[Samba] Online AD Backup fails with "no auth" in 4.20?

[Douglas Bagnall]

On 28/06/24 17:18, Michael Tokarev via samba wrote:

>>   /usr/bin/samba-tool domain backup online --targetdir=/root/samba-ad-backup-awing/ --server=awing -UAdministrator
>> INFO 2024-06-27 18:35:35,593 pid:2650 /usr/lib/python3/dist-packages/samba/join.py #1637: workgroup is MAD
>> INFO 2024-06-27 18:35:35,593 pid:2650 /usr/lib/python3/dist-packages/samba/join.py #1640: realm is mad.caponato.es
>> Calling bare provision
>> INFO 2024-06-27 18:35:35,606 pid:2650 /usr/lib/python3/dist-packages/samba/provision/__init__.py #2110: Looking up
>> IPv4 addresses
>> INFO 2024-06-27 18:35:35,607 pid:2650 /usr/lib/python3/dist-packages/samba/provision/__init__.py #2127: Looking up
>> IPv6 addresses
>> WARNING 2024-06-27 18:35:35,607 pid:2650 /usr/lib/python3/dist-packages/samba/provision/__init__.py #2134: No IPv6
>> address will be assigned
>> ERROR(exception): uncaught exception - File
>> [/usr/share/samba/setup/ad-schema/AD_DS_Attributes_Windows_Server_v1903.ldf] not found. Please install
>> samba-ad-provision package
> 
> Hmm.  Why it needs the ldif for `domain backup online' ?

Online backup works by using the replication code to get a copy of
the database to tar up. To do this it pretends to itself that it is
a new DC, for which it uses the join code which relies on provision,
which needs the base ldif, which is the traceback you see.

I think David Mulder did some work to separate out the Python bits
that don't rely on AD, and put in some stubs to make the edges less
sharp, but I don't remember the details (and it probably wouldn't
allow this backup).

cheers,
Douglas