[Samba] smbclient fails with "NT_STATUS_NO_SUCH_USER" for trusted domains, ntlm_auth succeeds, wbinfo not caching

Tue Sep 14 07:18:55 MDT 2010

FYI

The ntlm_auth command does work with users from the trusted domain.     

sambapdc# ntlm_auth --username "WINDOMAIN\winuser"

password: 

NT_STATUS_OK: Success (0x0)

sambapdc #

(winuser is the user in the trusted Windows 2003 AD domain.)  

I also removed a trust relationship with a 2nd Windows domain  that was no
longer active-  this fixed the slow "wbinfo -u" response but did not fix the
smbclient authentication issue to the existing windows domain.

From: Gaiseric Vandal [mailto:gaiseric.vandal at gmail.com] 
Sent: Monday, September 13, 2010 3:55 PM
To: samba at lists.samba.org
Subject: NT_STATUS_NO_SUCH_USER for trusted domains

I am running Samba 3.4.7 (compiled from source) on Solaris 10 as a PDC.  I
have trusted domains setup with a Windows 2003 Active Directory domain in
"2003 native" mode.    Everything is  in an LDAP backend (unix accounts for
the Samba domain, idmap entries for trusted domains.)  The Solaris 10 PDC is
also an ldap/nfs server for linux and solaris clients.

Assuming

                SAMBAPDC is the Solaris 10 PDC for the domain called
"SAMBADOMAIN."

                WINSERVER is the PDC for the Win 2003 AD domain called
"WINDOMAIN."

                "winuser" is a user in the "WINDOMAIN" domain.

This was working for some time.    Now, however, users in the Windows domain
can no longer access resources on the samba domain.   On a windows PC in the
trs   Smbclient on the PDC or on a linux workstation  also fails, so this
does not seem to be a mismatch in NTLM versions between windows and samba.
Samba log files show "NT_STATUS_NO_SUCH_USER."  

sambapdc #smbclient -U "WINDOMAIN\winuser" -L \\SAMBAPDC
<file:///\\SAMBAPDC> 

session setup failed: NT_STATUS_LOGON_FAILURE

"wbinfo -u" does list the users from the trusted  Windows domain.

The "/etc/nsswitch.conf" file  has the following entries

passwd:     files ldap winbind

group:      files ldap winbind

"getent passwd" command does list users from the trusted Windows domain.

"id "WINDOMAIN/winuser""  command  returns valid uid and gid values.

"wbinfo -s " and "winbinfo -n" commands show matching name-to-sid and
sid-to-name entries.

"Getent passwd" lists unix accounts from ldap quickly.  There is a delay of
about 10 seconds before it starts listing winbind users (i.e. from the
trusted domain.)   I suspect that the names are not getting returned to
samba fast enough.  

sambapdc# cat winserver.log

.

.

[2010/09/13 08:02:04,  3]
smbd/sesssetup.c:1202(reply_sesssetup_and_X_spnego)

  NativeOS=[Windows Server 2003 R2 3790 Service Pack 2] NativeLanMan=[]
PrimaryD

omain=[Windows Server 2003 R2 5.2]

[2010/09/13 08:02:04,  3] libsmb/ntlmssp.c:745(ntlmssp_server_auth)

  Got user=[winuser] domain=[WINDOMAIN] workstation=[WINSERVER] len1=24
len2=24

[2010/09/13 08:02:04,  3] smbd/sec_ctx.c:210(push_sec_ctx)

  push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1

[2010/09/13 08:02:04,  3] smbd/uid.c:428(push_conn_ctx)

  push_conn_ctx(0) : conn_ctx_stack_ndx = 0

[2010/09/13 08:02:04,  3] smbd/sec_ctx.c:310(set_sec_ctx)

  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1

[2010/09/13 08:02:04,  3] smbd/sec_ctx.c:418(pop_sec_ctx)

  pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0

[2010/09/13 08:02:04,  3] auth/auth.c:222(check_ntlm_password)

  check_ntlm_password:  Checking password for unmapped user [WINDOMAIN]\[li

nus]@[WINSERVER] with the new password interface

[2010/09/13 08:02:04,  3] auth/auth.c:225(check_ntlm_password)

  check_ntlm_password:  mapped user is: [WINDOMAIN]\[winuser]@[WINSERVER]

[2010/09/13 08:02:04,  3] smbd/sec_ctx.c:210(push_sec_ctx)

  push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1

[2010/09/13 08:02:04,  3] smbd/uid.c:428(push_conn_ctx)

  push_conn_ctx(0) : conn_ctx_stack_ndx = 0

[2010/09/13 08:02:04,  3] smbd/sec_ctx.c:310(set_sec_ctx)

  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1

[2010/09/13 08:02:04,  3] smbd/sec_ctx.c:418(pop_sec_ctx)

  pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0

[2010/09/13 08:02:04,  2] auth/auth.c:320(check_ntlm_password)

  check_ntlm_password:  Authentication for user [winuser] -> [winuser]
FAILED with e

rror NT_STATUS_NO_SUCH_USER

[2010/09/13 08:02:04,  3] smbd/error.c:60(error_packet_set)

  error packet at smbd/sesssetup.c(122) cmd=115 (SMBsesssetupX)
NT_STATUS_LOGON_

FAILURE

[2010/09/13 08:02:12,  2] smbd/process.c:1988(deadtime_fn)

  Closing idle connection

[2010/09/13 08:02:12,  3] smbd/server.c:146(msg_exit_server)

  got a SHUTDOWN message

[2010/09/13 08:02:12,  3] smbd/sec_ctx.c:310(set_sec_ctx)

  setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0

[2010/09/13 08:02:12,  3] smbd/connection.c:31(yield_connection)

  Yielding connection to 

[2010/09/13 08:02:12,  3] smbd/server.c:845(exit_server_common)

  Server exit (normal exit)

#

sambapdc #testparm -v | grep timeout

        passwd chat timeout = 2

        name cache timeout = 660

        cups connection timeout = 30

        machine password timeout = 604800

        ldap timeout = 15

        ldap connection timeout = 2

Help is appreciated.

Thanks