Hi, I could workaround the problem:
When I first connect to any share (e.g. the Netlogon share) on one Domain Controller of the SAMBA Domain, I am able to search users in the SAMBA Domain. Now, the next problem is that after I set some permissions on a file using SAMBA Domain users, logout and login again the SIDs do not get resolved anymore. Instead of seeing some Users like "SAMBA\jsmith" I see only his SID in the permission dialog. How can I force Windows to resolve the SIDs? Any help is greatly appreciated Best Regards Harry On Mon, 2010-03-22 at 14:25 +0100, Harald Strack wrote: > Hi, > > our setup is > > Samba 3.3.12 as the Trusted Domain (Domain name: SAMBA) > Windows 2008r2 as the Trusting Domain (Domain name: W2008) > > The trust itself works quite well, users of the SAMBA Domain are able to > log into the workstations of the W2008 domain and even roaming profiles > are working. > > However, when I try to configure permissions on a share of the W2008r2 > server to users from the SAMBA domain (e.g. SAMBA\jsmith), while I am > logged in as a user from the W2008 domain (e.g. W2008\Administrator) I > do not find any user from the SAMBA domain. > > > Background: > > Whenever a users wants to access the SAMBA domain, even when he only > wants to search users for granting permissions, he has to authenticate > first. As far as I know, the user has to authenticate, not the machine. > > Now, when I am logged in as a user from another domain (e.g. W2008 > \Administrator) I cannot authenticate in the SAMBA domain with my actual > credentials (desktop single sign-on). However, Windows 2008 R2 tries to > authenticate at the SAMBA domain controller several times with the > credentials (User: Administrator) of the W2008 domain. > > Samba Log of a SAMBA domain controller: > > [2010/03/22 12:07:51, 2] lib/access.c:check_access(406) > Allowed connection from (10.10.20.167) > [2010/03/22 12:07:51, 2] lib/smbldap.c:smbldap_open_connection(890) > smbldap_open_connection: connection opened > [2010/03/22 12:07:51, 2] auth/auth.c:check_ntlm_password(318) > check_ntlm_password: Authentication for user [Administrator] -> > [Administrator] FAILED with error NT_STATUS_NO_SUCH_USER > [2010/03/22 12:07:51, 2] auth/auth.c:check_ntlm_password(318) > check_ntlm_password: Authentication for user [Administrator] -> > [Administrator] FAILED with error NT_STATUS_NO_SUCH_USER > [2010/03/22 12:07:51, 2] auth/auth.c:check_ntlm_password(318) > check_ntlm_password: Authentication for user [Administrator] -> > [Administrator] FAILED with error NT_STATUS_NO_SUCH_USER > [2010/03/22 12:07:51, 2] auth/auth.c:check_ntlm_password(318) > check_ntlm_password: Authentication for user [Administrator] -> > [Administrator] FAILED with error NT_STATUS_NO_SUCH_USER > [2010/03/22 12:07:51, 2] auth/auth.c:check_ntlm_password(318) > check_ntlm_password: Authentication for user [Administrator] -> > [Administrator] FAILED with error NT_STATUS_NO_SUCH_USER > > However, Earlier versions of Windows tried only once to connect with the > wrong credentials and then appeared a prompt where the user could enter > its credentials in the other domain (SAMBA) to gain access to their > ressources. > > Does anyone know a registry setting or sth. similar that forces W2008R2 > to offer me a prompt for credentials if it gets a > NT_STATUS_NO_SUCH_USER? > > Or any other solution? I greatly appreciate any comments! > > Best Regards > > Harry > > -- > Harald Strack, Dipl.Inf.(FH) > IT Development > > ssystems > c/o todo GmbH > Alt-Moabit 60a > 10555 Berlin > > http://www.ssystems.de > > -- > To unsubscribe from this list go to the following URL and read the > instructions: https://lists.samba.org/mailman/options/samba -- Harald Strack, Dipl.Inf.(FH) IT Development ssystems c/o todo GmbH Alt-Moabit 60a 10555 Berlin Tel: +49 30 805 78 - 101 http://www.ssystems.de -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/options/samba
