[Samba] Re: ADS valid users can't map share

Igor Belyi sambauser at katehok.ac93.org
Wed Oct 20 17:12:22 GMT 2004

Gerald (Jerry) Carter wrote:

> Hash: SHA1
> Igor Belyi wrote:
> | No, wait! Samba checks only the first OID! And this is the
> | reason for NTLM! Here's the comment from source/smbd/sesssetup.c:
> |
> |        /* only look at the first OID for determining the mechToken --
> |           accoirding to RFC2478, we should choose the one we want
> |           and renegotiate, but i smell a client bug here..
> |
> |           Problem observed when connecting to a member (samba box)
> |           of an AD domain as a user in a Samba domain.  Samba member
> |           server sent back krb5/mskrb5/ntlmssp as mechtypes, but the
> |           client (2ksp3) replied with ntlmssp/mskrb5/krb5 and an
> |           NTLMSSP mechtoken.                 --jerry              */
> |
> | Jerry, that's your comment, right? :)
> Yup.  That's my change.  But since the NTLM authentication
> is succeeding, then I'll assume that the token sent back
> was an NTLMSSP tocken as well.  So for some reason the client
> either can't or won't obtain a ticket for the Samba server.

Do you mean NTLM got negotiated earlier than that code? Or that client 
obtains Kerberos tickets directly from security server and then just 
passes them to Samba server? Where those OIDs corresponding to Kerberos 
come from then?

I don't have ADS and I never saw one. I apologize if my questions are naive.


> DNS reverse mapping glitch perhaps?

More information about the samba mailing list