Dear Maintainer,

*** Reporter, please consider answering these questions, where appropriate ***

   * What led up to the situation?

For 15 years I've been using samba in a situation where the server is standalone,
and has users provided by LDAP and a kerberos KDC. The server uses sssd and works fine for ssh,
login, and every other kerberos enabled thing.

   * What exactly did you do (or not do) that was effective (or
     ineffective)?

Upgraded samba from previous version, not sure which version but would have been 4.8 ish


   * What was the outcome of this action?

samba no longer works with Kerberos unless it is joined to a full
Microsoft Active Directory Domain Controller.

Please see discussions on the samba mailing list in the thread starting here:

https://lists.samba.org/archive/samba/2023-April/244842.html

The situation appears to be that samba moved to using winbindd to do authentication, and this
combination samba + winbindd can't imagine a scenario in which there is a KDC which is not an AD DC.

What I want, and has worked for 15 years, and clearly has been done by plenty of other people in the
past based on google searches, is that a client gets a ticket from the KDC and uses it to authenticate
to a standalone samba server which is not a part of an AD DC but IS a part of an MIT Kerberos KDC realm.

It appears that this is an upstream "bug" in which a particular use case simply did not get considered
when rearchitecting the samba security system, and hence disappeared. However it affects Debian users
who have been using this technique such as myself, and certainly others.

This is probably related to previous bugs and other users have corroborated having related issues:

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1001053

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=899269

Hello!

14.04.2023 20:49, Daniel Lakeland wrote:

..

But I have a question for you, as the reporter of this bug:
What do you expect us the debian samba maintainers to do with it?
I definitely will not change samba in a way not approved by the
upstream. Also, I wont try to find out what the problem is and
how to deal with it as I don't have neither enough experience
in that area nor time nor motivation. If this bugreport stays
here for years, what good will it serve? I can immediately
think about a downside: it will keep my attention constantly
drawn away when I look for bugs to triage, so I'll have less
resources for other bugs I can possible fix.

You've been offered a workaround, too, in some way.

FWIF, you're the only user in this world who uses this configuration,
it looks like. Because the version where this configuration broke is
quite old, unsupported for a long time, and has many bugs including
easy triggerable security issues.

So I'm not sure for the severity of this bugreport.  I'd move it
to "wontfix" severity..

Thanks,

/mjt

Hi Michael, my concern is mainly to document the existence of this
problem for others who might use this similar config. I'm 100% sure I'm
not the only one in the world. There are debian bugs going back a while
where others have this kind of set up and had issues. I'll continue to
try to figure out the work around, and then document the method I came
up with here, and then we can close the bug so it's preserved for others
with similar issues?

Agreed that you won't make changes they don't approve, but it's possible
they'll realize that they've done something unintended and make some
changes based on my concerns etc. Or not. Let's not make this bug be a
thorn in your side for a long time, but let's leave it open for
documenting the issue and its resolution or non-resolution for a
sufficiently long time that it's clear whether this is permanently
unsupported, or only temporarily or requires some specific config.
Googling debian bugs can be an amazingly helpful way to figure out the
solutions to problems for others.

15.04.2023 00:03, Daniel Lakeland wrote:
...

It looks like you're one of maybe just a few people in the world
who uses this config with samba and stand-alone ldap and kdc, after
samba made everything to be internal because separate components
were basically unmanageable.

In order for this bug report to not disturb my workflow (not to pay
more attention to it every time I look at samba bugs), - since it
is for documentation purpose only, I'm lowering severity of it and
adding a "wontfix" tag.

Thanks,

/mjt

Per https://lists.samba.org/archive/samba/2023-April/244999.html it
*might* work if the MIT KDC were adjusted not to issue a PAC
https://web.mit.edu/kerberos/krb5-1.20/ suggests disable_pac in the
realm configuration on the KDC.
Andrew Bartlett