freeipa

#8185 Refused LDAP and SMB3.11 access with IPA Kerberos ticket to Windows 2016 server
Closed: fixed by abbra. Opened by abbra.

Closed: fixed
Reopen Issue

When testing access as IPA user to Windows 2016 server AD DC, I found out that on Fedora 31 we seem to have some issue with both LDAP and SMB3.11 access to that AD DC. The traces show that Windows server does authenticate us but then:
- for LDAP protocol sends back an error claiming we are not bound to the connection
- for SMB protocol it sends back a signature that Samba considers 'bad' one.

Attached is a network trace for the following events:
- kinit as AD administrator on Linux (IP address ends with .80)
- do ldapsearch -Y GSS-SPNEGO -h ad1.win2016.test ...
- result is successful
- do smbclient -k -U Administrator@WIN2016.TEST //ad1.win2016.test/IPC\$
- result is successful
- kinit as IPA admin on the same Linux machine (IP address ends with .80)
- do ldapsearch -Y GSS-SPNEGO -h ad1.win2016.test ...
- result is an error of binding (see below)
- do smbclient -k -U admin@IPA.TEST //ad1.win2016.test/IPC\$
- result is an error of SMB2 signature (see below)

Unsuccessful ldapsearch as IPA user:

# ldapsearch -Y GSS-SPNEGO -h ad1.win2016.test -b dc=win2016,dc=test cn=Administrator
SASL/GSS-SPNEGO authentication started
SASL username: admin@IPA.TEST
SASL SSF: 256
SASL data security layer installed.
# extended LDIF
#
# LDAPv3
# base <dc=win2016,dc=test> with scope subtree
# filter: cn=Administrator
# requesting: ALL
#
# search result
search: 2
result: 1 Operations error
text: 000004DC: LdapErr: DSID-0C0909AF, comment: In order to perform this opera
 tion a successful bind must be completed on the connection., data 0, v3839
# numResponses: 1

Unsuccessful SMB connection as IPA user:

# smbclient -k -U admin@IPA.TEST //ad1.win2016.test/IPC\$
lp_load_ex: changing to config backend registry
Bad SMB2 signature for message
[0000] 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00   ........ ........
[0000] C0 80 22 D6 46 C9 F0 79   40 C6 E5 B8 72 1E 43 C3   ..".F..y @...r.C.
session setup failed: NT_STATUS_ACCESS_DENIED
[root@master ~]# smbclient -d50 -k -U admin@IPA.TEST //ad1.win2016.test/IPC\$
INFO: Current debug levels:
  all: 50
  tdb: 50
  printdrivers: 50
  lanman: 50
  smb: 50
  rpc_parse: 50
  rpc_srv: 50
  rpc_cli: 50
  passdb: 50
  sam: 50
  auth: 50
  winbind: 50
  vfs: 50
  idmap: 50
  quota: 50
  acls: 50
  locking: 50
  msdfs: 50
  dmapi: 50
  registry: 50
  scavenger: 50
  dns: 50
  ldb: 50
  tevent: 50
  auth_audit: 50
  auth_json_audit: 50
  kerberos: 50
  drs_repl: 50
  smb2: 50
  smb2_credits: 50
  dsdb_audit: 50
  dsdb_json_audit: 50
  dsdb_password_audit: 50
  dsdb_password_json_audit: 50
  dsdb_transaction_audit: 50
  dsdb_transaction_json_audit: 50
  dsdb_group_audit: 50
  dsdb_group_json_audit: 50
lp_load_ex: refreshing parameters
Initialising global parameters
rlimit_max: increasing rlimit_max (1024) to minimum Windows limit (16384)
INFO: Current debug levels:
  all: 50
  tdb: 50
  printdrivers: 50
  lanman: 50
  smb: 50
  rpc_parse: 50
  rpc_srv: 50
  rpc_cli: 50
  passdb: 50
  sam: 50
  auth: 50
  winbind: 50
  vfs: 50
  idmap: 50
  quota: 50
  acls: 50
  locking: 50
  msdfs: 50
  dmapi: 50
  registry: 50
  scavenger: 50
  dns: 50
  ldb: 50
  tevent: 50
  auth_audit: 50
  auth_json_audit: 50
  kerberos: 50
  drs_repl: 50
  smb2: 50
  smb2_credits: 50
  dsdb_audit: 50
  dsdb_json_audit: 50
  dsdb_password_audit: 50
  dsdb_password_json_audit: 50
  dsdb_transaction_audit: 50
  dsdb_transaction_json_audit: 50
  dsdb_group_audit: 50
  dsdb_group_json_audit: 50
Processing section "[global]"
doing parameter debug pid = yes
doing parameter config backend = registry
pm_process() returned Yes
lp_load_ex: changing to config backend registry
Freeing parametrics:
Initialising global parameters
rlimit_max: increasing rlimit_max (1024) to minimum Windows limit (16384)
INFO: Current debug levels:
  all: 50
  tdb: 50
  printdrivers: 50
  lanman: 50
  smb: 50
  rpc_parse: 50
  rpc_srv: 50
  rpc_cli: 50
  passdb: 50
  sam: 50
  auth: 50
  winbind: 50
  vfs: 50
  idmap: 50
  quota: 50
  acls: 50
  locking: 50
  msdfs: 50
  dmapi: 50
  registry: 50
  scavenger: 50
  dns: 50
  ldb: 50
  tevent: 50
  auth_audit: 50
  auth_json_audit: 50
  kerberos: 50
  drs_repl: 50
  smb2: 50
  smb2_credits: 50
  dsdb_audit: 50
  dsdb_json_audit: 50
  dsdb_password_audit: 50
  dsdb_password_json_audit: 50
  dsdb_transaction_audit: 50
  dsdb_transaction_json_audit: 50
  dsdb_group_audit: 50
  dsdb_group_json_audit: 50
lp_load_ex: refreshing parameters
Initialising global parameters
rlimit_max: increasing rlimit_max (1024) to minimum Windows limit (16384)
INFO: Current debug levels:
  all: 50
  tdb: 50
  printdrivers: 50
  lanman: 50
  smb: 50
  rpc_parse: 50
  rpc_srv: 50
  rpc_cli: 50
  passdb: 50
  sam: 50
  auth: 50
  winbind: 50
  vfs: 50
  idmap: 50
  quota: 50
  acls: 50
  locking: 50
  msdfs: 50
  dmapi: 50
  registry: 50
  scavenger: 50
  dns: 50
  ldb: 50
  tevent: 50
  auth_audit: 50
  auth_json_audit: 50
  kerberos: 50
  drs_repl: 50
  smb2: 50
  smb2_credits: 50
  dsdb_audit: 50
  dsdb_json_audit: 50
  dsdb_password_audit: 50
  dsdb_password_json_audit: 50
  dsdb_transaction_audit: 50
  dsdb_transaction_json_audit: 50
  dsdb_group_audit: 50
  dsdb_group_json_audit: 50
doing parameter registry shares = yes
registry_init_smbconf called
regdb_init: registry db openend. refcount reset (1)
reghook_cache_init: new tree with default ops 0x7f77270a9100 for key []
tdb_unpack(d, 4) -> 4
tdb_unpack(d, 4) -> 4
tdb_unpack(d, 4) -> 4
tdb_unpack(d, 41) -> 4
tdb_unpack(d, 4) -> 4
tdb_unpack(d, 4) -> 4
tdb_unpack(d, 4) -> 4
tdb_unpack(d, 4) -> 4
tdb_unpack(d, 4) -> 4
tdb_unpack(d, 4) -> 4
tdb_unpack(d, 11) -> 4
tdb_unpack(d, 8) -> 4
tdb_unpack(d, 4) -> 4
tdb_unpack(d, 4) -> 4
tdb_unpack(d, 4) -> 4
tdb_unpack(d, 4) -> 4
tdb_unpack(d, 4) -> 4
tdb_unpack(d, 13) -> 4
tdb_unpack(d, 4) -> 4
tdb_unpack(d, 4) -> 4
tdb_unpack(d, 4) -> 4
tdb_unpack(d, 4) -> 4
tdb_unpack(d, 4) -> 4
tdb_unpack(d, 4) -> 4
tdb_unpack(d, 4) -> 4
tdb_unpack(d, 4) -> 4
tdb_unpack(d, 4) -> 4
tdb_unpack(d, 4) -> 4
tdb_unpack(d, 4) -> 4
tdb_unpack(d, 4) -> 4
regdb_fetch_values: Looking for values of key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Ports]
tdb_unpack(d, 4) -> 4
tdb_unpack(d, 33) -> 4
tdb_unpack(fdB, 29) -> 29
regdb_unpack_values: value[0]: name[Samba Printer Port] len[2]
regdb_fetch_values: Looking for values of key [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers]
tdb_unpack(d, 4) -> 4
tdb_unpack(d, 104) -> 4
tdb_unpack(fdB, 100) -> 100
regdb_unpack_values: value[0]: name[DefaultSpoolDirectory] len[70]
regdb_fetch_values: Looking for values of key [HKLM\SYSTEM\CurrentControlSet\Services\Eventlog]
tdb_unpack(d, 4) -> 4
tdb_unpack(d, 69) -> 4
tdb_unpack(fdB, 65) -> 40
regdb_unpack_values: value[0]: name[DisplayName] len[20]
tdb_unpack(fdB, 25) -> 25
regdb_unpack_values: value[1]: name[ErrorControl] len[4]
regdb_fetch_values: Looking for values of key [HKLM\SYSTEM\CurrentControlSet\Services\Eventlog]
tdb_unpack(d, 4) -> 4
tdb_unpack(d, 69) -> 4
tdb_unpack(fdB, 65) -> 40
regdb_unpack_values: value[0]: name[DisplayName] len[20]
tdb_unpack(fdB, 25) -> 25
regdb_unpack_values: value[1]: name[ErrorControl] len[4]
tdb_unpack(d, 11) -> 4
reghook_cache_add: Adding ops 0x7f77270a9020 for key [\HKLM\SOFTWARE\Samba\smbconf]
pathtree_add: Enter
pathtree_find_child: Did not find [HKLM]
pathtree_birth_child: First child of node [NULL]! [HKLM]
pathtree_find_child: Did not find [SOFTWARE]
pathtree_birth_child: First child of node [HKLM]! [SOFTWARE]
pathtree_find_child: Did not find [Samba]
pathtree_birth_child: First child of node [SOFTWARE]! [Samba]
pathtree_find_child: Did not find [smbconf]
pathtree_birth_child: First child of node [Samba]! [smbconf]
pathtree_add: Successfully added node [HKLM\SOFTWARE\Samba\smbconf] to tree
pathtree_add: Exit
regdb_close: decrementing refcount (1->0)
regdb_open: registry db opened. refcount reset (1)
regkey_open_onelevel: name = [HKLM]
regdb_open: incrementing refcount (1->2)
reghook_cache_find: Searching for keyname [\HKLM]
pathtree_find: Enter [\HKLM]
pathtree_find: [loop] base => [HKLM], new_path => []
pathtree_find_child: child key => [HKLM]
pathtree_find_child: Found [HKLM]
pathtree_find: Found data_p!
pathtree_find: Exit
reghook_cache_find: found ops 0x7f77270a9100 for key [\HKLM]
regdb_fetch_keys: Enter key => [HKLM]
tdb_unpack(d, 20) -> 4
tdb_unpack(d, 20) -> 4
tdb_unpack(f, 16) -> 9
tdb_unpack(f, 7) -> 7
regdb_fetch_keys: Exit [2] items
regkey_open_onelevel: name = [SOFTWARE]
regdb_open: incrementing refcount (2->3)
reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE]
pathtree_find: Enter [\HKLM\SOFTWARE]
pathtree_find: [loop] base => [HKLM], new_path => [SOFTWARE]
pathtree_find_child: child key => [HKLM]
pathtree_find_child: Found [HKLM]
pathtree_find: [loop] base => [SOFTWARE], new_path => []
pathtree_find_child: child key => [SOFTWARE]
pathtree_find_child: Found [SOFTWARE]
pathtree_find: Found data_p!
pathtree_find: Exit
reghook_cache_find: found ops 0x7f77270a9100 for key [\HKLM\SOFTWARE]
regdb_fetch_keys: Enter key => [HKLM\SOFTWARE]
tdb_unpack(d, 29) -> 4
tdb_unpack(d, 29) -> 4
tdb_unpack(f, 25) -> 10
tdb_unpack(f, 15) -> 6
tdb_unpack(f, 9) -> 9
regdb_fetch_keys: Exit [3] items
regkey_open_onelevel: name = [Samba]
regdb_open: incrementing refcount (3->4)
reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Samba]
pathtree_find: Enter [\HKLM\SOFTWARE\Samba]
pathtree_find: [loop] base => [HKLM], new_path => [SOFTWARE\Samba]
pathtree_find_child: child key => [HKLM]
pathtree_find_child: Found [HKLM]
pathtree_find: [loop] base => [SOFTWARE], new_path => [Samba]
pathtree_find_child: child key => [SOFTWARE]
pathtree_find_child: Found [SOFTWARE]
pathtree_find: [loop] base => [Samba], new_path => []
pathtree_find_child: child key => [Samba]
pathtree_find_child: Found [Samba]
pathtree_find: Found data_p!
pathtree_find: Exit
reghook_cache_find: found ops 0x7f77270a9100 for key [\HKLM\SOFTWARE\Samba]
regdb_fetch_keys: Enter key => [HKLM\SOFTWARE\Samba]
tdb_unpack(d, 25) -> 4
tdb_unpack(d, 25) -> 4
tdb_unpack(f, 21) -> 8
tdb_unpack(f, 13) -> 13
regdb_fetch_keys: Exit [2] items
regkey_open_onelevel: name = [smbconf]
regdb_open: incrementing refcount (4->5)
reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Samba\smbconf]
pathtree_find: Enter [\HKLM\SOFTWARE\Samba\smbconf]
pathtree_find: [loop] base => [HKLM], new_path => [SOFTWARE\Samba\smbconf]
pathtree_find_child: child key => [HKLM]
pathtree_find_child: Found [HKLM]
pathtree_find: [loop] base => [SOFTWARE], new_path => [Samba\smbconf]
pathtree_find_child: child key => [SOFTWARE]
pathtree_find_child: Found [SOFTWARE]
pathtree_find: [loop] base => [Samba], new_path => [smbconf]
pathtree_find_child: child key => [Samba]
pathtree_find_child: Found [Samba]
pathtree_find: [loop] base => [smbconf], new_path => []
pathtree_find_child: child key => [smbconf]
pathtree_find_child: Found [smbconf]
pathtree_find: Found data_p!
pathtree_find: Exit
reghook_cache_find: found ops 0x7f77270a9020 for key [\HKLM\SOFTWARE\Samba\smbconf]
regdb_fetch_keys: Enter key => [HKLM\SOFTWARE\Samba\smbconf]
tdb_unpack(d, 11) -> 4
tdb_unpack(d, 11) -> 4
tdb_unpack(f, 7) -> 7
regdb_fetch_keys: Exit [1] items
regdb_close: decrementing refcount (5->4)
regdb_close: decrementing refcount (4->3)
regdb_close: decrementing refcount (3->2)
process_registry_service: service name global
regkey_open_onelevel: name = [global]
regdb_open: incrementing refcount (2->3)
reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Samba\smbconf\global]
pathtree_find: Enter [\HKLM\SOFTWARE\Samba\smbconf\global]
pathtree_find: [loop] base => [HKLM], new_path => [SOFTWARE\Samba\smbconf\global]
pathtree_find_child: child key => [HKLM]
pathtree_find_child: Found [HKLM]
pathtree_find: [loop] base => [SOFTWARE], new_path => [Samba\smbconf\global]
pathtree_find_child: child key => [SOFTWARE]
pathtree_find_child: Found [SOFTWARE]
pathtree_find: [loop] base => [Samba], new_path => [smbconf\global]
pathtree_find_child: child key => [Samba]
pathtree_find_child: Found [Samba]
pathtree_find: [loop] base => [smbconf], new_path => [global]
pathtree_find_child: child key => [smbconf]
pathtree_find_child: Found [smbconf]
pathtree_find: [loop] base => [global], new_path => []
pathtree_find_child: Did not find [global]
pathtree_find: Found data_p!
pathtree_find: Exit
reghook_cache_find: found ops 0x7f77270a9020 for key [\HKLM\SOFTWARE\Samba\smbconf\global]
regdb_fetch_keys: Enter key => [HKLM\SOFTWARE\Samba\smbconf\global]
tdb_unpack(d, 4) -> 4
tdb_unpack(d, 4) -> 4
regdb_fetch_keys: Exit [0] items
regdb_close: decrementing refcount (3->2)
regkey_open_onelevel: name = [global]
regdb_open: incrementing refcount (2->3)
reghook_cache_find: Searching for keyname [\HKLM\SOFTWARE\Samba\smbconf\global]
pathtree_find: Enter [\HKLM\SOFTWARE\Samba\smbconf\global]
pathtree_find: [loop] base => [HKLM], new_path => [SOFTWARE\Samba\smbconf\global]
pathtree_find_child: child key => [HKLM]
pathtree_find_child: Found [HKLM]
pathtree_find: [loop] base => [SOFTWARE], new_path => [Samba\smbconf\global]
pathtree_find_child: child key => [SOFTWARE]
pathtree_find_child: Found [SOFTWARE]
pathtree_find: [loop] base => [Samba], new_path => [smbconf\global]
pathtree_find_child: child key => [Samba]
pathtree_find_child: Found [Samba]
pathtree_find: [loop] base => [smbconf], new_path => [global]
pathtree_find_child: child key => [smbconf]
pathtree_find_child: Found [smbconf]
pathtree_find: [loop] base => [global], new_path => []
pathtree_find_child: Did not find [global]
pathtree_find: Found data_p!
pathtree_find: Exit
reghook_cache_find: found ops 0x7f77270a9020 for key [\HKLM\SOFTWARE\Samba\smbconf\global]
regdb_fetch_keys: Enter key => [HKLM\SOFTWARE\Samba\smbconf\global]
tdb_unpack(d, 4) -> 4
tdb_unpack(d, 4) -> 4
regdb_fetch_keys: Exit [0] items
fetch_reg_values called for key 'HKLM\SOFTWARE\Samba\smbconf\global' (ops 0x7f77270a9020)
regdb_fetch_values: Looking for values of key [HKLM\SOFTWARE\Samba\smbconf\global]
tdb_unpack(d, 4) -> 4
tdb_unpack(d, 1561) -> 4
tdb_unpack(fdB, 1557) -> 26
regdb_unpack_values: value[0]: name[workgroup] len[8]
tdb_unpack(fdB, 1531) -> 35
regdb_unpack_values: value[1]: name[netbios name] len[14]
tdb_unpack(fdB, 1496) -> 32
regdb_unpack_values: value[2]: name[realm] len[18]
tdb_unpack(fdB, 1464) -> 58
regdb_unpack_values: value[3]: name[kerberos method] len[34]
tdb_unpack(fdB, 1406) -> 78
regdb_unpack_values: value[4]: name[dedicated keytab file] len[48]
tdb_unpack(fdB, 1328) -> 31
regdb_unpack_values: value[5]: name[create krb5 conf] len[6]
tdb_unpack(fdB, 1297) -> 27
regdb_unpack_values: value[6]: name[security] len[10]
tdb_unpack(fdB, 1270) -> 30
regdb_unpack_values: value[7]: name[domain master] len[8]
tdb_unpack(fdB, 1240) -> 30
regdb_unpack_values: value[8]: name[domain logons] len[8]
tdb_unpack(fdB, 1210) -> 22
regdb_unpack_values: value[9]: name[log level] len[4]
tdb_unpack(fdB, 1188) -> 35
regdb_unpack_values: value[10]: name[max log size] len[14]
tdb_unpack(fdB, 1153) -> 61
regdb_unpack_values: value[11]: name[log file] len[44]
tdb_unpack(fdB, 1092) -> 127
regdb_unpack_values: value[12]: name[passdb backend] len[104]
tdb_unpack(fdB, 965) -> 32
regdb_unpack_values: value[13]: name[disable spoolss] len[8]
tdb_unpack(fdB, 933) -> 32
regdb_unpack_values: value[14]: name[ldapsam:trusted] len[8]
tdb_unpack(fdB, 901) -> 25
regdb_unpack_values: value[15]: name[ldap ssl] len[8]
tdb_unpack(fdB, 876) -> 50
regdb_unpack_values: value[16]: name[ldap suffix] len[30]
tdb_unpack(fdB, 826) -> 67
regdb_unpack_values: value[17]: name[ldap user suffix] len[42]
tdb_unpack(fdB, 759) -> 70
regdb_unpack_values: value[18]: name[ldap group suffix] len[44]
tdb_unpack(fdB, 689) -> 78
regdb_unpack_values: value[19]: name[ldap machine suffix] len[50]
tdb_unpack(fdB, 611) -> 46
regdb_unpack_values: value[20]: name[rpc_server:epmapper] len[18]
tdb_unpack(fdB, 565) -> 44
regdb_unpack_values: value[21]: name[rpc_server:lsarpc] len[18]
tdb_unpack(fdB, 521) -> 43
regdb_unpack_values: value[22]: name[rpc_server:lsass] len[18]
tdb_unpack(fdB, 478) -> 43
regdb_unpack_values: value[23]: name[rpc_server:lsasd] len[18]
tdb_unpack(fdB, 435) -> 42
regdb_unpack_values: value[24]: name[rpc_server:samr] len[18]
tdb_unpack(fdB, 393) -> 46
regdb_unpack_values: value[25]: name[rpc_server:netlogon] len[18]
tdb_unpack(fdB, 347) -> 33
regdb_unpack_values: value[26]: name[rpc_server:tcpip] len[8]
tdb_unpack(fdB, 314) -> 34
regdb_unpack_values: value[27]: name[rpc_daemon:epmd] len[10]
tdb_unpack(fdB, 280) -> 35
regdb_unpack_values: value[28]: name[rpc_daemon:lsasd] len[10]
tdb_unpack(fdB, 245) -> 41
regdb_unpack_values: value[29]: name[idmap config * : backend] len[8]
tdb_unpack(fdB, 204) -> 43
regdb_unpack_values: value[30]: name[idmap config * : range] len[12]
tdb_unpack(fdB, 161) -> 43
regdb_unpack_values: value[31]: name[idmap config IPA : backend] len[8]
tdb_unpack(fdB, 118) -> 81
regdb_unpack_values: value[32]: name[idmap config IPA : range] len[48]
tdb_unpack(fdB, 37) -> 37
regdb_unpack_values: value[33]: name[max smbd processes] len[10]
regdb_close: decrementing refcount (3->2)
Processing section "[global]"
doing parameter workgroup = IPA
doing parameter netbios name = MASTER
doing parameter realm = IPA.TEST
doing parameter kerberos method = dedicated keytab
doing parameter dedicated keytab file = /etc/samba/samba.keytab
doing parameter create krb5 conf = no
doing parameter security = user
doing parameter domain master = yes
doing parameter domain logons = yes
doing parameter log level = 1
doing parameter max log size = 100000
doing parameter log file = /var/log/samba/log.%m
doing parameter passdb backend = ipasam:ldapi://%2fvar%2frun%2fslapd-IPA-TEST.socket
doing parameter disable spoolss = yes
doing parameter ldapsam:trusted = yes
doing parameter ldap ssl = off
doing parameter ldap suffix = dc=ipa,dc=test
doing parameter ldap user suffix = cn=users,cn=accounts
doing parameter ldap group suffix = cn=groups,cn=accounts
doing parameter ldap machine suffix = cn=computers,cn=accounts
doing parameter rpc_server:epmapper = external
doing parameter rpc_server:lsarpc = external
doing parameter rpc_server:lsass = external
doing parameter rpc_server:lsasd = external
doing parameter rpc_server:samr = external
doing parameter rpc_server:netlogon = external
doing parameter rpc_server:tcpip = yes
doing parameter rpc_daemon:epmd = fork
doing parameter rpc_daemon:lsasd = fork
doing parameter idmap config * : backend = tdb
doing parameter idmap config * : range = 0 - 0
doing parameter idmap config IPA : backend = sss
doing parameter idmap config IPA : range = 1822600000 - 1822800000
doing parameter max smbd processes = 1000
lp_servicenumber: couldn't find homes
added interface eth0 ip=10.0.153.80 bcast=10.0.155.255 netmask=255.255.252.0
Netbios name list:-
my_netbios_names[0]="MASTER"
Client started (version 4.11.5).
Opening cache file at /var/lib/samba/lock/gencache.tdb
sitename_fetch: No stored sitename for realm 'IPA.TEST'
internal_resolve_name: looking up ad1.win2016.test#20 (sitename (null))
name ad1.win2016.test#20 found.
remove_duplicate_addrs2: looking for duplicate address/port pairs
samba_tevent: Added timed event "tevent_req_timedout": 0x564db8d0b2a0
Connecting to 10.0.153.139 at port 445
samba_tevent: Added timed event "tevent_req_timedout": 0x564db8d113d0
samba_tevent: Added timed event "tevent_req_timedout": 0x564db8d242c0
samba_tevent: Added timed event "tevent_req_timedout": 0x564db8d09670
samba_tevent: Destroying timer event 0x564db8d113d0 "tevent_req_timedout"
samba_tevent: Destroying timer event 0x564db8d0b2a0 "tevent_req_timedout"
samba_tevent: Destroying timer event 0x564db8d242c0 "tevent_req_timedout"
Socket options:
    SO_KEEPALIVE = 0
    SO_REUSEADDR = 0
    SO_BROADCAST = 0
    TCP_NODELAY = 1
    TCP_KEEPCNT = 9
    TCP_KEEPIDLE = 300
    TCP_KEEPINTVL = 75
    IPTOS_LOWDELAY = 0
    IPTOS_THROUGHPUT = 0
    SO_REUSEPORT = 0
    SO_SNDBUF = 87040
    SO_RCVBUF = 131072
    SO_SNDLOWAT = 1
    SO_RCVLOWAT = 1
    SO_SNDTIMEO = 0
    SO_RCVTIMEO = 0
    TCP_QUICKACK = 1
    TCP_DEFER_ACCEPT = 0
samba_tevent: Destroying timer event 0x564db8d09670 "tevent_req_timedout"
 session request ok
samba_tevent: Added timed event "tevent_req_timedout": 0x564db8d1d710
samba_tevent: Schedule immediate event "tevent_queue_immediate_trigger": 0x564db8d113d0
samba_tevent: Run immediate event "tevent_queue_immediate_trigger": 0x564db8d113d0
samba_tevent: Destroying timer event 0x564db8d1d710 "tevent_req_timedout"
samba_tevent: Schedule immediate event "tevent_req_trigger": 0x564db8d22230
samba_tevent: Run immediate event "tevent_req_trigger": 0x564db8d22230
 negotiated dialect[SMB3_11] against server[ad1.win2016.test]
cli_session_setup_spnego_send: Connect to ad1.win2016.test as admin@IPA.TEST using SPNEGO
GENSEC backend 'gssapi_spnego' registered
GENSEC backend 'gssapi_krb5' registered
GENSEC backend 'gssapi_krb5_sasl' registered
GENSEC backend 'spnego' registered
GENSEC backend 'schannel' registered
GENSEC backend 'naclrpc_as_system' registered
GENSEC backend 'sasl-EXTERNAL' registered
GENSEC backend 'ntlmssp' registered
GENSEC backend 'ntlmssp_resume_ccache' registered
GENSEC backend 'http_basic' registered
GENSEC backend 'http_ntlm' registered
GENSEC backend 'http_negotiate' registered
Starting GENSEC mechanism spnego
Starting GENSEC submechanism gse_krb5
samba_tevent: Schedule immediate event "tevent_req_trigger": 0x564db8d09530
gensec_update_send: gse_krb5[0x564db8d2a5f0]: subreq: 0x564db8d09440
gensec_update_send: spnego[0x564db8d20090]: subreq: 0x564db8d24590
samba_tevent: Run immediate event "tevent_req_trigger": 0x564db8d09530
gensec_update_done: gse_krb5[0x564db8d2a5f0]: NT_STATUS_MORE_PROCESSING_REQUIRED tevent_req[0x564db8d09440/../../source3/librpc/crypto/gse.c:842]: state[2] error[0 (0x0)]  state[struct gensec_gse_update_state (0x564db8d095f0)] timer[(nil)] finish[../../source3/librpc/crypto/gse.c:853]
gensec_update_done: spnego[0x564db8d20090]: NT_STATUS_MORE_PROCESSING_REQUIRED tevent_req[0x564db8d24590/../../auth/gensec/spnego.c:1630]: state[2] error[0 (0x0)]  state[struct gensec_spnego_update_state (0x564db8d24740)] timer[(nil)] finish[../../auth/gensec/spnego.c:2115]
samba_tevent: Added timed event "tevent_req_timedout": 0x564db8d281a0
samba_tevent: Schedule immediate event "tevent_queue_immediate_trigger": 0x564db8d113d0
samba_tevent: Run immediate event "tevent_queue_immediate_trigger": 0x564db8d113d0
samba_tevent: Destroying timer event 0x564db8d281a0 "tevent_req_timedout"
samba_tevent: Schedule immediate event "tevent_req_trigger": 0x564db8d3ebd0
samba_tevent: Run immediate event "tevent_req_trigger": 0x564db8d3ebd0
samba_tevent: Schedule immediate event "tevent_req_trigger": 0x564db8d25130
gensec_update_send: gse_krb5[0x564db8d2a5f0]: subreq: 0x564db8d25040
gensec_update_send: spnego[0x564db8d20090]: subreq: 0x564db8d37400
samba_tevent: Run immediate event "tevent_req_trigger": 0x564db8d25130
gensec_update_done: gse_krb5[0x564db8d2a5f0]: NT_STATUS_OK tevent_req[0x564db8d25040/../../source3/librpc/crypto/gse.c:842]: state[2] error[0 (0x0)]  state[struct gensec_gse_update_state (0x564db8d251f0)] timer[(nil)] finish[../../source3/librpc/crypto/gse.c:860]
gensec_update_done: spnego[0x564db8d20090]: NT_STATUS_OK tevent_req[0x564db8d37400/../../auth/gensec/spnego.c:1630]: state[2] error[0 (0x0)]  state[struct gensec_spnego_update_state (0x564db8d375b0)] timer[(nil)] finish[../../auth/gensec/spnego.c:2115]
Bad SMB2 signature for message
[0000] 00 00 00 00 00 00 00 00   00 00 00 00 00 00 00 00   ........ ........
[0000] 26 58 19 33 18 2D 0E 49   49 50 97 6D AF F6 1B AA   &X.3.-.I IP.m....
SPNEGO login failed: {Access Denied} A process has requested access to an object but has not been granted those access rights.
session setup failed: NT_STATUS_ACCESS_DENIED

I'm attaching the network trace and a keytab that contains all principals from AD DC side, including a trusted domain object for IPA-AD two-way trust.

win2016.keytabipa-ad-ldap-and-smb.pcap

Corresponding successful actions for AD user:

[root@master ~]# kinit Adminstrator@WIN2016.TEST
kinit: Client 'Adminstrator@WIN2016.TEST' not found in Kerberos database while getting initial credentials
[root@master ~]# kinit Administrator@WIN2016.TEST
Password for Administrator@WIN2016.TEST: 
[root@master ~]# ldapsearch -Y GSS-SPNEGO -h ad1.win2016.test -b dc=win2016,dc=test cn=Administrator
SASL/GSS-SPNEGO authentication started
SASL username: Administrator@WIN2016.TEST
SASL SSF: 256
SASL data security layer installed.
# extended LDIF
#
# LDAPv3
# base <dc=win2016,dc=test> with scope subtree
# filter: cn=Administrator
# requesting: ALL
#
# Administrator, Users, win2016.test
dn: CN=Administrator,CN=Users,DC=win2016,DC=test
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: user
cn: Administrator
description: Built-in account for administering the computer/domain
distinguishedName: CN=Administrator,CN=Users,DC=win2016,DC=test
instanceType: 4
whenCreated: 20200131082851.0Z
whenChanged: 20200131084425.0Z
uSNCreated: 8196
memberOf: CN=Group Policy Creator Owners,CN=Users,DC=win2016,DC=test
memberOf: CN=Domain Admins,CN=Users,DC=win2016,DC=test
memberOf: CN=Enterprise Admins,CN=Users,DC=win2016,DC=test
memberOf: CN=Schema Admins,CN=Users,DC=win2016,DC=test
memberOf: CN=Administrators,CN=Builtin,DC=win2016,DC=test
uSNChanged: 13279
name: Administrator
objectGUID:: xjBYOMFcYkCIKc2tJeBClA==
userAccountControl: 512
badPwdCount: 0
codePage: 0
countryCode: 0
badPasswordTime: 0
lastLogoff: 0
lastLogon: 132249370018807138
logonHours:: ////////////////////////////
pwdLastSet: 132249322773365571
primaryGroupID: 513
objectSid:: AQUAAAAAAAUVAAAAhvfyc7GAyaRfvmbT9AEAAA==
adminCount: 1
accountExpires: 0
logonCount: 205
sAMAccountName: Administrator
sAMAccountType: 805306368
objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=win2016,DC=test
isCriticalSystemObject: TRUE
dSCorePropagationData: 20200131084425.0Z
dSCorePropagationData: 20200131084425.0Z
dSCorePropagationData: 20200131082915.0Z
dSCorePropagationData: 16010101181216.0Z
lastLogonTimestamp: 132249329964431855
# search reference
ref: ldap://ForestDnsZones.win2016.test/DC=ForestDnsZones,DC=win2016,DC=test
# search reference
ref: ldap://sub1.win2016.test/DC=sub1,DC=win2016,DC=test
# search reference
ref: ldap://DomainDnsZones.win2016.test/DC=DomainDnsZones,DC=win2016,DC=test
# search reference
ref: ldap://win2016.test/CN=Configuration,DC=win2016,DC=test
# search result
search: 2
result: 0 Success
# numResponses: 6
# numEntries: 1
# numReferences: 4
[root@master ~]# smbclient -k -U Administrator@WIN2016.TEST //ad1.win2016.test/IPC\$
lp_load_ex: changing to config backend registry
Try "help" to get a list of possible commands.
smb: \> ls
NT_STATUS_INVALID_INFO_CLASS listing \*
smb: \> [root@master ~]# 
[root@master ~]# kdestroy -A

Software versions:

 rpm -q krb5-libs samba-client openldap-clients cyrus-sasl-gssapi
krb5-libs-1.17-45.fc31.x86_64
samba-client-4.11.5-20.test.fc31.x86_64
openldap-clients-2.4.47-3.fc31.x86_64
cyrus-sasl-gssapi-2.1.27-2.fc31.x86_64

BTW, the difference between IPA and AD user is that IPA user has no RC4-HMAC encryption keys but AD user has only RC4-HMAC key. The cross-realm tgt has both AES and RC4-HMAC encryption types:

$ klist -k -t -e win2016.keytab
Keytab name: FILE:win2016.keytab
KVNO Timestamp           Principal
---- ------------------- ------------------------------------------------------
   3 31.01.2020 10.50.59 IPA$@WIN2016.TEST (aes256-cts-hmac-sha1-96) 
   3 31.01.2020 10.50.59 IPA$@WIN2016.TEST (aes128-cts-hmac-sha1-96) 
   3 31.01.2020 10.50.59 IPA$@WIN2016.TEST (DEPRECATED:arcfour-hmac) 
   2 31.01.2020 10.50.59 krbtgt@WIN2016.TEST (aes256-cts-hmac-sha1-96) 
   2 31.01.2020 10.50.59 krbtgt@WIN2016.TEST (aes128-cts-hmac-sha1-96) 
   2 31.01.2020 10.50.59 krbtgt@WIN2016.TEST (DEPRECATED:arcfour-hmac) 
   1 31.01.2020 10.50.59 cloudbase-init@WIN2016.TEST (DEPRECATED:arcfour-hmac) 
   2 31.01.2020 10.50.59 SUB1$@WIN2016.TEST (aes256-cts-hmac-sha1-96) 
   2 31.01.2020 10.50.59 SUB1$@WIN2016.TEST (aes128-cts-hmac-sha1-96) 
   2 31.01.2020 10.50.59 SUB1$@WIN2016.TEST (DEPRECATED:arcfour-hmac) 
   1 31.01.2020 10.50.59 cyg_server@WIN2016.TEST (DEPRECATED:arcfour-hmac) 
   3 31.01.2020 10.50.59 AD1$@WIN2016.TEST (aes256-cts-hmac-sha1-96) 
   3 31.01.2020 10.50.59 AD1$@WIN2016.TEST (aes128-cts-hmac-sha1-96) 
   3 31.01.2020 10.50.59 AD1$@WIN2016.TEST (DEPRECATED:arcfour-hmac) 
   1 31.01.2020 10.50.59 Administrator@WIN2016.TEST (DEPRECATED:arcfour-hmac)

Discussing it with Isaac, we found that in krb5 1.17 or below authentication indicators are added in CAMMAC entry as a separate ad-if-relevant element before the PAC record. This, it seems, confuses Windows server implementation.

In krb5 1.18 (current git master) the code around sign_authdata() callback was changed to first retrieve existing PAC and then authentication indicators, to allow them to be passed to sign_authdata() callback for possible change of PAC or auth indicators. It means in 1.18 the behavior would be different -- PAC record would appear a first ad-if-relevant element, CAMMAC would be added to it.

Isaac is currently testing this idea.

@rharwood -- as we confirmed the issue is actually a CAMMAC data added before the PAC record, we might need to have a backport/fixes in 1.17 and earlier to make it possible to have tickets with authentication indicators working against Windows systems.

Thanks for the heads up. Will pay attention to the discussion.

@rharwood so we need to think about a solution for FreeIPA 4.8 for krb5 < 1.18. This affects Fedora 30-31 and RHEL 8.2 beta right now because we are now adding authentication indicators for SPAKE and FAST-wrapped OTP pre-authentication.

I think I'm missing something. Why is this more complicated than just backporting the upstream change in krb5?

Because krb5 change is an ABI and API change in DAL. You are not really wanting to make that breaking older releases, right?

The problem was mitigated in MIT krb5 git master when sign_authdata callback was changed to allow KDB modules to modify a list of authentication indicators with https://github.com/krb5/krb5/commit/7196c03f18f14695abeb5ae4923004469b172f0f#diff-857aff07799d2dce245f10c186400e23. There was no release with this API change and the signed_authdata callback was further modified to handle RBCD. So the final update on the API is bigger than needed for a backport.

I suspect we need to extract a part of the original commit that moves PAC generation fragment from https://github.com/krb5/krb5/commit/7196c03f18f14695abeb5ae4923004469b172f0f#diff-857aff07799d2dce245f10c186400e23 before CAMMAC generation (e.g. fetch_kdb_authdata call). That would be a small backport.

I also suspect we would need a part of https://github.com/krb5/krb5/commit/94f7c9705879500b1dc8dda8592490efce05688f which will allow both CAMMAC and PAC to exist. Since we now add CAMMAC to any IPA user authenticated with SPAKE, and PAC to any IPA user that has ipaNTSecurityIdentifier attribute (all users after ipa-adtrust-install --add-sids was done), we need the fix independently of RBCD work.

Following patch fixes the issue for me:

[root@master ~]# kdestroy -A
[root@master ~]# kinit admin
Password for admin@IPA.TEST: 
[root@master ~]# klist -A
Ticket cache: KCM:0
Default principal: admin@IPA.TEST
Valid starting     Expires            Service principal
02/05/20 09:32:54  02/06/20 09:32:51  krbtgt/IPA.TEST@IPA.TEST
[root@master ~]# smbclient -d5 -k -U admin@IPA.TEST //ad1.win2016.test/IPC\$
INFO: Current debug levels:
  all: 5
  tdb: 5
  printdrivers: 5
  lanman: 5
  smb: 5
  rpc_parse: 5
  rpc_srv: 5
  rpc_cli: 5
  passdb: 5
  sam: 5
  auth: 5
  winbind: 5
  vfs: 5
  idmap: 5
  quota: 5
  acls: 5
  locking: 5
  msdfs: 5
  dmapi: 5
  registry: 5
  scavenger: 5
  dns: 5
  ldb: 5
  tevent: 5
  auth_audit: 5
  auth_json_audit: 5
  kerberos: 5
  drs_repl: 5
  smb2: 5
  smb2_credits: 5
  dsdb_audit: 5
  dsdb_json_audit: 5
  dsdb_password_audit: 5
  dsdb_password_json_audit: 5
  dsdb_transaction_audit: 5
  dsdb_transaction_json_audit: 5
  dsdb_group_audit: 5
  dsdb_group_json_audit: 5
lp_load_ex: refreshing parameters
Initialising global parameters
rlimit_max: increasing rlimit_max (1024) to minimum Windows limit (16384)
INFO: Current debug levels:
  all: 5
  tdb: 5
  printdrivers: 5
  lanman: 5
  smb: 5
  rpc_parse: 5
  rpc_srv: 5
  rpc_cli: 5
  passdb: 5
  sam: 5
  auth: 5
  winbind: 5
  vfs: 5
  idmap: 5
  quota: 5
  acls: 5
  locking: 5
  msdfs: 5
  dmapi: 5
  registry: 5
  scavenger: 5
  dns: 5
  ldb: 5
  tevent: 5
  auth_audit: 5
  auth_json_audit: 5
  kerberos: 5
  drs_repl: 5
  smb2: 5
  smb2_credits: 5
  dsdb_audit: 5
  dsdb_json_audit: 5
  dsdb_password_audit: 5
  dsdb_password_json_audit: 5
  dsdb_transaction_audit: 5
  dsdb_transaction_json_audit: 5
  dsdb_group_audit: 5
  dsdb_group_json_audit: 5
Processing section "[global]"
doing parameter debug pid = yes
doing parameter config backend = registry
pm_process() returned Yes
lp_load_ex: changing to config backend registry
Freeing parametrics:
Initialising global parameters
rlimit_max: increasing rlimit_max (1024) to minimum Windows limit (16384)
INFO: Current debug levels:
  all: 5
  tdb: 5
  printdrivers: 5
  lanman: 5
  smb: 5
  rpc_parse: 5
  rpc_srv: 5
  rpc_cli: 5
  passdb: 5
  sam: 5
  auth: 5
  winbind: 5
  vfs: 5
  idmap: 5
  quota: 5
  acls: 5
  locking: 5
  msdfs: 5
  dmapi: 5
  registry: 5
  scavenger: 5
  dns: 5
  ldb: 5
  tevent: 5
  auth_audit: 5
  auth_json_audit: 5
  kerberos: 5
  drs_repl: 5
  smb2: 5
  smb2_credits: 5
  dsdb_audit: 5
  dsdb_json_audit: 5
  dsdb_password_audit: 5
  dsdb_password_json_audit: 5
  dsdb_transaction_audit: 5
  dsdb_transaction_json_audit: 5
  dsdb_group_audit: 5
  dsdb_group_json_audit: 5
lp_load_ex: refreshing parameters
Initialising global parameters
rlimit_max: increasing rlimit_max (1024) to minimum Windows limit (16384)
INFO: Current debug levels:
  all: 5
  tdb: 5
  printdrivers: 5
  lanman: 5
  smb: 5
  rpc_parse: 5
  rpc_srv: 5
  rpc_cli: 5
  passdb: 5
  sam: 5
  auth: 5
  winbind: 5
  vfs: 5
  idmap: 5
  quota: 5
  acls: 5
  locking: 5
  msdfs: 5
  dmapi: 5
  registry: 5
  scavenger: 5
  dns: 5
  ldb: 5
  tevent: 5
  auth_audit: 5
  auth_json_audit: 5
  kerberos: 5
  drs_repl: 5
  smb2: 5
  smb2_credits: 5
  dsdb_audit: 5
  dsdb_json_audit: 5
  dsdb_password_audit: 5
  dsdb_password_json_audit: 5
  dsdb_transaction_audit: 5
  dsdb_transaction_json_audit: 5
  dsdb_group_audit: 5
  dsdb_group_json_audit: 5
doing parameter registry shares = yes
process_registry_service: service name global
Processing section "[global]"
doing parameter workgroup = IPA
doing parameter netbios name = MASTER
doing parameter realm = IPA.TEST
doing parameter kerberos method = dedicated keytab
doing parameter dedicated keytab file = /etc/samba/samba.keytab
doing parameter create krb5 conf = no
doing parameter security = user
doing parameter domain master = yes
doing parameter domain logons = yes
doing parameter log level = 1
doing parameter max log size = 100000
doing parameter log file = /var/log/samba/log.%m
doing parameter passdb backend = ipasam:ldapi://%2fvar%2frun%2fslapd-IPA-TEST.socket
doing parameter disable spoolss = yes
doing parameter ldapsam:trusted = yes
doing parameter ldap ssl = off
doing parameter ldap suffix = dc=ipa,dc=test
doing parameter ldap user suffix = cn=users,cn=accounts
doing parameter ldap group suffix = cn=groups,cn=accounts
doing parameter ldap machine suffix = cn=computers,cn=accounts
doing parameter rpc_server:epmapper = external
doing parameter rpc_server:lsarpc = external
doing parameter rpc_server:lsass = external
doing parameter rpc_server:lsasd = external
doing parameter rpc_server:samr = external
doing parameter rpc_server:netlogon = external
doing parameter rpc_server:tcpip = yes
doing parameter rpc_daemon:epmd = fork
doing parameter rpc_daemon:lsasd = fork
doing parameter idmap config * : backend = tdb
doing parameter idmap config * : range = 0 - 0
doing parameter idmap config IPA : backend = sss
doing parameter idmap config IPA : range = 959400000 - 959600000
doing parameter max smbd processes = 1000
added interface eth0 ip=10.0.152.167 bcast=10.0.155.255 netmask=255.255.252.0
Netbios name list:-
my_netbios_names[0]="MASTER"
Client started (version 4.11.6).
Opening cache file at /var/lib/samba/lock/gencache.tdb
sitename_fetch: No stored sitename for realm 'IPA.TEST'
no entry for ad1.win2016.test#20 found.
resolve_hosts: Attempting host lookup for name ad1.win2016.test<0x20>
namecache_store: storing 1 address for ad1.win2016.test#20: 10.0.152.241
Connecting to 10.0.152.241 at port 445
Socket options:
    SO_KEEPALIVE = 0
    SO_REUSEADDR = 0
    SO_BROADCAST = 0
    TCP_NODELAY = 1
    TCP_KEEPCNT = 9
    TCP_KEEPIDLE = 300
    TCP_KEEPINTVL = 75
    IPTOS_LOWDELAY = 0
    IPTOS_THROUGHPUT = 0
    SO_REUSEPORT = 0
    SO_SNDBUF = 87040
    SO_RCVBUF = 131072
    SO_SNDLOWAT = 1
    SO_RCVLOWAT = 1
    SO_SNDTIMEO = 0
    SO_RCVTIMEO = 0
    TCP_QUICKACK = 1
    TCP_DEFER_ACCEPT = 0
 session request ok
 negotiated dialect[SMB3_11] against server[ad1.win2016.test]
cli_session_setup_spnego_send: Connect to ad1.win2016.test as admin@IPA.TEST using SPNEGO
GENSEC backend 'gssapi_spnego' registered
GENSEC backend 'gssapi_krb5' registered
GENSEC backend 'gssapi_krb5_sasl' registered
GENSEC backend 'spnego' registered
GENSEC backend 'schannel' registered
GENSEC backend 'naclrpc_as_system' registered
GENSEC backend 'sasl-EXTERNAL' registered
GENSEC backend 'ntlmssp' registered
GENSEC backend 'ntlmssp_resume_ccache' registered
GENSEC backend 'http_basic' registered
GENSEC backend 'http_ntlm' registered
GENSEC backend 'http_negotiate' registered
Starting GENSEC mechanism spnego
Starting GENSEC submechanism gse_krb5
 session setup ok
signed SMB2 message
 tconx ok
Try "help" to get a list of possible commands.
smb: \> signed SMB2 message
[root@master ~]# klist -A
Ticket cache: KCM:0
Default principal: admin@IPA.TEST
Valid starting     Expires            Service principal
02/05/20 09:33:27  02/05/20 19:33:27  krbtgt/WIN2016.TEST@WIN2016.TEST
02/05/20 09:32:54  02/06/20 09:32:51  krbtgt/IPA.TEST@IPA.TEST
02/05/20 09:33:27  02/05/20 19:33:27  cifs/ad1.win2016.test@WIN2016.TEST

and with LDAP access:

[root@master ~]# KRB5_TRACE=/dev/stderr ldapsearch -Y GSS-SPNEGO -h ad1.win2016.test -b dc=win2016,dc=test cn=administrator
SASL/GSS-SPNEGO authentication started
[34690] 1580894961.877172: ccselect can't find appropriate cache for server principal ldap/ad1.win2016.test@WIN2016.TEST
[34690] 1580894961.877173: Getting credentials admin@IPA.TEST -> ldap/ad1.win2016.test@WIN2016.TEST using ccache KCM:0
[34690] 1580894961.877174: Retrieving admin@IPA.TEST -> ldap/ad1.win2016.test@WIN2016.TEST from KCM:0 with result: -1765328243/Matching credential not found
[34690] 1580894961.877175: Retrieving admin@IPA.TEST -> krbtgt/WIN2016.TEST@WIN2016.TEST from KCM:0 with result: -1765328243/Matching credential not found
[34690] 1580894961.877176: Retrieving admin@IPA.TEST -> krbtgt/IPA.TEST@IPA.TEST from KCM:0 with result: 0/Success
[34690] 1580894961.877177: Starting with TGT for client realm: admin@IPA.TEST -> krbtgt/IPA.TEST@IPA.TEST
[34690] 1580894962.3623: Retrieving admin@IPA.TEST -> krbtgt/WIN2016.TEST@WIN2016.TEST from KCM:0 with result: -1765328243/Matching credential not found
[34690] 1580894962.3624: Requesting TGT krbtgt/WIN2016.TEST@IPA.TEST using TGT krbtgt/IPA.TEST@IPA.TEST
[34690] 1580894962.3625: Generated subkey for TGS request: aes256-cts/2FBF
[34690] 1580894962.3626: etypes requested in TGS request: aes256-cts, aes128-cts, aes256-sha2, aes128-sha2, rc4-hmac, camellia128-cts, camellia256-cts
[34690] 1580894962.3628: Encoding request body and padata into FAST request
[34690] 1580894962.3629: Sending request (1614 bytes) to IPA.TEST
[34690] 1580894962.3630: Initiating TCP connection to stream 10.0.152.167:88
[34690] 1580894962.3631: Sending TCP request to stream 10.0.152.167:88
[34690] 1580894962.3632: Received answer (1512 bytes) from stream 10.0.152.167:88
[34690] 1580894962.3633: Terminating TCP connection to stream 10.0.152.167:88
[34690] 1580894962.3634: Response was from master KDC
[34690] 1580894962.3635: Decoding FAST response
[34690] 1580894962.3636: FAST reply key: aes256-cts/9487
[34690] 1580894962.3637: TGS reply is for admin@IPA.TEST -> krbtgt/WIN2016.TEST@IPA.TEST with session key aes256-cts/84BE
[34690] 1580894962.3638: TGS request result: 0/Success
[34690] 1580894962.3639: Received TGT for WIN2016.TEST; advancing current realm
[34690] 1580894962.3640: Retrieving admin@IPA.TEST -> krbtgt/WIN2016.TEST@WIN2016.TEST from KCM:0 with result: -1765328243/Matching credential not found
[34690] 1580894962.3641: Requesting TGT krbtgt/WIN2016.TEST@WIN2016.TEST using TGT krbtgt/WIN2016.TEST@IPA.TEST
[34690] 1580894962.3642: Generated subkey for TGS request: aes256-cts/136F
[34690] 1580894962.3643: etypes requested in TGS request: aes256-cts, aes128-cts, aes256-sha2, aes128-sha2, rc4-hmac, camellia128-cts, camellia256-cts
[34690] 1580894962.3645: Encoding request body and padata into FAST request
[34690] 1580894962.3646: Sending request (1589 bytes) to WIN2016.TEST
[34690] 1580894962.3647: Initiating TCP connection to stream 10.0.152.241:88
[34690] 1580894962.3648: Sending TCP request to stream 10.0.152.241:88
[34690] 1580894962.3649: Received answer (1412 bytes) from stream 10.0.152.241:88
[34690] 1580894962.3650: Terminating TCP connection to stream 10.0.152.241:88
[34690] 1580894962.3651: Response was from master KDC
[34690] 1580894962.3652: Decoding FAST response
[34690] 1580894962.3653: FAST reply key: aes256-cts/853E
[34690] 1580894962.3654: TGS reply is for admin@IPA.TEST -> krbtgt/WIN2016.TEST@WIN2016.TEST with session key aes256-cts/C48E
[34690] 1580894962.3655: TGS request result: 0/Success
[34690] 1580894962.3656: Storing admin@IPA.TEST -> krbtgt/WIN2016.TEST@WIN2016.TEST in KCM:0
[34690] 1580894962.3657: Received TGT for service realm: krbtgt/WIN2016.TEST@WIN2016.TEST
[34690] 1580894962.3658: Requesting tickets for ldap/ad1.win2016.test@WIN2016.TEST, referrals on
[34690] 1580894962.3659: Generated subkey for TGS request: aes256-cts/4570
[34690] 1580894962.3660: etypes requested in TGS request: aes256-cts, aes128-cts, aes256-sha2, aes128-sha2, rc4-hmac, camellia128-cts, camellia256-cts
[34690] 1580894962.3662: Encoding request body and padata into FAST request
[34690] 1580894962.3663: Sending request (1489 bytes) to WIN2016.TEST
[34690] 1580894962.3664: Initiating TCP connection to stream 10.0.152.241:88
[34690] 1580894962.3665: Sending TCP request to stream 10.0.152.241:88
[34690] 1580894962.3666: Received answer (1440 bytes) from stream 10.0.152.241:88
[34690] 1580894962.3667: Terminating TCP connection to stream 10.0.152.241:88
[34690] 1580894962.3668: Response was from master KDC
[34690] 1580894962.3669: Decoding FAST response
[34690] 1580894962.3670: FAST reply key: aes256-cts/18F7
[34690] 1580894962.3671: TGS reply is for admin@IPA.TEST -> ldap/ad1.win2016.test@WIN2016.TEST with session key aes256-cts/6636
[34690] 1580894962.3672: TGS request result: 0/Success
[34690] 1580894962.3673: Received creds for desired service ldap/ad1.win2016.test@WIN2016.TEST
[34690] 1580894962.3674: Storing admin@IPA.TEST -> ldap/ad1.win2016.test@WIN2016.TEST in KCM:0
[34690] 1580894962.3676: Creating authenticator for admin@IPA.TEST -> ldap/ad1.win2016.test@WIN2016.TEST, seqnum 352069573, subkey aes256-cts/29F0, session key aes256-cts/6636
[34690] 1580894962.3681: Read AP-REP, time 1580894962.3677, subkey aes256-cts/DAAD, seqnum 1050652895
SASL username: admin@IPA.TEST
SASL SSF: 256
SASL data security layer installed.
# extended LDIF
#
# LDAPv3
# base <dc=win2016,dc=test> with scope subtree
# filter: cn=administrator
# requesting: ALL
#
# Administrator, Users, win2016.test
dn: CN=Administrator,CN=Users,DC=win2016,DC=test
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: user
cn: Administrator
description: Built-in account for administering the computer/domain
distinguishedName: CN=Administrator,CN=Users,DC=win2016,DC=test
instanceType: 4
whenCreated: 20200205081815.0Z
whenChanged: 20200205083345.0Z
uSNCreated: 8196
memberOf: CN=Group Policy Creator Owners,CN=Users,DC=win2016,DC=test
memberOf: CN=Domain Admins,CN=Users,DC=win2016,DC=test
memberOf: CN=Enterprise Admins,CN=Users,DC=win2016,DC=test
memberOf: CN=Schema Admins,CN=Users,DC=win2016,DC=test
memberOf: CN=Administrators,CN=Builtin,DC=win2016,DC=test
uSNChanged: 13264
name: Administrator
objectGUID:: FngzRXbbFU67VBO9KTFxvQ==
userAccountControl: 512
badPwdCount: 0
codePage: 0
countryCode: 0
badPasswordTime: 0
lastLogoff: 0
lastLogon: 132253664622915712
logonHours:: ////////////////////////////
pwdLastSet: 132253635360254120
primaryGroupID: 513
objectSid:: AQUAAAAAAAUVAAAAbL9gGYyb/4nL8OH/9AEAAA==
adminCount: 1
accountExpires: 0
logonCount: 204
sAMAccountName: Administrator
sAMAccountType: 805306368
objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=win2016,DC=test
isCriticalSystemObject: TRUE
dSCorePropagationData: 20200205083345.0Z
dSCorePropagationData: 20200205083345.0Z
dSCorePropagationData: 20200205081835.0Z
dSCorePropagationData: 16010101181216.0Z
lastLogonTimestamp: 132253643558071834
# search reference
ref: ldap://ForestDnsZones.win2016.test/DC=ForestDnsZones,DC=win2016,DC=test
# search reference
ref: ldap://sub1.win2016.test/DC=sub1,DC=win2016,DC=test
# search reference
ref: ldap://DomainDnsZones.win2016.test/DC=DomainDnsZones,DC=win2016,DC=test
# search reference
ref: ldap://win2016.test/CN=Configuration,DC=win2016,DC=test
# search result
search: 2
result: 0 Success
# numResponses: 6
# numEntries: 1
# numReferences: 4

freeipa-ticket-8185-support.patch

samba and freeipa are the only users of the DAL. I'd be fine with just rebasing in Fedora.

We discussed with Isaac that a fix from https://github.com/krb5/krb5/pull/1033 is actually more appropriate. It is small: https://github.com/krb5/krb5/commit/6fe918ad7db80056dfbb615b2dc248670189e585.patch, I tried it on my test environment and it also works where the original 1.17 in F31 is not working.

@rharwood I'm not sure it makes sense to rebase F31 to krb5 1.18 -- there are other API and ABI changes there that broke other packages.

FWIW, just applying 1033 was my original plan, but I assumed I was missing something.

krb5 does not break API/ABI between releases in stable libraries (i.e., everything except libkadm5/the KDB).

Pushed to rawhide. f31 bodhi needs karma: https://bodhi.fedoraproject.org/updates/FEDORA-2020-f5beaa44a6

Metadata Update from @abbra:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

Since the fixes are in krb5 upstream, Fedora rawhide and Fedora 31, close this ticket.
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.