXAMPLE.COM]:
> > > > gensec_spnego_client_negTokenInit_step: gse_krb5: creating NEG_TOKEN_INIT
> > >
> > > for cifs/ums025.idm.example.com failed (next[(null)]): NT_STATUS_INVALID_PARAMETER
> > > > session setup failed: NT_STATUS_INVALID_PARAMETER
> > >
> > > Can you get more details?
> > >
> > > It would help to collect debug logs from the samba server as well as the
> > > client at the same time, with 'log level = 10' in smb.conf.
> > >
> > > Use something like the following on the client:
> > >
> > > kinit -c ./file.ccache
> > > KRB5_TRACE=/dev/stderr smbclient -d10 -L ... -U --use-kerberos=required
> > > --use-krb5-ccache=./file.ccache
> > >
> > > This will collect information from the client side.
> > >
> > > --
> > > / Alexander Bokovoy
> > > Sr. Principal Software Engineer
> > > Security / Identity Management Engineering
> > > Red Hat Limited, Finland
>
> --
> / Alexander Bokovoy
> Sr. Principal Software Engineer
> Security / Identity Management Engineering
> Red Hat Limited, Finland

[Thomas Handler]

So in case someone is stumbling over the same problem I had I post the outcome to the list.

Alexander was so kind to donate a bunch of his time in spotting the problem for which am grateful.

From the generated logs on the client (ums029 in my initial mail, later I had to change to a different machine ums038 for completeness) he saw that the client thought that the IPA and the AD domain both share example.com which clearly would not work.

But IPA is running under ipa.example.com and Ad under example.com

But in this special case a requirement with this customer was to have host resolve as <host>.example.com even if they are attached to IPA (instead of <host>.ipa.example.com) which was working fine without the Samba share requirement.

So here is the final mail conversation I had with Alexander containing all the nitty gritty bits of complexity IPA handles for us:

-- my last mail to Alexander --

One thing that might interfere: the customer requested that hosts should resolve with <host>.example.com and this was required also for hosts which are connected to IPA.

I had already a question in the past (beginning of 2023) were I asked wether the IPA host itself requires to be in the same domain and your answer was yes. So IPA host resolves as ums012.ipa.example.com but all other hosts connected to IPA do not e.g. ums025.example.com

Could this be the reason for samba problems now?

—- and Alexander’s answer to it —

Yes, it is the problem. Please read the page I referred to. (he referred to https://www.freeipa.org/page/V4/IPA_Client_in_Active_Directory_DNS_domain)

Your SMB client asks for a service ticket to SMB server. Kerberos 
protocol is built in a such way that a service principal is constructed 
by using the DNS name of the machine, e.g. cifs/ums025.example.com is 
used and this principal belongs to AD namespace. The client, thus, asks 
AD DC about the service ticket. AD DC has no idea about this prinicipal 
and has no way to tell the client to talk to a different KDC to request 
a ticket.

In AD there is a way to add namespaces routed to specific domains when 
there is a trust established between them. This is how AD DCs know they 
need to issue a referral to talk to IPA when a service principal is in 
ipa.example.com namespace. However, this mechanism does not work for 
individual hosts, only for DNS domain level.

This is fundamental requirement and we cannot avoid it when 
interoperating with Active Directory, at least Microsoft implementation. 
For MIT Kerberos, there is a special support for per-host discovery of 
Kerberos realm the host belongs to. But with Windows systems being 
involved, this mechanism does not work, they simply have no support for 
it. And here AD DC is the Windows system that makes a decision.

On Linux systems you can try to force client-side redirection with 
either per-host DNS TXT information or with explicit krb5.conf 
domain/realm mapping per host. All of that has their own limitations as 
well. Windows clients will always fail.

You can also read https://vda.li/en/posts/2019/03/24/Kerberos-host-to-realm-translation/%C2%A0
for some of that complexity.

Best regards,

Thomas

-----Original Message-----
From: Alexander Bokovoy 
Reply: Alexander Bokovoy 
Date: 1. March 2024 at 08:29:34
To: Thomas Handler 
Cc: FreeIPA users list 
Subject:  Re: [Freeipa-users] problem allowing Windows Active Directory users to access SMB shares on IPA client machine (IPA has trust with AD)
> > On Чцв, 29 лют 2024, Thomas Handler wrote:
> > Dear Alexander,
> >
> > thank you for your assistance this is greatly appreciated.
> >
> > Regarding the logs - the got quite big, not sure if I can attach
>
> them
> > here as a .tgz as I have 972k uncompressed.
>
> You can send to me directly or upload somewhere and send a link.