Samba 3.0alpha21, Windows XP SP1 and Kerberos authentication

Antti Tikkanen antti.tikkanen at
Wed Feb 12 12:22:57 GMT 2003

On Sat, 1 Feb 2003, Andrew Bartlett wrote:

> The interesting thing is this - my Win2k servers don't seem to share
> this property.  I can't even get a CIFS/ ticket, and they don't have
> those names.  So, we need to do some more digging - what is it that
> makes Samba look different to Win2k in this regard?
> Do some comparative traces, look at what names your Win2k servers have
> registered etc.  It would be interesting to track this down.


I promised to get back on this after I could get some tests done on a
Win2k workstation.

To put it short: indeed, Win2k with SP3 does not look for a
CIFS/ ticket. Win2k clients will look for the service
principal HOST/, which is there by default.

Still, my XP clients will insist on trying to get a ticket for the
service principal CIFS/, and will not work without one.

The really interesting thing is this. My Windows 2000 Server fileservers
do *not* have a servicePrincipalName of CIFS/ Here is
an LDAP dump of a W2k fileserver:


# FILESERVER01, OUfile, OUmemberserver, OUroot, win, hut, fi
dn: CN=FILESERVER01,OU=OUfile,OU=OUmemberserver,OU=OUroot,DC=win,DC=hut,DC=fi
accountExpires: 9223372036854775807
badPasswordTime: 0
badPwdCount: 0
codePage: 0
cn: CCFILE01
countryCode: 0
displayName: FILESERVER01$
objectCategory: CN=Computer,CN=Schema,CN=Configuration,DC=win,DC=hut,DC=fi
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: user
objectClass: computer
objectGUID:: Ww2Hq27cj0Si6AB3eQk1qQ==
operatingSystem: Windows 2000 Server
operatingSystemServicePack: Service Pack 3
operatingSystemVersion: 5.0 (2195)
primaryGroupID: 515
pwdLastSet: 126891621025546875
sAMAccountName: FILESERVER01$
sAMAccountType: 805306369
servicePrincipalName: HOST/FILESERVER01
servicePrincipalName: HOST/
userAccountControl: 4096
uSNChanged: 13142668
uSNCreated: 3385
whenChanged: 20030208071502.0Z
whenCreated: 20000809081657.0Z


*BUT*, when I access with my XP clients, they
somehow manage to get a ticket for the service principal
CIFS/, even though it is not listed here (I
verified this with 'klist tickets').

In Linux, when I attempt to get a service ticket for
CIFS/ with 'kinit -S CIFS/',
it fails and reports that the server was not found in the database.

For my Samba server, I am able to get a service ticket for
CIFS/ with 'kinit -s', because I have added it manually.

This sounds really weird to me..

And, if it has any information value, we have under testing a NetApp
fileserver which is able to join a domain and talk to SMB clients authenticating
them with Kerberos. It will also add a SPN named CIFS/
when joining the domain.

Any comments?

Antti Tikkanen

More information about the samba-technical mailing list