#1052245 SMB authentication failure against main server

Package:
debian-edu-config
Source:
debian-edu-config
Submitter:
Guido Berhoerster
Date:
2023-09-26 13:36:02 UTC
Severity:
normal
#1052245#5
Date:
2023-09-19 12:08:33 UTC
From:
To:
Currently, it is not possible with either gvfs nor smbclient to access a user's
home directory due to an authentication failure.

$ klist
Ticket cache: FILE:/tmp/krb5cc_1003_X8fbPu
Default principal: gber@INTERN

Valid starting     Expires            Service principal
09/19/23 13:12:44  09/19/23 23:12:44  krbtgt/INTERN@INTERN
	renew until 09/20/23 13:12:44
09/19/23 13:13:16  09/19/23 23:12:44  cifs/tjener.intern@INTERN
	renew until 09/20/23 13:12:44

$ smbclient -d 99 --use-kerberos=required -U 'TJENER\gber' '\\tjener.intern\homes\'
INFO: Current debug levels:
  all: 99
  tdb: 99
  printdrivers: 99
  lanman: 99
  smb: 99
  rpc_parse: 99
  rpc_srv: 99
  rpc_cli: 99
  passdb: 99
  sam: 99
  auth: 99
  winbind: 99
  vfs: 99
  idmap: 99
  quota: 99
  acls: 99
  locking: 99
  msdfs: 99
  dmapi: 99
  registry: 99
  scavenger: 99
  dns: 99
  ldb: 99
  tevent: 99
  auth_audit: 99
  auth_json_audit: 99
  kerberos: 99
  drs_repl: 99
  smb2: 99
  smb2_credits: 99
  dsdb_audit: 99
  dsdb_json_audit: 99
  dsdb_password_audit: 99
  dsdb_password_json_audit: 99
  dsdb_transaction_audit: 99
  dsdb_transaction_json_audit: 99
  dsdb_group_audit: 99
  dsdb_group_json_audit: 99
lp_load_ex: refreshing parameters
Initialising global parameters
rlimit_max: increasing rlimit_max (1024) to minimum Windows limit (16384)
INFO: Current debug levels:
  all: 99
  tdb: 99
  printdrivers: 99
  lanman: 99
  smb: 99
  rpc_parse: 99
  rpc_srv: 99
  rpc_cli: 99
  passdb: 99
  sam: 99
  auth: 99
  winbind: 99
  vfs: 99
  idmap: 99
  quota: 99
  acls: 99
  locking: 99
  msdfs: 99
  dmapi: 99
  registry: 99
  scavenger: 99
  dns: 99
  ldb: 99
  tevent: 99
  auth_audit: 99
  auth_json_audit: 99
  kerberos: 99
  drs_repl: 99
  smb2: 99
  smb2_credits: 99
  dsdb_audit: 99
  dsdb_json_audit: 99
  dsdb_password_audit: 99
  dsdb_password_json_audit: 99
  dsdb_transaction_audit: 99
  dsdb_transaction_json_audit: 99
  dsdb_group_audit: 99
  dsdb_group_json_audit: 99
Processing section "[global]"
doing parameter workgroup = skolelinux
doing parameter log file = /var/log/samba/log.%m
doing parameter max log size = 1000
doing parameter logging = file
doing parameter panic action = /usr/share/samba/panic-action %d
doing parameter server role = standalone server
doing parameter obey pam restrictions = yes
doing parameter unix password sync = yes
doing parameter passwd program = /usr/bin/passwd %u
doing parameter passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .
doing parameter pam password change = yes
doing parameter map to guest = bad user
doing parameter usershare allow guests = yes
pm_process() returned Yes
lp_servicenumber: couldn't find homes
added interface eth0 ip=10.0.2.20 bcast=10.255.255.255 netmask=255.0.0.0
Password for [TJENER\gber]:Client started (version 4.17.10-Debian).
Opening cache file at /run/samba/gencache.tdb
tdb(/run/samba/gencache.tdb): tdb_open_ex: could not open file /run/samba/gencache.tdb: Permission denied
gencache_init: Opening user cache file /skole/tjener/home0/gber/.cache/samba/gencache.tdb.
sitename_fetch: No stored sitename for realm ''
internal_resolve_name: looking up tjener.intern#20 (sitename (null))
namecache_fetch: name tjener.intern#20 found.
remove_duplicate_addrs2: looking for duplicate address/port pairs
samba_tevent: Added timed event "tevent_req_timedout": 0x55612aa9f2b0
Connecting to 10.0.2.2 at port 445
samba_tevent: Added timed event "tevent_req_timedout": 0x55612aa9fb50
samba_tevent: Added timed event "tevent_req_timedout": 0x55612aa87d00
samba_tevent: Destroying timer event 0x55612aa9f2b0 "tevent_req_timedout"
samba_tevent: Destroying timer event 0x55612aa9fb50 "tevent_req_timedout"
socket options: SO_KEEPALIVE=0, SO_REUSEADDR=0, SO_BROADCAST=0, TCP_NODELAY=1, TCP_KEEPCNT=9, TCP_KEEPIDLE=7200, TCP_KEEPINTVL=75, IPTOS_LOWDELAY=0, IPTOS_THROUGHPUT=0, SO_REUSEPORT=0, SO_SNDBUF=87040, SO_RCVBUF=131072, SO_SNDLOWAT=1, SO_RCVLOWAT=1, SO_SNDTIMEO=0, SO_RCVTIMEO=0, TCP_QUICKACK=1, TCP_DEFER_ACCEPT=0, TCP_USER_TIMEOUT=0
samba_tevent: Destroying timer event 0x55612aa87d00 "tevent_req_timedout"
 session request ok
samba_tevent: Added timed event "tevent_req_timedout": 0x55612aa986f0
samba_tevent: Schedule immediate event "tevent_req_trigger": 0x55612aa9ed60
samba_tevent: Cancel immediate event 0x55612aa9ed60 "tevent_req_trigger"
samba_tevent: Schedule immediate event "tevent_req_trigger": 0x55612aa9ed60
samba_tevent: Run immediate event "tevent_req_trigger": 0x55612aa9ed60
samba_tevent: Destroying timer event 0x55612aa986f0 "tevent_req_timedout"
samba_tevent: Schedule immediate event "tevent_req_trigger": 0x55612aaa0cd0
samba_tevent: Run immediate event "tevent_req_trigger": 0x55612aaa0cd0
 negotiated dialect[SMB3_11] against server[tjener.intern]
cli_session_setup_spnego_send: Connect to tjener.intern as gber@TJENER using SPNEGO
GENSEC backend 'gssapi_spnego' registered
GENSEC backend 'gssapi_krb5' registered
GENSEC backend 'gssapi_krb5_sasl' registered
GENSEC backend 'spnego' registered
GENSEC backend 'schannel' registered
GENSEC backend 'ncalrpc_as_system' registered
GENSEC backend 'sasl-EXTERNAL' registered
GENSEC backend 'ntlmssp' registered
GENSEC backend 'ntlmssp_resume_ccache' registered
GENSEC backend 'http_basic' registered
GENSEC backend 'http_ntlm' registered
GENSEC backend 'http_negotiate' registered
GENSEC backend 'krb5' registered
GENSEC backend 'fake_gssapi_krb5' registered
Starting GENSEC mechanism spnego
Starting GENSEC submechanism gse_krb5
samba_tevent: Schedule immediate event "tevent_req_trigger": 0x55612aa9fa10
gensec_update_send: gse_krb5[0x55612aaa0ad0]: subreq: 0x55612aa9f920
gensec_update_send: spnego[0x55612aa9e7c0]: subreq: 0x55612aaa3610
samba_tevent: Run immediate event "tevent_req_trigger": 0x55612aa9fa10
gensec_update_done: gse_krb5[0x55612aaa0ad0]: NT_STATUS_MORE_PROCESSING_REQUIRED tevent_req[0x55612aa9f920/../../source3/librpc/crypto/gse.c:895]: state[2] error[0 (0x0)]  state[struct gensec_gse_update_state (0x55612aa9fae0)] timer[(nil)] finish[../../source3/librpc/crypto/gse.c:906]
gensec_update_done: spnego[0x55612aa9e7c0]: NT_STATUS_MORE_PROCESSING_REQUIRED tevent_req[0x55612aaa3610/../../auth/gensec/spnego.c:1631]: state[2] error[0 (0x0)]  state[struct gensec_spnego_update_state (0x55612aaa37d0)] timer[(nil)] finish[../../auth/gensec/spnego.c:2116]
samba_tevent: Added timed event "tevent_req_timedout": 0x55612aa986f0
samba_tevent: Schedule immediate event "tevent_req_trigger": 0x55612aaadc30
samba_tevent: Cancel immediate event 0x55612aaadc30 "tevent_req_trigger"
samba_tevent: Schedule immediate event "tevent_req_trigger": 0x55612aaadc30
samba_tevent: Run immediate event "tevent_req_trigger": 0x55612aaadc30
samba_tevent: Destroying timer event 0x55612aa986f0 "tevent_req_timedout"
samba_tevent: Schedule immediate event "tevent_req_trigger": 0x55612aaad6a0
samba_tevent: Run immediate event "tevent_req_trigger": 0x55612aaad6a0
SPNEGO login failed: An invalid parameter was passed to a service or function.

session setup failed: NT_STATUS_INVALID_PARAMETER

The samba log on tjener:

[2023/09/19 14:04:01.336794,  5] ../../source3/auth/auth.c:565(make_auth3_context_for_ntlm)
  make_auth3_context_for_ntlm: Making default auth method list for server role = 'standalone server', encrypt passwords = yes
[2023/09/19 14:04:01.336861,  5] ../../source3/auth/auth.c:52(smb_register_auth)
  Attempting to register auth backend anonymous
[2023/09/19 14:04:01.336882,  5] ../../source3/auth/auth.c:64(smb_register_auth)
  Successfully added auth method 'anonymous'
[2023/09/19 14:04:01.336893,  5] ../../source3/auth/auth.c:52(smb_register_auth)
  Attempting to register auth backend sam
[2023/09/19 14:04:01.336901,  5] ../../source3/auth/auth.c:64(smb_register_auth)
  Successfully added auth method 'sam'
[2023/09/19 14:04:01.336908,  5] ../../source3/auth/auth.c:52(smb_register_auth)
  Attempting to register auth backend sam_ignoredomain
[2023/09/19 14:04:01.336914,  5] ../../source3/auth/auth.c:64(smb_register_auth)
  Successfully added auth method 'sam_ignoredomain'
[2023/09/19 14:04:01.336922,  5] ../../source3/auth/auth.c:52(smb_register_auth)
  Attempting to register auth backend sam_netlogon3
[2023/09/19 14:04:01.336929,  5] ../../source3/auth/auth.c:64(smb_register_auth)
  Successfully added auth method 'sam_netlogon3'
[2023/09/19 14:04:01.336935,  5] ../../source3/auth/auth.c:52(smb_register_auth)
  Attempting to register auth backend winbind
[2023/09/19 14:04:01.336942,  5] ../../source3/auth/auth.c:64(smb_register_auth)
  Successfully added auth method 'winbind'
[2023/09/19 14:04:01.336950,  5] ../../source3/auth/auth.c:52(smb_register_auth)
  Attempting to register auth backend unix
[2023/09/19 14:04:01.336961,  5] ../../source3/auth/auth.c:64(smb_register_auth)
  Successfully added auth method 'unix'
[2023/09/19 14:04:01.336969,  5] ../../source3/auth/auth.c:426(load_auth_module)
  load_auth_module: Attempting to find an auth method to match anonymous
[2023/09/19 14:04:01.336978,  5] ../../source3/auth/auth.c:451(load_auth_module)
  load_auth_module: auth method anonymous has a valid init
[2023/09/19 14:04:01.336985,  5] ../../source3/auth/auth.c:426(load_auth_module)
  load_auth_module: Attempting to find an auth method to match sam_ignoredomain
[2023/09/19 14:04:01.336991,  5] ../../source3/auth/auth.c:451(load_auth_module)
  load_auth_module: auth method sam_ignoredomain has a valid init
[2023/09/19 14:04:01.338828,  3] ../../auth/gensec/gensec_start.c:1083(gensec_register)
  GENSEC backend 'gssapi_spnego' registered
[2023/09/19 14:04:01.338852,  3] ../../auth/gensec/gensec_start.c:1083(gensec_register)
  GENSEC backend 'gssapi_krb5' registered
[2023/09/19 14:04:01.338862,  3] ../../auth/gensec/gensec_start.c:1083(gensec_register)
  GENSEC backend 'gssapi_krb5_sasl' registered
[2023/09/19 14:04:01.338870,  3] ../../auth/gensec/gensec_start.c:1083(gensec_register)
  GENSEC backend 'spnego' registered
[2023/09/19 14:04:01.338878,  3] ../../auth/gensec/gensec_start.c:1083(gensec_register)
  GENSEC backend 'schannel' registered
[2023/09/19 14:04:01.338887,  3] ../../auth/gensec/gensec_start.c:1083(gensec_register)
  GENSEC backend 'ncalrpc_as_system' registered
[2023/09/19 14:04:01.338895,  3] ../../auth/gensec/gensec_start.c:1083(gensec_register)
  GENSEC backend 'sasl-EXTERNAL' registered
[2023/09/19 14:04:01.338903,  3] ../../auth/gensec/gensec_start.c:1083(gensec_register)
  GENSEC backend 'ntlmssp' registered
[2023/09/19 14:04:01.338911,  3] ../../auth/gensec/gensec_start.c:1083(gensec_register)
  GENSEC backend 'ntlmssp_resume_ccache' registered
[2023/09/19 14:04:01.338919,  3] ../../auth/gensec/gensec_start.c:1083(gensec_register)
  GENSEC backend 'http_basic' registered
[2023/09/19 14:04:01.338927,  3] ../../auth/gensec/gensec_start.c:1083(gensec_register)
  GENSEC backend 'http_ntlm' registered
[2023/09/19 14:04:01.338935,  3] ../../auth/gensec/gensec_start.c:1083(gensec_register)
  GENSEC backend 'http_negotiate' registered
[2023/09/19 14:04:01.338945,  3] ../../auth/gensec/gensec_start.c:1083(gensec_register)
  GENSEC backend 'krb5' registered
[2023/09/19 14:04:01.338954,  3] ../../auth/gensec/gensec_start.c:1083(gensec_register)
  GENSEC backend 'fake_gssapi_krb5' registered
[2023/09/19 14:04:01.339044,  5] ../../auth/gensec/gensec_start.c:844(gensec_start_mech)
  Starting GENSEC mechanism spnego
[2023/09/19 14:04:01.339083,  5] ../../auth/gensec/gensec_start.c:844(gensec_start_mech)
  Starting GENSEC submechanism ntlmssp
[2023/09/19 14:04:01.342752,  5] ../../source3/auth/auth.c:565(make_auth3_context_for_ntlm)
  make_auth3_context_for_ntlm: Making default auth method list for server role = 'standalone server', encrypt passwords = yes
[2023/09/19 14:04:01.342788,  5] ../../source3/auth/auth.c:426(load_auth_module)
  load_auth_module: Attempting to find an auth method to match anonymous
[2023/09/19 14:04:01.342801,  5] ../../source3/auth/auth.c:451(load_auth_module)
  load_auth_module: auth method anonymous has a valid init
[2023/09/19 14:04:01.342811,  5] ../../source3/auth/auth.c:426(load_auth_module)
  load_auth_module: Attempting to find an auth method to match sam_ignoredomain
[2023/09/19 14:04:01.342820,  5] ../../source3/auth/auth.c:451(load_auth_module)
  load_auth_module: auth method sam_ignoredomain has a valid init
[2023/09/19 14:04:01.342873,  5] ../../auth/gensec/gensec_start.c:844(gensec_start_mech)
  Starting GENSEC mechanism spnego
[2023/09/19 14:04:01.342936,  1] ../../auth/gensec/spnego.c:1341(gensec_spnego_server_negTokenInit_step)
  gensec_spnego_server_negTokenInit_step: Could not find a suitable mechtype in NEG_TOKEN_INIT
[2023/09/19 14:04:01.342972,  5] ../../auth/gensec/gensec.c:534(gensec_update_done)
  gensec_update_done: spnego[0x5618c5c0b850]: NT_STATUS_INVALID_PARAMETER
#1052245#10
Date:
2023-09-26 13:33:06 UTC
From:
To:
So debugging this with Wireshark showed that during the SPNEGO negotiation,
server and client could not settle on a mutually supported authentication
mechanism. The server was only offering NTLMSSP while the client offers MS
KRB5/KRB5 (due to --use-kerberos=required).

The server needs to have "kerberos method" set to use the right keytab, for
some reason "system keytab" does not work and I had to explicitly set

   kerberos method = dedicated keytab
   dedicated keytab file = /etc/krb5.keytab

This allows SPNEGO negotiation to succeed but leads to the next error:

[2023/09/26 15:21:29.755056,  5] ../../source3/auth/auth.c:565(make_auth3_context_for_ntlm)
  make_auth3_context_for_ntlm: Making default auth method list for server role = 'standalone server', encrypt passwords = yes
[2023/09/26 15:21:29.755119,  5] ../../source3/auth/auth.c:52(smb_register_auth)
  Attempting to register auth backend anonymous
[2023/09/26 15:21:29.755141,  5] ../../source3/auth/auth.c:64(smb_register_auth)
  Successfully added auth method 'anonymous'
[2023/09/26 15:21:29.755154,  5] ../../source3/auth/auth.c:52(smb_register_auth)
  Attempting to register auth backend sam
[2023/09/26 15:21:29.755164,  5] ../../source3/auth/auth.c:64(smb_register_auth)
  Successfully added auth method 'sam'
[2023/09/26 15:21:29.755173,  5] ../../source3/auth/auth.c:52(smb_register_auth)
  Attempting to register auth backend sam_ignoredomain
[2023/09/26 15:21:29.755183,  5] ../../source3/auth/auth.c:64(smb_register_auth)
  Successfully added auth method 'sam_ignoredomain'
[2023/09/26 15:21:29.755191,  5] ../../source3/auth/auth.c:52(smb_register_auth)
  Attempting to register auth backend sam_netlogon3
[2023/09/26 15:21:29.755201,  5] ../../source3/auth/auth.c:64(smb_register_auth)
  Successfully added auth method 'sam_netlogon3'
[2023/09/26 15:21:29.755210,  5] ../../source3/auth/auth.c:52(smb_register_auth)
  Attempting to register auth backend winbind
[2023/09/26 15:21:29.755219,  5] ../../source3/auth/auth.c:64(smb_register_auth)
  Successfully added auth method 'winbind'
[2023/09/26 15:21:29.755228,  5] ../../source3/auth/auth.c:52(smb_register_auth)
  Attempting to register auth backend unix
[2023/09/26 15:21:29.755237,  5] ../../source3/auth/auth.c:64(smb_register_auth)
  Successfully added auth method 'unix'
[2023/09/26 15:21:29.755246,  5] ../../source3/auth/auth.c:426(load_auth_module)
  load_auth_module: Attempting to find an auth method to match anonymous
[2023/09/26 15:21:29.755276,  5] ../../source3/auth/auth.c:451(load_auth_module)
  load_auth_module: auth method anonymous has a valid init
[2023/09/26 15:21:29.755286,  5] ../../source3/auth/auth.c:426(load_auth_module)
  load_auth_module: Attempting to find an auth method to match sam_ignoredomain
[2023/09/26 15:21:29.755296,  5] ../../source3/auth/auth.c:451(load_auth_module)
  load_auth_module: auth method sam_ignoredomain has a valid init
[2023/09/26 15:21:29.757684,  3] ../../auth/gensec/gensec_start.c:1083(gensec_register)
  GENSEC backend 'gssapi_spnego' registered
[2023/09/26 15:21:29.757719,  3] ../../auth/gensec/gensec_start.c:1083(gensec_register)
  GENSEC backend 'gssapi_krb5' registered
[2023/09/26 15:21:29.757732,  3] ../../auth/gensec/gensec_start.c:1083(gensec_register)
  GENSEC backend 'gssapi_krb5_sasl' registered
[2023/09/26 15:21:29.757744,  3] ../../auth/gensec/gensec_start.c:1083(gensec_register)
  GENSEC backend 'spnego' registered
[2023/09/26 15:21:29.757754,  3] ../../auth/gensec/gensec_start.c:1083(gensec_register)
  GENSEC backend 'schannel' registered
[2023/09/26 15:21:29.757764,  3] ../../auth/gensec/gensec_start.c:1083(gensec_register)
  GENSEC backend 'ncalrpc_as_system' registered
[2023/09/26 15:21:29.757774,  3] ../../auth/gensec/gensec_start.c:1083(gensec_register)
  GENSEC backend 'sasl-EXTERNAL' registered
[2023/09/26 15:21:29.757784,  3] ../../auth/gensec/gensec_start.c:1083(gensec_register)
  GENSEC backend 'ntlmssp' registered
[2023/09/26 15:21:29.757793,  3] ../../auth/gensec/gensec_start.c:1083(gensec_register)
  GENSEC backend 'ntlmssp_resume_ccache' registered
[2023/09/26 15:21:29.757803,  3] ../../auth/gensec/gensec_start.c:1083(gensec_register)
  GENSEC backend 'http_basic' registered
[2023/09/26 15:21:29.757813,  3] ../../auth/gensec/gensec_start.c:1083(gensec_register)
  GENSEC backend 'http_ntlm' registered
[2023/09/26 15:21:29.757822,  3] ../../auth/gensec/gensec_start.c:1083(gensec_register)
  GENSEC backend 'http_negotiate' registered
[2023/09/26 15:21:29.757835,  3] ../../auth/gensec/gensec_start.c:1083(gensec_register)
  GENSEC backend 'krb5' registered
[2023/09/26 15:21:29.757853,  3] ../../auth/gensec/gensec_start.c:1083(gensec_register)
  GENSEC backend 'fake_gssapi_krb5' registered
[2023/09/26 15:21:29.757980,  5] ../../auth/gensec/gensec_start.c:844(gensec_start_mech)
  Starting GENSEC mechanism spnego
[2023/09/26 15:21:29.758031,  5] ../../auth/gensec/gensec_start.c:844(gensec_start_mech)
  Starting GENSEC submechanism gse_krb5
[2023/09/26 15:21:29.767904,  5] ../../source3/auth/auth.c:565(make_auth3_context_for_ntlm)
  make_auth3_context_for_ntlm: Making default auth method list for server role = 'standalone server', encrypt passwords = yes
[2023/09/26 15:21:29.767924,  5] ../../source3/auth/auth.c:426(load_auth_module)
  load_auth_module: Attempting to find an auth method to match anonymous
[2023/09/26 15:21:29.767931,  5] ../../source3/auth/auth.c:451(load_auth_module)
  load_auth_module: auth method anonymous has a valid init
[2023/09/26 15:21:29.767936,  5] ../../source3/auth/auth.c:426(load_auth_module)
  load_auth_module: Attempting to find an auth method to match sam_ignoredomain
[2023/09/26 15:21:29.767941,  5] ../../source3/auth/auth.c:451(load_auth_module)
  load_auth_module: auth method sam_ignoredomain has a valid init
[2023/09/26 15:21:29.767971,  5] ../../auth/gensec/gensec_start.c:844(gensec_start_mech)
  Starting GENSEC mechanism spnego
[2023/09/26 15:21:29.768004,  5] ../../auth/gensec/gensec_start.c:844(gensec_start_mech)
  Starting GENSEC submechanism gse_krb5
[2023/09/26 15:21:29.768378,  1] ../../source3/auth/auth_generic.c:211(auth3_generate_session_info_pac)
  auth3_generate_session_info_pac: Unexpected PAC for [atest@INTERN] in standalone mode - NT_STATUS_BAD_TOKEN_TYPE

This leads to a bug in Samba, based on false assumptions, which was
introduced in 2021 and makes it impossible to use MIT Kerberos
authentication with the standalone server role.

There is a long thread on the Samba list starting at
https://lists.samba.org/archive/samba/2023-April/244842.html about it,
the actual cause is described by Andrew Bartlett from the Samba team:

    > So I knew this would happen, sorry about that.
    >
    > When we did the big 2021 security fixes, we strictly set a line between
    > 'AD has a PAC' and 'MIT Krb5 (traditional) does not'.
    >
    > This was meant to ensure that folks would not connect Samba as a
    > 'standalone' server in an AD domain, bypassing the security mitigation
    > we put in place against the 'dollar ticket attack' where users could
    > create an account called 'root$' but print it as 'root'.
    >
    > The problem is that subsequent to that, I saw that the MIT folks
    > decided to always issue a PAC, just without the LOGON_INFO
    > component.  Samba doesn't do well with that, and a fix is needed both
    > in this code an in winbindd to change the test from 'has a PAC' to 'has a PAC with LOGON_INFO'.

    (see https://lists.samba.org/archive/samba/2023-April/244999.html)

So if we don't want to set up  a AD DC we will probably not be able to use
Kerberos authentication with our current setup.