[Samba] Suppressing the Windows password pop up when using bad user trap for user from trusted domains

[Dedhi Sujatmiko]

Dear all,

I have a situation where the Samba file server is the ADS domain member 
of DomA, and the DomA is trusting another domain DomB.
Currently the Samba version I am using is 3.0.34 under Solaris 10 Update 
7 with Sun Cluster 3.2 HA solution. I understand that the "trusted 
domains" feature on this release is breaking, thus I cannot make it 
works, and the path to upgrade to 3.2.2 is also not possible since it is 
not supported by Sun Cluster agent.

Therefore I need to have a mechanism to trap the user from DomB, to be 
"bad user", and allowing it to access as "guest" user. The problem I 
have now, when the user from DomB is accessing the share, he/she is 
always presented with the Windows password pop up, which is difficult 
since we want it to be unattended or at least silently login behind the 
application. Only after the user entering bogus username/password, then 
he can access the share as guest user.

Basically if the authentication result is NT_STATUS_LOGON_FAILURE, the 
dekstop will keep asking with pop up screen. Only when the result is 
NT_STATUS_NO_SUCH_USER, it is directed to "guest" account.

What I want is that both authentication failure is mapped to "guest" 
account, and supressing Windows login pop up.

Many thanks in advance,

Dedhi

PS : some information

This is my excerpt of "smb.conf" :

[global]
log level = 3
syslog only = no
max log size = 50000
realm = DOMA.PVT
workgroup = DOMA
security = ADS
encrypt passwords = true
unix extensions = yes
password server = ESSBCST1.doma.pvt ESSBCST2.doma.pvt
server string = "SAMBA File Server"
wins server = 192.168.1.11 192.168.1.12
domain master = no
local master = no
client schannel = no
client use spnego = yes
interfaces = 192.168.1.17/24
bind interfaces only = yes
netbios name=SAM-FS-SAMBA
pid directory = /global/SAM-QFS-HA/samba/SAM-FS-SAMBA/var/locks
log file = /global/SAM-QFS-HA/samba/SAM-FS-SAMBA/logs/log.%m
smb passwd file = /global/SAM-QFS-HA/samba/SAM-FS-SAMBA/private/smbpasswd
private dir = /global/SAM-QFS-HA/samba/SAM-FS-SAMBA/private
lock dir = /global/SAM-QFS-HA/samba/SAM-FS-SAMBA/var/locks
kernel oplocks = true
oplocks = true

# winbind
winbind separator = /
idmap uid = 11000-19000
idmap gid = 11000-19000
#
idmap domains = DOMA
idmap config DOMA:backend = rid
idmap config DOMA:default = yes
idmap config DOMA:range = 11000-19000
#
winbind enum users = yes
winbind enum groups = yes
winbind nested groups = yes
allow trusted domains = no
winbind use default domain = yes
template shell = /bin/bash
map to guest = bad password
guest account = nobody

[media]
        comment = "Media directory"
        path = /samfs1/omnibus_F/Media
        read only = No
        create mask = 0666
        directory mask = 0775
        writable = yes
        browseable = yes
        guest ok = yes
        case sensitive = true
        default case = lower
        preserve case = no
        short preserve case = no
        level2 oplocks = true
       

Output from the log :

 check_ntlm_password:  mapped user is: [DOMB]\[TengTM]@[DT06-016654]
[2009/10/21 17:26:26, 1] auth/auth.c:(172)
  check_domain_match: Attempt to connect as user TengTM from domain DOMB 
denied.
[2009/10/21 17:26:26, 3] smbd/error.c:(106)
  error packet at smbd/sesssetup.c(107) cmd=115 (SMBsesssetupX) 
NT_STATUS_LOGON_FAILURE
 
  check_ntlm_password:  Checking password for unmapped user 
[local]\[ttty]@[DT06-016654] with the new password interface
[2009/10/21 17:26:45, 3] auth/auth.c:(224)
  check_ntlm_password:  mapped user is: [DOMA]\[ttty]@[DT06-016654]
  check_ntlm_password:  Authentication for user [ttty] -> [ttty] FAILED 
with error NT_STATUS_NO_SUCH_USER
[2009/10/21 17:26:45, 3] smbd/sesssetup.c:(45)
  No such user ttty [local] - using guest account