[cifs-protocol] cifs/ SPN not accepted in certain scenarios
edgaro at microsoft.com
Thu Sep 3 09:26:28 MDT 2009
I have investigated this case and configured a similar environment as you described. In my testing environment the Windows XP client can successfully join the new Windows Server 2008 domain (new tree root domain in an existing forest) by using Kerberos authentication.
I suspect the Kerberos error KRB_ERROR - KDC_ERR_S_PRINCIPAL_UNKNOWN (7) that you experienced on the TGS request is due your environment. Since the Kerberos mechanism failed to obtain the ticket for the CIFS service, the fallback to NTLM mechanism is the correct processing with respect to SPNEGO as documented in [MS-SPNG] and [RFC4178].
In case this helps, I am providing this reference on Kerberos troubleshooting.
Troubleshooting Kerberos Errors
The KDC_ERR_S_PRINCIPAL_UNKNOWN error could be associated with these Windows internal errors:
If you need more in-depth support in troubleshooting and debugging this issue, we can work with you to establish a Windows support case to pursue this in more depth.
As always, please let us know if you have any specific documentation issue and we will be happy to assist.
From: Zachary Loafman [mailto:zachary.loafman at isilon.com]
Sent: Friday, August 28, 2009 11:18 AM
To: Interoperability Documentation Help
Cc: pfif at tridgell.net; cifs-protocol at samba.org
Subject: cifs/ SPN not accepted in certain scenarios
We stumbled across a rather odd behavior related to non-forest-root tree-root domains. Can you help explain/document this behavior?
I've attached a short pcap showing the start of an XP machine joining a
2k8 tree-root. Here's the setup:
*) I have a Win2k8 DC at 10.54.139.240 for the zl.test domain, which is the forest root for this forest. This domain is only once contacted during the capture, but if you're setting up a similar environment, you'll need it.
*) I have another Win2k8 DC at 10.54.139.241 for the zl-alt.test domain (ZL-ALTROOT-TEST.zl-alt.test). This domain was configured as an alternate root within the same forest using the "advanced" settings in the dcpromo wizard (but is otherwise the standard configuration from that wizard).
*) I have an XP client whose DNS is set to 10.54.139.241 prior to the join.
For whatever reason, the alternate root DC will not accept a TGS-REQ for cifs/ZL-ALTROOT-TEST.zl-alt.test. In this pcap, the XP join then falls back to NTLM. This is fine, but kind of dumb - there should be no need to fall back to NTLM.
The zl-alt.test DC *will* accept a TGS-REQ for HOST/ZL-ALTROOT-TEST.zl-alt.test. That's the curious part.
In case it helps, here's a setspn -L on the altroot:
C:\Users\Administrator>setspn -L ZL-ALTROOT-TEST Registered ServicePrincipalNames for CN=ZL-ALTROOT-TEST,OU=Domain
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the cifs-protocol