ALT Linux Bugzilla – #55324

Исправление ошибки https://bugzilla.altlinux.org/55238, по всей вероятности, сломало это.


Шаги
====

1. Развернуть Samba DC (ALT Server 11.0 x86_64) и реплику и ввести клиентов (ALT Workstation, Workstation K, Education (KDE), Education (XFCE) 11.0 x86_64).

2. Выполнить `# kinit testuser` для тестового пользователя.

3. # gpoa --loglevel 0


Фактический результат
=====================

3. Запрашивается пароль, хотя пользователь авторизован через kinit:

> 2025-07-23 15:37:39.765|[D00061]| Процесс GPOA запущен для компьютера|{'username': 'S-EDU-KDE$', 'is_machine': True, > 'process_username': 'root', 'process_uid': 0}
> 2025-07-23 15:37:39.766|[D00060]| Запуск GPOA от root для пользователя|{'username': 'S-EDU-KDE$'}
> 2025-07-23 15:37:39.766|[D00003]| Инициализация плагинов|{}
> 2025-07-23 15:37:39.767|[D00004]| Инициализирован плагин ADP|{}
> 2025-07-23 15:37:39.853|[D00018]| Имя домена Active Directory успешно определено при запросе к LDAP|{'domain': > 'samba.testdomain'}
> 2025-07-23 15:37:39.854|[D00009]| Инициализация бэкэнда Samba|{'domain': 'samba.testdomain', 'username': 'S-EDU-KDE$', > 'is_machine': True}
> 2025-07-23 15:37:39.882|[D00017]| Проверка билета Kerberos прошла успешно|{'output': 'Ticket cache: > FILE:/var/cache/gpupdate/creds/krb5cc_2354\nDefault principal: S-EDU-KDE$@SAMBA.TESTDOMAIN\n\nValid starting       > Expires              Service principal\n23.07.2025 15:37:39  24.07.2025 01:37:39  krbtgt/SAMBA.TESTDOMAIN@SAMBA.TESTDOMAIN> \n\trenew until 30.07.2025 15:37:39\n'}
> 2025-07-23 15:37:39.883|[D00021]| Установка рабочего SID|{'sid': 'S-1-5-21-2683076439-4171479240-4005529867-1106'}
> 2025-07-23 15:37:39.883|[D00007]| Определена директория кэша Samba|{'cachedir': '/var/cache/samba'}
> 2025-07-23 15:37:39.884|[D00045]| Начато обновление GPO|{'username': 'S-EDU-KDE$', 'sid': > 'S-1-5-21-2683076439-4171479240-4005529867-1106'}
> 2025-07-23 15:37:39.887|[D00048]| Установка соединения с контроллером домена AD|{}
> 2025-07-23 15:37:39.913|[D00047]| Получение списка GPO для репликации с контроллера домена AD|{}
> 2025-07-23 15:37:39.938|[I00001]| Получен список GPO для пользователя|{'username': 'S-EDU-KDE$'}
> 2025-07-23 15:37:39.939|[I00002]| Получен объект групповой политики|{'gpo_name': 'Local Policy', 'gpo_uuid': 'Local > Policy', 'file_sys_path': None}
> 2025-07-23 15:37:39.939|[I00002]| Получен объект групповой политики|{'gpo_name': 'Default Domain Policy', 'gpo_uuid': '> {31B2F340-016D-11D2-945F-00C04FB984F9}', 'file_sys_path': '\\\\samba.testdomain\\sysvol\\samba.testdomain\\Policies\\> {31B2F340-016D-11D2-945F-00C04FB984F9}'}
> 2025-07-23 15:37:39.939|[D00049]| Начата репликация GPO от контроллера домена AD|{'username': 'S-EDU-KDE$', 'dc': > 'dc.samba.testdomain'}
> Password for [testuser@SAMBA.TESTDOMAIN]:


Ожидаемый результат
===================

3. Нет запроса пароля.


Дополнительно
=============

# cat /etc/samba/smb.conf

На клиенте:

> # See smb.conf.example for a more detailed config file or
> # read the smb.conf manpage.
> # Run 'testparm' to verify the config is correct after
> # you modified it.
> #
> # Note:
> # SMB1 is disabled by default. This means clients without support for SMB2 or
> # SMB3 are no longer able to connect to smbd (by default).
>
> [global]
> 	security = ads
> 	realm = SAMBA.TESTDOMAIN
> 	workgroup = SAMBA
> 	netbios name = S-EDU-KDE
> 	template shell = /bin/bash
> 	kerberos method = system keytab
> 	wins support = no
> 	winbind use default domain = yes
> 	winbind enum users = no
> 	winbind enum groups = no
> 	template homedir = /home/SAMBA.TESTDOMAIN/%U
>         idmap config * : range = 200000-2000200000
>         idmap config * : backend = sss
>
> 	machine password timeout = 0
> ;	encrypt passwords = true
> ;	dns proxy = no
> ;	socket options = TCP_NODELAY
> ;	domain master = no
> ;	local master = no
> ;	preferred master = no
> ;	os level = 0
> ;	domain logons = no
> ;	load printers = no
> ;	show add printer wizard = no
> ;	printcap name = /dev/null
> ;	disable spoolss = yes
> [homes]
> 	comment = Home Directories
> 	valid users = %S, %D%w%S
> 	browseable = no
> 	read only = no
> 	inherit acls = yes
>
> [printers]
> 	comment = All Printers
> 	path = /var/tmp
> 	printable = yes
> 	create mask = 0600
> 	browseable = no
>
> [print$]
> 	comment = Printer Drivers
> 	path = /var/lib/samba/drivers
> 	write list = @printadmin root
> 	force group = @printadmin
> 	create mask = 0664
> 	directory mask = 0775


На сервере:

> [global]
>     dns forwarder =  <dns-ipv4>
>     netbios name = DC
>     realm = SAMBA.TESTDOMAIN
>     server role = active directory domain controller
>     workgroup = SAMBA
>     idmap_ldb:use rfc2307 = yes
>     printcap name = cups
>     load printers = yes
>     cups server = "localhost"
>     printing = cups
>     log file = /var/log/samba/log.%m
>     max log size = 50
>     interfaces = <self-ipv4> 127.0.0.1
>     bind interfaces only = yes
>
> [printers]
>     comment = All Printers
>     path = /var/spool/samba
>     browseable = no
>     guest ok = yes
>     writable = yes
>     printable = yes
>
> [media]
>     comment = media
>     browseable = yes
>     path = /media
>     read only = no
>     guest ok = yes
>
> [sysvol]
>     path = /var/lib/samba/sysvol
>     read only = No
>
> [netlogon]
>     path = /var/lib/samba/sysvol/samba.testdomain/scripts
>     read only = No
>
> [SHARE]
>     comment = Share directory for AD users
>     path = /var/share
>     public = no
>     writable = yes
>     read only = no
>     guest ok = no
>     valid users = "@samba\Domain Users" "@samba\Domain Admins"
>     create mask = 0666
>     directory mask = 0777
>     force create mode = 0666
>     force directory mode = 0777
>     inherit owner = yes

На реплике:

> # Global parameters
> [global]
> 	bind interfaces only = Yes
> 	dns forwarder = <dns-ipv4>
> 	interfaces = <self-ipv4> 127.0.0.1
> 	netbios name = DC2
> 	realm = SAMBA.TESTDOMAIN
> 	server role = active directory domain controller
> 	workgroup = SAMBA
>
> [sysvol]
> 	path = /var/lib/samba/sysvol
> 	read only = No
>
> [netlogon]
> 	path = /var/lib/samba/sysvol/samba.testdomain/scripts
> 	read only = No

Воспроизводимость
=================

Воспроизводится на виртуальных машинах:

[sisyphus]
samba-4.21.7-alt2.x86_64
sssd-2.9.7-alt3.x86_64
gpupdate-0.13.2-alt1.noarch

[p11+387440.5]
samba-4.21.7-alt2.x86_64
sssd-2.9.7-alt3.x86_64
gpupdate-0.13.2-alt1.noarch


Не воспроизводится на виртуальных машинах:

[p11+387440.4]
samba-4.21.7-alt1.x86_64
sssd-2.9.7-alt2.x86_64
gpupdate-0.13.2-alt1.noarch

[p11]
samba-4.20.8-alt2.x86_64
sssd-2.9.7-alt1.x86_64
gpupdate-0.13.2-alt1.noarch