Bug 48231 – sambaNTPassword: NO PASSWORD*** after AD-Takeover from ad/member

Bug 48231 - sambaNTPassword: NO PASSWORD*** after AD-Takeover from ad/member


Summary:	sambaNTPassword: NO PASSWORD*** after AD-Takeover from ad/member

Status:	RESOLVED WONTFIX

Product:	UCS
Classification:	Unclassified
Component:	AD Takeover
Version:	UCS 4.3
Hardware:	Other Linux

Importance:	P5 normal (vote)
Target Milestone:	---
Assigned To:	Samba maintainers
QA Contact:	Samba maintainers

URL:
Keywords:

Depends on:	35540
Blocks:
	Show dependency tree / graph

Reported:	2018-11-28 17:04 CET by Arvid Requate
Modified:	2021-05-14 16:38 CEST (History)
CC List:	5 users (show)

See Also:	49590
What kind of report is it?:	Development Internal
What type of bug is this?:	---
Who will be affected by this bug?:	---
How will those affected feel about the bug?:	---
User Pain:	0.229
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional):
Max CVSS v3 score:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Arvid Requate

2018-11-28 17:04:38 CET

If an AD-Takeover is performed in an UCS domain that previously had an ad/member connection to the AD domain, the user password attributes in OpenLDAP have special values:

* userPassword: {KINIT}
* sambaNTPassword: NO PASSWORD*********************
* krb5Keys: <generated by users/user from random password>


When the S4-Connector is started during the AD-Takeover, it starts with sync_from_ucs. Bug #35540 fixed the rejects that occurred in this situation, by ignoring these "NO PASSWORD" password values. But that still leaves these values in OpenLDAP and that might cause confusion (and possibly issues in special setups).



We could improve this by running a resync_from_s4 in AD-Takeover:

/usr/share/univention-s4-connector/resync_object_from_s4.py \
  --filter '(&(objectClass=user)(!(objectClass=computer))(userAccountControl:1.2.840.113556.1.4.803:=512))'

The filter ^^^ is taken from the 'user' section of the S4-Connector mapping.

Comment 1 Ingo Steuwer

2021-05-14 16:38:06 CEST

This issue has been filed against UCS 4.3.

UCS 4.3 is out of maintenance and many UCS components have changed in later releases. Thus, this issue is now being closed.

If this issue still occurs in newer UCS versions, please use "Clone this bug" or reopen it and update the UCS version. In this case please provide detailed information on how this issue is affecting you.