[Samba] NT_STATUS_NO_SUCH_USER for trusted domains

[Gaiseric Vandal]

I am running Samba 3.4.7 (compiled from source) on Solaris 10 as a PDC.  I
have trusted domains setup with a Windows 2003 Active Directory domain in
"2003 native" mode.    Everything is  in an LDAP backend (unix accounts for
the Samba domain, idmap entries for trusted domains.)  The Solaris 10 PDC is
also an ldap/nfs server for linux and solaris clients.

 

Assuming

                SAMBAPDC is the Solaris 10 PDC for the domain called
"SAMBADOMAIN."

                WINSERVER is the PDC for the Win 2003 AD domain called
"WINDOMAIN."

                "winuser" is a user in the "WINDOMAIN" domain.

 

 

This was working for some time.    Now, however, users in the Windows domain
can no longer access resources on the samba domain.   On a windows PC in the
trs   Smbclient on the PDC or on a linux workstation  also fails, so this
does not seem to be a mismatch in NTLM versions between windows and samba.
Samba log files show "NT_STATUS_NO_SUCH_USER."  

 

 

sambapdc #smbclient -U "WINDOMAIN\winuser" -L \\SAMBAPDC
<file:///\\SAMBAPDC> 

session setup failed: NT_STATUS_LOGON_FAILURE

 

 

 


"wbinfo -u" does list the users from the trusted  Windows domain.

 

The "/etc/nsswitch.conf" file  has the following entries

 

passwd:     files ldap winbind

group:      files ldap winbind

 

 

"getent passwd" command does list users from the trusted Windows domain.

"id "WINDOMAIN/winuser""  command  returns valid uid and gid values.

"wbinfo -s " and "winbinfo -n" commands show matching name-to-sid and
sid-to-name entries.

 

 

 

"Getent passwd" lists unix accounts from ldap quickly.  There is a delay of
about 10 seconds before it starts listing winbind users (i.e. from the
trusted domain.)   I suspect that the names are not getting returned to
samba fast enough.  

 

 

 

 

sambapdc# cat winserver.log

.

.

[2010/09/13 08:02:04,  3]
smbd/sesssetup.c:1202(reply_sesssetup_and_X_spnego)

  NativeOS=[Windows Server 2003 R2 3790 Service Pack 2] NativeLanMan=[]
PrimaryD

omain=[Windows Server 2003 R2 5.2]

[2010/09/13 08:02:04,  3] libsmb/ntlmssp.c:745(ntlmssp_server_auth)

  Got user=[winuser] domain=[WINDOMAIN] workstation=[WINSERVER] len1=24
len2=24

[2010/09/13 08:02:04,  3] smbd/sec_ctx.c:210(push_sec_ctx)

  push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1

[2010/09/13 08:02:04,  3] smbd/uid.c:428(push_conn_ctx)

  push_conn_ctx(0) : conn_ctx_stack_ndx = 0

[2010/09/13 08:02:04,  3] smbd/sec_ctx.c:310(set_sec_ctx)

  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1

[2010/09/13 08:02:04,  3] smbd/sec_ctx.c:418(pop_sec_ctx)

  pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0

[2010/09/13 08:02:04,  3] auth/auth.c:222(check_ntlm_password)

  check_ntlm_password:  Checking password for unmapped user [WINDOMAIN]\[li

nus]@[WINSERVER] with the new password interface

[2010/09/13 08:02:04,  3] auth/auth.c:225(check_ntlm_password)

  check_ntlm_password:  mapped user is: [WINDOMAIN]\[winuser]@[WINSERVER]

[2010/09/13 08:02:04,  3] smbd/sec_ctx.c:210(push_sec_ctx)

  push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1

[2010/09/13 08:02:04,  3] smbd/uid.c:428(push_conn_ctx)

  push_conn_ctx(0) : conn_ctx_stack_ndx = 0

[2010/09/13 08:02:04,  3] smbd/sec_ctx.c:310(set_sec_ctx)

  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1

[2010/09/13 08:02:04,  3] smbd/sec_ctx.c:418(pop_sec_ctx)

  pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0

[2010/09/13 08:02:04,  2] auth/auth.c:320(check_ntlm_password)

  check_ntlm_password:  Authentication for user [winuser] -> [winuser]
FAILED with e

rror NT_STATUS_NO_SUCH_USER

[2010/09/13 08:02:04,  3] smbd/error.c:60(error_packet_set)

  error packet at smbd/sesssetup.c(122) cmd=115 (SMBsesssetupX)
NT_STATUS_LOGON_

FAILURE

[2010/09/13 08:02:12,  2] smbd/process.c:1988(deadtime_fn)

  Closing idle connection

[2010/09/13 08:02:12,  3] smbd/server.c:146(msg_exit_server)

  got a SHUTDOWN message

[2010/09/13 08:02:12,  3] smbd/sec_ctx.c:310(set_sec_ctx)

  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0

[2010/09/13 08:02:12,  3] smbd/connection.c:31(yield_connection)

  Yielding connection to 

[2010/09/13 08:02:12,  3] smbd/server.c:845(exit_server_common)

  Server exit (normal exit)

#

 

 

 

sambapdc #testparm -v | grep timeout

 

        passwd chat timeout = 2

        name cache timeout = 660

        cups connection timeout = 30

        machine password timeout = 604800

        ldap timeout = 15

        ldap connection timeout = 2

 

 

 

Help is appreciated.

 

Thanks