Bug 211706

Created attachment 101247 [details]
YaST2 log file

And what is your correct realm?
What does "net ads info -S $server" (where $server is your AD server) report?

krikkit:~ # net ads info -S g234.suse.de
Failed to get server's current time!
LDAP server: 10.10.103.234
LDAP server name: sbs2003.SBS-TEST.site
Realm: SBS-TEST.SITE
Bind Path: dc=SBS-TEST,dc=SITE
LDAP port: 389
Server time: Thu, 01 Jan 1970 01:00:00 CET
KDC server: 10.10.103.234
Server time offset: 0

According to the logs, yast2-samba-client tried to use SBS-TEST.SITE. Maybe your configuration is wrong.

Which configuration. The yast2-samba-client creates its own samba and kerberos configuration. If I set up a configuration manually and join the domain with the command line tools, it works just fine.

Created attachment 101291 [details]
patch for /usr/share/YaST2/modules/SambaNetJoin.pm

Please patch your /usr/share/YaST2/modules/SambaNetJoin.pm, run yast2-samba-client again and when (during the join) the popup opens, fetch the temporary krb.conf file (found on the location popup tells about) and attach it to the bug.
(The file is removed after YaST module is finished).

Yes, the default_realm is missing. Fix follows as attachment.

Created attachment 101304 [details]
Patch for SambaNetJoin Yast2 Module

Well, but isn't this a bug? Why should krb.conf need to containe "default_realm" key when it already provides the "realm" and the value is the same?

It worked before, so I wonder if something has changed in samba tools or if you have non-standard environment.

Guenther, could you comment?

Guenther, Lars, please comment.

Yes, the new join code in 3.0.23c changes things. We have a patch to allow to define the realm as part of the username, so that yast can join like

net ads join -U administrator@MY.REALM%password

Digging that up, hold on.

Test package is at: http://w3.suse.de/~gd/samba-join-fix/

Jiri, Andreas, could you please have a look?

Now packages live at: 
http://w3.suse.de/~gd/samba-join-fix-i386  or http://w3.suse.de/~gd/samba-join-fix-x86_64/

Do I understand it right? Does yast2-samba-client really have to change the way it calls the join command (comment #11)?

Currently, the realm is given in the temporary krb5.conf file and the join command looks like "KRB5_CONFIG=$tmp_krb_file net ads join -U administrator%password). AFAIK the problem Andreas pointed out that when krb.conf file doesn't contain "default_realm" key (while it _does_ contains the "realm"!) This is change from previous versions (see comment #9) - couldn't it be just fixed back, so the "default_realm" is not needed when "realm" is present?

If you really want to change the join command to include the realm, is the temporary krb.conf file still necessary?

(In reply to comment #14)
> Do I understand it right? Does yast2-samba-client really have to change the way
> it calls the join command (comment #11)?

No, but we needed to handle the case that you don't.

> Currently, the realm is given in the temporary krb5.conf file and the join
> command looks like "KRB5_CONFIG=$tmp_krb_file net ads join -U
> administrator%password). AFAIK the problem Andreas pointed out that when
> krb.conf file doesn't contain "default_realm" key (while it _does_ contains the
> "realm"!) This is change from previous versions (see comment #9) - couldn't it
> be just fixed back, so the "default_realm" is not needed when "realm" is
> present?

It should be fixed by now, but I need to do some more testing myself.

> If you really want to change the join command to include the realm, is the
> temporary krb.conf file still necessary?

Let me check.

having the temp. krb5.conf is still correct. no change required in that regard. With our currently committed samba package (apart from your very recent join fix in bug #215645) the joining was successful for me again.

So I assume the problem is fixed in samba tools and no change in YaST needs to be  done for this issue.