[Samba] Failed to convert SID to a UID

[Rowland Penny]

On 12/06/2023 07:04, Christian Naumer via samba wrote:
> Am Samstag, dem 10.06.2023 um 20:57 +0100 schrieb Rowland Penny via samba:
>>
>>
>> On 10/06/2023 20:37, Christian Naumer via samba wrote:
>>> That might be the right direction. The standard kerb5.conf on rhel/rocky breaks samba. At
>>> least for us. That is why we always replace it with a custom one.
>>
>> It might be an idea if we could see your definition of the standard
>> krb5.conf. I ask this because I have set up a Unix domain member on both
>> Rocky Linux 8 and 9 with my idea of the standard krb5.conf and they both
>> worked.
> 
> 
> In Rocky 8 we have this as standard which we usually replace:
> 
> # To opt out of the system crypto-policies configuration of krb5, remove the
> # symlink at /etc/krb5.conf.d/crypto-policies which will not be recreated.
> includedir /etc/krb5.conf.d/
> 
> [logging]
>      default = FILE:/var/log/krb5libs.log
>      kdc = FILE:/var/log/krb5kdc.log
>      admin_server = FILE:/var/log/kadmind.log
> 
> [libdefaults]
>      dns_lookup_realm = false
>      ticket_lifetime = 24h
>      renew_lifetime = 7d
>      forwardable = true
>      rdns = false
>      pkinit_anchors = FILE:/etc/pki/tls/certs/ca-bundle.crt
>      spake_preauth_groups = edwards25519
> #    default_realm = EXAMPLE.COM
>      default_ccache_name = KEYRING:persistent:%{uid}
> 
> [realms]
> # EXAMPLE.COM = {
> #     kdc = kerberos.example.com
> #     admin_server = kerberos.example.com
> # }
> 
> [domain_realm]
> # .example.com = EXAMPLE.COM
> # example.com = EXAMPLE.COM
> 
> I think it does not like the "crypto-policies" file in the includedir. But I am unsure. Maybe
> this is different now but it used to be a Problem.
> 
> Here is what we replace it with:
> 
> [logging]
> default = FILE:/var/log/krb5libs.log
> kdc = FILE:/var/log/krb5kdc.log
> admin_server = FILE:/var/log/kadmind.log
> 
> [libdefaults]
> default_realm = EXAMPLEREALM.COM
> dns_lookup_realm = true
> dns_lookup_kdc = true
> ticket_lifetime = 24h
> renew_lifetime = 7d
> forwardable = true
> default_ccache_name = KEYRING:persistent:%{uid}
> 
> Regards
> 
> Christian
> 
> 

I used this /etc/krb5.conf on a machine called 'rocky9'

[libdefaults]
   default_realm = SAMDOM.EXAMPLE.COM
   dns_lookup_kdc = false
   dns_lookup_realm = true

[realms]
	SAMDOM.EXAMPLE.COM = {
		default_domain = samdom.example.com
	}

[domain_realm]
	ROCKY9 = SAMDOM.EXAMPLE.COM

I also did this:

sudo rm /etc/krb5.conf.d/crypto-policies

I ended up with a fully working Unix domain member using the 'rid' idmap 
backend.

Rowland