[Samba] Azure AD Sync not working

Mon Aug 1 11:01:39 UTC 2022

Dear All,

After some detail digging on the issue.

I found the following:

1. Azure AD Connect 2.x can be installed to "Server which are member of a
Domain" (Not required to be a controller)
2. Thus you can use Windows Server 2012R2 as a Bridge to another Server
Version like 2016 or higher 2019 (I only try 2016)

However, password hash sync (PHS will still not work) -- According to the
We can see the same RPC Error 8420 as shown on this bug...
https://bugzilla.samba.org/show_bug.cgi?id=10635

The only option now is running Password Passthrough (Single sign on or not,
I don't see the issue)

But I'm sure on the Azure AD connect 2.x have a better compatibility of the
overall AD DC. (At least no sync issue periodically in Server 2012R2)

Hope this helps some of the people.

Regards,
Min Wai

On Wed, Jul 6, 2022 at 6:04 PM Simon FONTENEAU via samba <
samba at lists.samba.org> wrote:

> Hi
>
> Le 06/07/2022 à 10:30, Andrew Bartlett a écrit :
> > We would really prefer the password check API wasn't used like that,
> > but I suppose that works.
>
> yes I understand Something like "post script password" in samba would be
> ideal
>
> >
> > Is there any documentation on which hash formats Azure can take?
> When I looked 4 years ago it was not possible
>
> https://github.com/Azure/azure-sdk-for-python/issues/4018
>
> this may have changed, i have to look.
>
> I just think it's not documented at microsoft...  (He doesn't want it)
>
>
> >
> > Folks had the same for Google, and then we showed that we could have
> > Samba store a crypt() hash and then sync that with the samba-tool
> > userpasswords sync toolkit.
> >
> https://github.com/sfonteneau/samba4-gaps
>
> I know because I participated in the script ;)
> >
> > If storing the plaintext passwords in your directory, GPG encrypted, is
> > not impossible then this can also be done that way, if needed.
> If the password could not be recoverable outside the samba process even
> with a gpg key that would be better.
>
> That's just my opinion
>
> >
> > Andrew Bartlett
> >
> > On Tue, 2022-07-05 at 23:32 +0200, Simon FONTENEAU via samba wrote:
> >> Hi Arthur
> >>
> >> Have you tried to implement this script with /check password script ?
> >> /
> >>
> >>
> https://github.com/sfonteneau/send_password_in_azure/blob/master/send_password_azure.py
> >>
> >> It's less practical but it uses the official Microsoft APIs
> >>
> >> Simon Fonteneau
> >>
> >>
> >> Le 05/07/2022 à 14:12, Arthur Toussaint via samba a écrit :
> >>> Okay, I thought PTA didn't work, but I guess it was because I had
> >>> "Enable single sign on" enabled, once i unticked that, it worked,
> >>> thanks a lot !
> >>> Kind regards
> >>>
> >>>
> >>> De: "Min Wai Chan"<dcmwai at gmail.com>
> >>> À: "arthur toussaint"<arthur.toussaint at wandercraft.eu>
> >>> Envoyé: Mardi 5 Juillet 2022 13:32:36
> >>> Objet: Re: [Samba] Azure AD Sync not working
> >>>
> >>> Dear Arthur,
> >>>
> >>> I'm on Azure Ad connect 1.6.16.0
> >>> Download from this link below
> >>> [https://www.microsoft.com/en-us/download/details.aspx?id=103336   |
> >>> https://www.microsoft.com/en-us/download/details.aspx?id=103336   ]
> >>>
> >>>
> >>> What I do is change the users sign in
> >>>
> >>>
> >>> And Change to pass-through authentication.
> >>>
> >>>
> >>>
> >>> And that will change the azure AD to pass-through authentication...
> >>>
> >>> Hope this help.
> >>>
> >>> Thank You
> >>> Regards,
> >>> Min Wai
> >>>
> >>> On Tue, Jul 5, 2022 at 4:02 PM Arthur Toussaint < [mailto:
> >>> arthur.toussaint at wandercraft.eu   |arthur.toussaint at wandercraft.eu
> >>> ] > wrote:
> >>>
> >>>
> >>>
> >>> Hi,
> >>> Thanks a lot, how did you manage to make Passthrough work ?
> >>> Kind regards
> >>> Arthur
> >>>
> >>>
> >>> De: "Min Wai Chan" < [mailto:dcmwai at gmail.com   |dcmwai at gmail.com   ]
> >>> À: "arthur toussaint" < [mailto:arthur.toussaint at wandercraft.eu
> >>> |arthur.toussaint at wandercraft.eu   ] >
> >>> Cc: "Dr. Hansjörg Maurer" < [mailto:hansjoerg.maurer at itsd.de
> >>> |hansjoerg.maurer at itsd.de   ] >, "samba" < [mailto:
> >>> samba at lists.samba.org   |samba at lists.samba.org   ] >
> >>> Envoyé: Mardi 5 Juillet 2022 04:44:30
> >>> Objet: Re: [Samba] Azure AD Sync not working
> >>>
> >>> Dear Arthur,
> >>> I've face with similar issue on my new Azure AD Connect Setup but
> >>> same like you password hash synchronization don't seem to work.
> >>>
> >>> I'm wondering if the MS site had upgrade to Connect protocol 1st...
> >>>
> >>> I don't know and I'm clueless...
> >>>
> >>> However for me... currently the only working way is Passthrough...
> >>>
> >>> Thank you
> >>>
> >>> Regards,
> >>> Min Wai
> >>>
> >>> On Mon, Jul 4, 2022 at 11:09 PM Arthur Toussaint via samba <
> >>> [mailto:samba at lists.samba.org   |samba at lists.samba.org   ] > wrote:
> >>>
> >>> BQ_BEGIN
> >>> OK,
> >>> Is there anything I could do to help ? Or anywhere I could find
> >>> info about the effort done up to now to trace the root cause ?
> >>> Thanks a lot
> >>> Arthur
> >>>
> >>>
> >>> De: "samba" < [mailto:samba at lists.samba.org   |samba at lists.samba.org
> >>>    ] >
> >>> À: "samba" < [mailto:samba at lists.samba.org   |samba at lists.samba.org
> >>>   ] >
> >>> Envoyé: Lundi 4 Juillet 2022 16:58:04
> >>> Objet: Re: [Samba] Azure AD Sync not working
> >>>
> >>> Hi
> >>>
> >>>
> >>> Am 23.06.22 um 11:03 schrieb Arthur Toussaint via samba:
> >>>> Hi,
> >>>>
> >>>> I'm trying to sync my local samba AD to azure AD, but I'm running
> >>>> into an issue with password hash synchronization.
> >>>> The users sync task works well,but the password hash sync task is
> >>>> always marked "Active" on the interface but never finishes
> >>>> I'm following this guide : [ [
> >>>> https://wiki.samba.org/index.php/Azure_AD_Sync   |
> >>>> https://wiki.samba.org/index.php/Azure_AD_Sync   ] | [
> >>>> https://wiki.samba.org/index.php/Azure_AD_Sync   |
> >>>> https://wiki.samba.org/index.php/Azure_AD_Sync   ] ] with samba
> >>>> 4.13.13
> >>>> Does someone have any pointers on where and what to do to
> >>>> diagnose the issue, I'm not seeing any logs
> >>>> Also, I'm not sure anyone has managed to sync passwords, so even
> >>>> a "Password sync works for me" answer would be a huge help.
> >>> Password sync has been working for almost one year, with the config
> >>> you
> >>> mention above, but it stopped working some month ago (without any
> >>> change
> >>> on the samba side)
> >>> We did not manage to trace it down up to now
> >>>
> >>> Regards
> >>>
> >>> Hansjörg
> >>>
> >>>
> >>>> Thanks a lot
> >>>> Arthur
> --
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba
>