[Samba] Re: ADS valid users can't map share
sambauser at katehok.ac93.org
Wed Oct 20 17:12:22 GMT 2004
Gerald (Jerry) Carter wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> Igor Belyi wrote:
> | No, wait! Samba checks only the first OID! And this is the
> | reason for NTLM! Here's the comment from source/smbd/sesssetup.c:
> | /* only look at the first OID for determining the mechToken --
> | accoirding to RFC2478, we should choose the one we want
> | and renegotiate, but i smell a client bug here..
> | Problem observed when connecting to a member (samba box)
> | of an AD domain as a user in a Samba domain. Samba member
> | server sent back krb5/mskrb5/ntlmssp as mechtypes, but the
> | client (2ksp3) replied with ntlmssp/mskrb5/krb5 and an
> | NTLMSSP mechtoken. --jerry */
> | Jerry, that's your comment, right? :)
> Yup. That's my change. But since the NTLM authentication
> is succeeding, then I'll assume that the token sent back
> was an NTLMSSP tocken as well. So for some reason the client
> either can't or won't obtain a ticket for the Samba server.
Do you mean NTLM got negotiated earlier than that code? Or that client
obtains Kerberos tickets directly from security server and then just
passes them to Samba server? Where those OIDs corresponding to Kerberos
come from then?
I don't have ADS and I never saw one. I apologize if my questions are naive.
> DNS reverse mapping glitch perhaps?
More information about the samba