[Samba] Issue with FAST implementation ? Disabling really disable ?

[Andrew Bartlett]

On Wed, 2022-07-20 at 13:19 +0200, Olivier BILHAUT via samba wrote:
> Hi list, 
> Juste migrating from samba 4.14 to samba 4.16.3. Most worksfine and
> thanks again for this great work. 
> However I have an issuewith a smbclient run locally which seems to
> fail due to a FAST issue.

Until you said this:

> The command is run from the DC itself : 
> gse_get_client_auth_token: gss_init_sec_context failed with
> [Miscellaneous failure (see text): FAST fast response is missing FX-
> FAST(cifs/DOMAIN.TLD at LOCAL)](2529639059)gensec_spnego_client_negToken
> Init_step:gse_krb5: creating NEG_TOKEN_INIT for cifs/domain.tld
> failed(next[(null)]): NT_STATUS_LOGON_FAILUREsession setup
> failed:NT_STATUS_LOGON_FAILURE 
I was going to say that this is almost certainly clock skew.  I saw the
same and got very confused until I fixed the clocks.

But the same sort of still applies, this isn't really about FAST, it is
another error that is being over-written by the FAST failure because
the error packet doesn't offer FAST.

That is also why turning it off on the KDC isn't helping, because this
is the client hoping for FAST.

Andrew Bartlett

-- 
Andrew Bartlett (he/him)       https://samba.org/~abartlet/Samba Team Member (since 2001) https://samba.orgSamba Team Lead, Catalyst IT   https://catalyst.net.nz/services/samba
Samba Development and Support, Catalyst IT - Expert Open SourceSolutions