[Samba] Domain member cannot authenticate when first domain controller is down

[Dale]

Jake,

I can't speak for the others in this thread, but I can vouch that I did 
do the replication.

Thanks,
Dale

On 3/8/21 9:20 AM, Jake Black via samba wrote:
> This thread is already pretty long and so I'm not sure if this has been looked at yet, but my linux clients would experience this same issue unless I made sure to replicate idmappings on a new DC after it was joined:
>
> https://wiki.samba.org/index.php/Joining_a_Samba_DC_to_an_Existing_Active_Directory#Built-in_User_.26_Group_ID_Mappings
>
> Jake
>
>
> From: "Jason Keltz" <jas at eecs.yorku.ca>
> To: "Dale" <samba at txschroeder.family>
> Cc: samba at lists.samba.org
> Sent: Wednesday, March 3, 2021 10:14:07 AM
> Subject: Re: [Samba] Domain member cannot authenticate when first domain controller is down
>
> Hi Dale/Josh,
>
> I had opened a ticket about this issue back in December (at least I
> think this is similar):
>
> https://bugzilla.samba.org/show_bug.cgi?id=14597
>
> I consider failover to be very important. Unfortunately, the Samba
> developers haven't had time to work on it. I've had a few users email
> me over the course of the last months stating similar problems. Maybe
> you or anyone else who has the problem might add a similar "me too" to
> the bug so that the information is all available when the developers do
> have time to work on it, and we can all benefit.
>
> I suppose there's still a benefit to having multiple DC for load
> balancing. However, yes, when the DC goes out, in my experience,
> there's definately trouble.
>
> Jason.
>
> On 3/3/2021 10:25 AM, Dale via samba wrote:
>> Josh, I don't have the answer to your question, but if you ever figure
>> it out, I would like to know the answer, too.
>>
>> The 2nd DC that I built has been of very little use. While building,
>> it passed all the tests in the wiki. After building, I found some DNS
>> entries that were not created during the join. Rowland kindly helped
>> me add and/or edit the affected entries, and I hoped for better
>> results. However, it was not to be. If the 1st DC is removed from
>> the network, any kind of login or getent is interminably long or times
>> out. So, while I easily see the theoretical value of having multiple
>> DC's, I'm having trouble seeing the actual, practical benefit of
>> having them. There is no instant failover, and often times, there is
>> complete failure of necessary AD functions. While it's certainly
>> possible the problem could be me, I cannot troubleshoot what the
>> problem is.
>>
>> Dale
>>
>>
>> On 3/1/21 6:25 PM, Josh T via samba wrote:
>>> Further fiddling with this has shown something strange. If I enter my
>>> username and password in an attempt to authenticate a domain user, it
>>> will take 60+ seconds for it to fail to log in. However, during said
>>> 60+ seconds, if I log in via SSH as a non-domain user, then the
>>> domain user login succeeds. What could cause that?
>>>
>>>
>>> ________________________________
>>> From: Roy Eastwood <spindles7 at gmail.com>
>>> Sent: Saturday, February 27, 2021 1:27 AM
>>> To: 'Josh T' <c3h4ohcooh3 at hotmail.com>; samba at lists.samba.org
>>> <samba at lists.samba.org>
>>> Subject: Re: [Samba] Domain member cannot authenticate when first
>>> domain controller is down
>>>
>>>
>>>
>>> On 27 February 2021 03:35 Josh T wrote:
>>>> //Problem:
>>>> I am unable to authenticate a domain user on a Samba domain member
>>>> while the
>>>> first Samba directory controller DC1 is powered off and the second
>>>> Samba
>>>> directory controller DC2 is powered on.
>>>>
>>>> While DC1 is powered on, I can log in as a domain user with no
>>>> problems. While
>>>> DC1 is powered off, attempting to log in usually results in waiting 60+
>>> seconds
>>>> followed by a login failure message. If I had already logged in
>>>> prior to
>>> powering
>>>> off DC1, then I can see the same long delay and authentication
>>>> failures when
>>>> entering my sudo password. Intermittently I can sometimes manage to
>>>> log in
>>>> while DC1 is powered off, but there is still the 60+ second delay; I
>>>> haven't
>>> been
>>>> able to link this intermittent behavior to any of my own
>>>> troubleshooting
>>> actions.
>>>> In any case, a 60+ second delay is undesirable.
>>>>
>>>> //Environment description:
>>>> The first Samba domain controller DC1 was created following these
>>>> instructions
>>>> on the Samba wiki:
>>>> https://wiki.samba.org/index.php/Setting_up_Samba_as_an_Active_Directory_
>>>>
>>>> Domain_Controller
>>>> It was provisioned using the command "samba-tool domain provision
>>>> --use-
>>>> rfc2307 --interactive".
>>>> The BIND9_DLZ DNS backend was selected during provisioning.
>>>> Samba version 4.11.6-Ubuntu was installed on DC1 using the apt command.
>>>>
>>>> The second Samba domain controller DC2 was created following these
>>>> instructions on the Samba wiki:
>>>> https://wiki.samba.org/index.php/Joining_a_Samba_DC_to_an_Existing_Active
>>>>
>>>> _Directory
>>>> It was joined using the command "samba-tool domain join
>>>> my.domain.tld --dns-
>>>> backend=BIND9_DLZ --option='idmap_ldb:use rfc2307 = yes'".
>>> The above is missing the letters "DC" in the command line. This may
>>> be the
>>> issue.
>>>
>>> HTH
>>>
>>> Roy
>>>
>>>
>>>
>>>
>>