Web lists-archives.com

Re: [Samba] Unable to add additional domain controller - uncaught exception - LDAP error 10 on join




Il 03/10/2018 13:00, Alexey Sheplyakov via samba ha scritto:


On 10/02/2018 05:21 PM, Fabio Fantoni via samba wrote:
I updated both the linux domain controllers to samba 4.8.5, changed the hostname of server I tried to add as dc but same error:

samba-tool domain join m2r.local DC -Uadministrator --realm=m2r.local --dns-backend=SAMBA_INTERNAL --option='idmap_ldb:use rfc2307 = yes'
Finding a writeable DC for domain 'm2r.local'
Found DC DUO-ADD-DC.m2r.local
Password for [WORKGROUP\administrator]:
workgroup is M2R
realm is m2r.local
Adding CN=D9NDC,OU=Domain Controllers,DC=m2r,DC=local
Adding CN=D9NDC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=m2r,DC=local Adding CN=NTDS Settings,CN=D9NDC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=m2r,DC=local
Join failed - cleaning up
Deleted CN=D9NDC,OU=Domain Controllers,DC=m2r,DC=local
Deleted CN=NTDS Settings,CN=D9NDC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=m2r,DC=local Deleted CN=D9NDC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=m2r,DC=local ERROR(ldb): uncaught exception - LDAP error 10 LDAP_REFERRAL - <0000202B: RefErr: DSID-030A0B09, data 0, 1 access points
 ref 1: 'a45ce9be-c350-4429-964b-a10c1dd92af5._msdcs.m2r.local'
> <ldap://a45ce9be-c350-4429-964b-a10c1dd92af5._msdcs.m2r.local>
  File "/usr/lib/python2.7/dist-packages/samba/netcmd/__init__.py", line 176, in _run
    return self.run(*args, **kwargs)
  File "/usr/lib/python2.7/dist-packages/samba/netcmd/domain.py", line 706, in run
    plaintext_secrets=plaintext_secrets)
  File "/usr/lib/python2.7/dist-packages/samba/join.py", line 1482, in join_DC
    ctx.do_join()
  File "/usr/lib/python2.7/dist-packages/samba/join.py", line 1381, in do_join
    ctx.join_add_objects()
  File "/usr/lib/python2.7/dist-packages/samba/join.py", line 673, in join_add_objects
    ctx.samdb.modify(m)


d7npdc have all roles:

samba-tool fsmo show
SchemaMasterRole owner: CN=NTDS Settings,CN=D7NPDC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=m2r,DC=local InfrastructureMasterRole owner: CN=NTDS Settings,CN=D7NPDC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=m2r,DC=local RidAllocationMasterRole owner: CN=NTDS Settings,CN=D7NPDC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=m2r,DC=local PdcEmulationMasterRole owner: CN=NTDS Settings,CN=D7NPDC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=m2r,DC=local DomainNamingMasterRole owner: CN=NTDS Settings,CN=D7NPDC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=m2r,DC=local DomainDnsZonesMasterRole owner: CN=NTDS Settings,CN=D7NPDC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=m2r,DC=local ForestDnsZonesMasterRole owner: CN=NTDS Settings,CN=D7NPDC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=m2r,DC=local

DUO-ADD-DC.m2r.local is additional dc w2008r2 added recently, d7npdc what at samba 4.5 at the windows dc join.

We have been experiencing a similar (same?) problem when joining samba4 DC's to windows (2008 r2) ones, see this thread for more details: https://lists.samba.org/archive/samba-technical/2018-June/128672.html

As far as I understand the problem is caused by 3 factors

1) samba-tool prefers to pick a windows DC to perform the join
2) when joining as a DC samba-tool tries to modify the application directory partition (presumably describing DNS zone) via LDAP (as opposed to DRS RPC) 3) windows strictly obeys FSMO roles and returns an error (or rather a referral) if  (to a DC holding `Domain naming master` FSMO role)

To solve the problem one can instruct samba-tool to talk with a DC holding `Domain naming master' FSMO role
(d7npdc in your example), something like this:

samba-tool domain join m2r.local DC --server=D7NPDC.m2r.local -Uadministrator --realm=m2r.local --dns-backend=SAMBA_INTERNAL --option='idmap_ldb:use rfc2307 = yes'

Or apply a patch which does this automatically (attached), and (if you feel lucky) convince samba developers
to merge it (so people won't face this problem ever and ever again).

Thanks for help me to solve the issue (the new dc join is now completed), I also suppose is good apply your patch upstream, you already posted it but was rejected?

---
Questa e-mail è stata controllata per individuare virus con Avast antivirus.
https://www.avast.com/antivirus


--
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba