Bug 31919 – msDS-KeyVersionNumber != krb5KeyVersionNumber after migration to Samba4

Bug 31919 - msDS-KeyVersionNumber != krb5KeyVersionNumber after migration to Samba4


Summary:	msDS-KeyVersionNumber != krb5KeyVersionNumber after migration to Samba4

Status:	RESOLVED WONTFIX

Product:	UCS
Classification:	Unclassified
Component:	Samba4
Version:	UCS 3.1
Hardware:	Other Linux

Importance:	P5 normal (vote)
Target Milestone:	---
Assigned To:	Samba maintainers
QA Contact:

URL:
Keywords:

Depends on:
Blocks:
	Show dependency tree / graph

Reported:	2013-07-08 16:35 CEST by Arvid Requate
Modified:	2016-10-11 08:01 CEST (History)
CC List:	1 user (show)

See Also:	32082
What kind of report is it?:	---
What type of bug is this?:	---
Who will be affected by this bug?:	---
How will those affected feel about the bug?:	---
User Pain:
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional):
Max CVSS v3 score:

Attachments
set-user-msDS-KeyVersionNumber-to-value-of-krb5KeyVersionNumber.py (1.58 KB, text/plain) 2013-07-08 16:40 CEST, Arvid Requate	Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Arvid Requate

2013-07-08 16:35:20 CEST

When migrating a Samba3 Domain to Samba4 the msDS-KeyVersionNumber is 1 for all Samba accounts in the Samba directory service, no matter what krb5KeyVersionNumber they currently have in OpenLDAP. This might explain problems we experienced in the early phase of the UCS 3.0 development in the interaction of clients and services running hosted on Samba4 servers and non-Samba4 servers.

When the password is modified in the Samba directory service the S4 Connector unconditionally writes the incremented msDS-KeyVersionNumber to the krb5KeyVersionNumber.

Comment 1 Arvid Requate

2013-07-08 16:40:03 CEST

Created attachment 5313 [details]
set-user-msDS-KeyVersionNumber-to-value-of-krb5KeyVersionNumber.py

Example script which increments the msDS-KeyVersionNumber of all users (not machines) to the value of their krb5KeyVersionNumber. Obviously one could do the reverse as well, re-setting the LDAP-attribute, which might be a better choice especially in the case of DCs (otherwise the msDS-KeyVersionNumber would need to be modified in the local secrets.ldb of the respective DC).

Comment 2 Stefan Gohmann

2016-10-11 08:01:18 CEST

This issue has been filed against UCS 3.1.

UCS 3.1 is out of maintenance and many UCS components have vastly changed in later releases. Thus, this issue is now being closed.

If this issue still occurs in newer UCS versions, please reopen.