Hi everyone, The term "regression" is a slight overstatement for Kinetic, as login fails with the version in -updates as well, due to it not supporting the "-" in the domain name.
With 0.9.2 in kinetic -updates: ERRORgithub.com/ubuntu/adsys/cmd/adsysd/main.go:50 main.run() Error from server: error while updating policy: can't get policies for "ec2amaz- hg2r0q8.fabio-rg.com": failed to retrieve offline state from SSSD: dbus: invalid message: invalid path name and then login also fails. So, the package in -proposed does not break anything further, but it doesn't fix everything either. Now, here is what I found with the package in -proposed: Jul 20 05:21:35 ip-172-31-55-219 adsysctl[2564546]: level=error msg="Error from server: error while updating policy: can't get policies for \"ip-172-31-55-219\": failed to retrieve the list of GPO (exited with 1): exit status 1 Failed to bind - LDAP client internal error: NT_STATUS_INVALID_PARAMETER Failed to connect to 'ldap://ec2amaz-hg2r0q8.fabio-rg.com' with backend 'ldap': LDAP client internal error: NT_STATUS_INVALID_PARAMETER Failed to open session: (1, 'LDAP client internal error: NT_STATUS_INVALID_PARAMETER') " > Failed to connect to 'ldap://ec2amaz-hg2r0q8.fabio-rg.com' > ith backend 'ldap': LDAP client internal error: NT_STATUS_INVALID_PARAMETER So this is a ldap based error, but we know this already. I then tried to use other ldap based tools, like ldbsearch: $ sudo apt install ldb-tools samba-dsdb-modules $ cd /tmp $ ll krb5cc_1930801111_Xu8aKP $ sudo ldbsearch -H ldap://ec2amaz-hg2r0q8.fabio-rg.com --use-krb5-ccache=/tmp/krb5cc_1930801111_Xu8aKP --debug-stdout --debuglevel 20 ... resolve_lmhosts: Attempting lmhosts lookup for name ec2amaz-hg2r0q8.fabio-rg.com<0x20> startlmhosts: Can't open lmhosts file /etc/samba/lmhosts. Error was No such file or directory Starting GENSEC mechanism spnego Starting GENSEC submechanism gssapi_krb5 cli_credentials(WORKGROUP/root) without realm, cannot use kerberos for this connection ldap/ec2amaz-hg2r0q8.fabio-rg.com Failed to start GENSEC client mech gssapi_krb5: NT_STATUS_INVALID_PARAMETER gensec_spnego_create_negTokenInit_step: Failed to setup SPNEGO negTokenInit request gensec_update_send: spnego[0x5556c039ff10]: subreq: 0x5556c03a0450 gensec_update_done: spnego[0x5556c039ff10]: NT_STATUS_INVALID_PARAMETER tevent_req[0x5556c03a0450/../../auth/gensec/spnego.c:1631]: state[3] error[-7963671676338569203 (0x917B5ACDC000000D)] state[struct gensec_spnego_update_state (0x5556c03a0610)] timer[(nil)] finish[../../auth/gensec/spnego.c:1947] Failed to bind - LDAP client internal error: NT_STATUS_INVALID_PARAMETER Failed to connect to 'ldap://ec2amaz-hg2r0q8.fabio-rg.com' with backend 'ldap': LDAP client internal error: NT_STATUS_INVALID_PARAMETER Failed to connect to ldap://ec2amaz-hg2r0q8.fabio-rg.com - LDAP client internal error: NT_STATUS_INVALID_PARAMETER Now, if we do this on Jammy, it works fine. I was trying out different parameters to ldbsearch on kinetic, as you can see the user is incorrect: WORKGROUP/root The clue came from: cannot use kerberos for this connection ldap/ec2amaz-hg2r0q8.fabio- rg.com I started looking at kerberos credential caches. I found that if I did a fresh kinit: $ sudo kinit [email protected] Password for [email protected]: $ ll krb5cc_0 krb5cc_1930801111_Xu8aKP Now, if we use this fresh one: $ sudo ldbsearch -H ldap://ec2amaz-hg2r0q8.fabio-rg.com --use- krb5-ccache=/tmp/krb5cc_0 --debug-stdout --debuglevel 20 Everything works fine on Kinetic. So, maybe the kerberos keytab / credential cache is broken. If we compare: $ sudo klist /tmp/krb5cc_0 Ticket cache: FILE:/tmp/krb5cc_0 Default principal: [email protected] Valid starting Expires Service principal 07/20/23 05:28:49 07/20/23 15:28:49 krbtgt/[email protected] renew until 07/21/23 05:28:38 07/20/23 05:30:18 07/20/23 15:28:49 ldap/[email protected] renew until 07/21/23 05:28:38 $ sudo klist /tmp/krb5cc_1930801111_Xu8aKP Ticket cache: FILE:/tmp/krb5cc_1930801111_Xu8aKP Default principal: [email protected] Valid starting Expires Service principal 07/20/23 03:19:25 07/20/23 13:19:25 krbtgt/[email protected] renew until 07/21/23 03:19:25 If we compare to Jammy: $ sudo klist /tmp/krb5cc_1930801111_5HVmi5 Ticket cache: FILE:/tmp/krb5cc_1930801111_5HVmi5 Default principal: [email protected] Valid starting Expires Service principal 07/20/23 01:19:29 07/20/23 11:19:29 krbtgt/[email protected] renew until 07/21/23 01:19:29 07/20/23 01:19:30 07/20/23 11:19:29 ldap/[email protected] 07/20/23 01:19:30 07/20/23 11:19:29 cifs/[email protected] The kerberos credential cache obtained by sssd is missing the service principal for ldap/[email protected]. I haven't figured out why sssd is not adding ldap/ to the credential cache, or how to add one manually to test, but I think this is what is broken on Kinetic. Thanks, Matthew -- You received this bug notification because you are a member of Desktop Packages, which is subscribed to adsys in Ubuntu. https://bugs.launchpad.net/bugs/2020834 Title: Properly convert DNS names with '-' characters to valid dbus object paths Status in adsys package in Ubuntu: Fix Released Status in adsys source package in Focal: Fix Committed Status in adsys source package in Jammy: Fix Committed Status in adsys source package in Kinetic: Confirmed Bug description: [Impact] It is common that domain names contain the '-' character, as in "test- example.com", and adsys versions 0.9.2 and below cannot parse these correctly, leading to the error: ERRORgithub.com/ubuntu/adsys/cmd/adsysd/main.go:50 main.run() Error from server: error while updating policy: can't get policies for "test-example.com": failed to retrieve offline state from SSSD: dbus: invalid message: invalid path name when attempting to run adsys on a system attached to "test- example.com" Active Directory. Currently, 0.9.2 only changes '.' into '_2e', and this would change all special characters to use their hexadecimal representations, notably '-' becomes '_2d'. There is plans from Foundations + Desktop to SRU 0.12.0 back to at least Jammy, documented in bug 2020682 which depends on golang 1.20 to be included in the jammy archive, documented in bug 2020658. However, this fixup is required with high priority while the 0.12.0 release is being prepared, and the SRU will hopefully bridge a few weeks between SRU release to release of 0.12.0. [Testcase] Start a Windows Server VM, 2022 will be fine, and create an Active Directory with the domain "test-example.com". Launch a Focal, or Jammy, or Kinetic VM, and use SSSD to join the domain. Try to enable adsys: $ sudo apt install adsys $ adsysctl update ERRORgithub.com/ubuntu/adsys/cmd/adsysd/main.go:50 main.run() Error from server: error while updating policy: can't get policies for "test-example.com": failed to retrieve offline state from SSSD: dbus: invalid message: invalid path name There are test packages in the below ppa: https://launchpad.net/~mruffell/+archive/ubuntu/sf360012-test If you install the test package and retry to join the domain, it will succeed. [Where problems could occur] We are changing how domain names are being parsed and converted to valid dbus object path names. Domain names can only contain [0-9], [A-Z], [a-z], [.], and [-], so by adding '-' to being processed to its hexadecimal representation of '_2d', there should be limited scope of regressions. However, if a regression were to occur, then users may not be able to use adsys to apply group policy restrictions, and could run into issues accessing files, shares and networks. As mentioned in the impact section, this will be a temporary fix to 0.9.2 while 0.12.0 is being prepared to be released into the archive, which contains the full fix and testsuite coverage. This SRU should hopefully be short lived. [Other Info] The upstream merge request is: https://github.com/ubuntu/adsys/pull/498 This was fixed in 0.10.0 by the commit: commit 5752ba87347d7813dd56bc6a9ec6369ec56e5dc4 Author: Didier Roche <[email protected]> Date: Tue Nov 15 11:10:51 2022 +0100 Subject: Fix special characters in domain conversion to dbus object path Link: https://github.com/ubuntu/adsys/commit/5752ba87347d7813dd56bc6a9ec6369ec56e5dc4 Now, there were some additional commits that added testsuite coverage: commit cd79b3f81441a3d9ab50f11bc8c3b5c7bf722540 Author: Didier Roche <[email protected]> Date: Tue Nov 15 11:13:03 2022 +0100 Subject: Refresh golden file now that we properly handle the path. Link: https://github.com/ubuntu/adsys/commit/cd79b3f81441a3d9ab50f11bc8c3b5c7bf722540 commit 4571e39cd724a973270a586d2b18f653f0007de9 Author: Didier Roche <[email protected]> Date: Tue Nov 15 11:14:35 2022 +0100 Subject: Use a better case to assert on ServerURL() failure being ignored. Link: https://github.com/ubuntu/adsys/commit/4571e39cd724a973270a586d2b18f653f0007de9 commit fdca6e462c26e1cbecdb8386f43515c1947d423d Author: Didier Roche <[email protected]> Date: Tue Nov 15 11:16:21 2022 +0100 Subject: Add a separate case for special characters in domain name. Link: https://github.com/ubuntu/adsys/commit/fdca6e462c26e1cbecdb8386f43515c1947d423d These commits are not compatible with 0.9.2 due to testsuite harnesses and frameworks and test data files not being added until 0.10.0, and adding such commits is numerous, and contains too many changes for a SRU. Regrettably, the testsuite commits must be omitted. To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/adsys/+bug/2020834/+subscriptions -- Mailing list: https://launchpad.net/~desktop-packages Post to : [email protected] Unsubscribe : https://launchpad.net/~desktop-packages More help : https://help.launchpad.net/ListHelp
