Comment 1 Stefan Gohmann 2017-06-16 20:40:34 CEST

This issue has been filed against UCS 3. UCS 3 is out of the normal maintenance and many UCS components have vastly changed in UCS 4.

If this issue is still valid, please change the version to a newer UCS version otherwise this issue will be automatically closed in the next weeks.

Comment 2 Stefan Gohmann 2017-08-08 07:08:35 CEST

This issue has been filed against UCS 3.0.

UCS 3.0 is out of maintenance and many UCS components have vastly changed in later releases. Thus, this issue is now being closed.

If this issue still occurs in newer UCS versions, please use "Clone this bug" or reopen this issue. In this case please provide detailed information on how this issue is affecting you.

Comment 3 Florian Best 2021-08-08 11:12:16 CEST

It's still with UCS 5.0 not possible to set a custom kerberos realm during installation.

The kerberos realm is automatically chosen from the entered FQDN. e.g. primary.ucs3.intern.local creates a realm ucs3.intern.local but one wants to set up intern.local.

Fixing this should be simple by just setting another UCR variable.

Comment 4 Florian Best 2021-08-13 16:37:49 CEST

A patch is available in git:fbest/netbios-name-kerberos-realm.
It add the configuration of kerberos realm in system setup - by clicking on advanced settings (see attachment 10795 [details]).

We also need to patch the samba provisioning to make it work with Samba 4. Samba 4 used the kerberos realm as dns domainname. We have to keep the domainname of UCS.

Comment 5 Florian Best 2021-08-16 13:48:13 CEST

TODO:

1. error messages in samba_dnsupdate:
  /usr/sbin/samba_dnsupdate: ERROR: Zone does not exist; record could not be added. zone[example.local] name[_ldap._tcp.Default-First-Site-Name._sites.ForestDnsZones]                                                                        
[2021/08/14 05:15:24.480290,  0, pid=10555] ../../source4/dsdb/dns/dns_update.c:86(dnsupdate_nameupdate_done)
  dnsupdate_nameupdate_done: Failed DNS update with exit code 27

2. kinit fails
# univention-s4search >/dev/null 
Wrong username or password: kinit for ucs45$@EXAMPLE.LOCAL failed (Client not found in Kerberos database)

3.
in LDAP:
dn: CN=UCS45,OU=Domain Controllers,DC=example,DC=local
krb5PrincipalName: host/ucs45.intranet.example.local@EXAMPLE.LOCAL
 
in Samba:

dn: CN=UCS45,OU=Domain Controllers,DC=example,DC=local
does not contain:
servicePrincipalName: HOST/ucs45.intranet.example.local/EXAMPLE.LOCAL

4. … ?