[Samba] Failed to convert SID to a UID

[Robert Marcano]

On 6/12/23 2:55 AM, Rowland Penny via samba wrote:
> 
> 
> On 12/06/2023 07:04, Christian Naumer via samba wrote:
>> Am Samstag, dem 10.06.2023 um 20:57 +0100 schrieb Rowland Penny via 
>> samba:
>>>
>>>
>>> On 10/06/2023 20:37, Christian Naumer via samba wrote:
>>>> That might be the right direction. The standard kerb5.conf on 
>>>> rhel/rocky breaks samba. At
>>>> least for us. That is why we always replace it with a custom one.
>>>
>>> It might be an idea if we could see your definition of the standard
>>> krb5.conf. I ask this because I have set up a Unix domain member on both
>>> Rocky Linux 8 and 9 with my idea of the standard krb5.conf and they both
>>> worked.
>>
>>
>> In Rocky 8 we have this as standard which we usually replace:
>>
>> # To opt out of the system crypto-policies configuration of krb5, 
>> remove the
>> # symlink at /etc/krb5.conf.d/crypto-policies which will not be 
>> recreated.
>> includedir /etc/krb5.conf.d/
>>
>> [logging]
>>      default = FILE:/var/log/krb5libs.log
>>      kdc = FILE:/var/log/krb5kdc.log
>>      admin_server = FILE:/var/log/kadmind.log
>>
>> [libdefaults]
>>      dns_lookup_realm = false
>>      ticket_lifetime = 24h
>>      renew_lifetime = 7d
>>      forwardable = true
>>      rdns = false
>>      pkinit_anchors = FILE:/etc/pki/tls/certs/ca-bundle.crt
>>      spake_preauth_groups = edwards25519
>> #    default_realm = EXAMPLE.COM
>>      default_ccache_name = KEYRING:persistent:%{uid}
>>
>> [realms]
>> # EXAMPLE.COM = {
>> #     kdc = kerberos.example.com
>> #     admin_server = kerberos.example.com
>> # }
>>
>> [domain_realm]
>> # .example.com = EXAMPLE.COM
>> # example.com = EXAMPLE.COM
>>
>> I think it does not like the "crypto-policies" file in the includedir. 
>> But I am unsure. Maybe
>> this is different now but it used to be a Problem.
>>
>> Here is what we replace it with:
>>
>> [logging]
>> default = FILE:/var/log/krb5libs.log
>> kdc = FILE:/var/log/krb5kdc.log
>> admin_server = FILE:/var/log/kadmind.log
>>
>> [libdefaults]
>> default_realm = EXAMPLEREALM.COM
>> dns_lookup_realm = true
>> dns_lookup_kdc = true
>> ticket_lifetime = 24h
>> renew_lifetime = 7d
>> forwardable = true
>> default_ccache_name = KEYRING:persistent:%{uid}
>>
>> Regards
>>
>> Christian
>>
>>
> 
> I used this /etc/krb5.conf on a machine called 'rocky9'
> 
> [libdefaults]
>    default_realm = SAMDOM.EXAMPLE.COM
>    dns_lookup_kdc = false
>    dns_lookup_realm = true
> 
> [realms]
>      SAMDOM.EXAMPLE.COM = {
>          default_domain = samdom.example.com
>      }
> 
> [domain_realm]
>      ROCKY9 = SAMDOM.EXAMPLE.COM
> 
> I also did this:
> 
> sudo rm /etc/krb5.conf.d/crypto-policies
> 
> I ended up with a fully working Unix domain member using the 'rid' idmap 
> backend.
> 
> Rowland
> 


There exist a way to setup crypto policies with support for old AD crypto.

RHEL 8 and derivative:
   update-crypto-policies --set DEFAULT:AD-SUPPORT

RHEL 9 and derivative
   update-crypto-policies --set DEFAULT:AD-SUPPORT-LEGACY

From: https://access.redhat.com/solutions/7004158