Bug 34669 - Sync servicePrincipalName
Sync servicePrincipalName
Status: REOPENED
Product: UCS
Classification: Unclassified
Component: S4 Connector
UCS 4.4
Other Linux
: P5 enhancement (vote)
: ---
Assigned To: Samba maintainers
https://etherpad-lite.knut.univention...
:
Depends on:
Blocks: 30115 32079
  Show dependency treegraph
 
Reported: 2014-04-28 13:59 CEST by Arvid Requate
Modified: 2020-07-13 20:13 CEST (History)
4 users (show)

See Also:
What kind of report is it?: Feature Request
What type of bug is this?: 2: Improvement: Would be a product improvement
Who will be affected by this bug?: 2: Will only affect a few installed domains
How will those affected feel about the bug?: 3: A User would likely not purchase the product
User Pain: 0.069
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional):
Max CVSS v3 score:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Arvid Requate univentionstaff 2014-04-28 13:59:23 CEST
Currently there is no way to indirectly set a servicePrincipalName in Samba/AD via some UDM operation.


This would be good for situations like Bug 30115 and Bug 27980 / Bug 30348 (related: Bug 31968) and would avoid Bugs like Bug 34575


The S4-Connector only synchronizes userPrincipalName with krb5PrincipalName, both of which are single-value.

To make things more challenging the OpenLDAP krb5-kdc.schema semantics differ from the servicePrincipalName (SPN) concept in AD/Samba:

 * In OpenLDAP we have separate objects below cn=kerberos for each SPN.

 * In AD/Samba we have several SPNs attached to one machine/user object.
The "advantage" of the AD/Samba approach is that one set of Kerberos keys can be associated with several services.


Starting with Windows 2008 R2 Active Directory additionally supports "Managed Service Accounts", which might be more compatible with the OpenLDAP schema:
http://blogs.technet.com/b/askds/archive/2009/09/10/managed-service-accounts-understanding-implementing-best-practices-and-troubleshooting.aspx

It's probably pretty challenging to adjust the S4-Connector in a way that covers these options, but some way to achive this would be good.
Comment 1 Arvid Requate univentionstaff 2014-04-28 14:12:06 CEST
This also blocks Bug 32079.
Comment 2 Ingo Steuwer univentionstaff 2020-07-03 20:54:17 CEST
This issue has been filed against UCS 4.2.

UCS 4.2 is out of maintenance and many UCS components have changed in later releases. Thus, this issue is now being closed.

If this issue still occurs in newer UCS versions, please use "Clone this bug" or reopen it and update the UCS version. In this case please provide detailed information on how this issue is affecting you.