I meet a problem when trying to join Active Directory domain with Samba.
The error message is
cli_session_creds_prepare_krb5: Doing kinit for myaccount@domain.com to access domaincontroller.hostname
cli_session_setup_spnego_send: Connect to access domaincontroller.hostname as myaccount@domain.com using SPNEGO
GENSEC backend 'gssapi_spnego' registered
GENSEC backend 'gssapi_krb5' registered
GENSEC backend 'gssapi_krb5_sasl' registered
GENSEC backend 'spnego' registered
GENSEC backend 'schannel' registered
GENSEC backend 'naclrpc_as_system' registered
GENSEC backend 'sasl-EXTERNAL' registered
GENSEC backend 'ntlmssp' registered
GENSEC backend 'ntlmssp_resume_ccache' registered
GENSEC backend 'http_basic' registered
GENSEC backend 'http_ntlm' registered
GENSEC backend 'http_negotiate' registered
Starting GENSEC mechanism spnego
Starting GENSEC submechanism gse_krb5
Bad SMB2 signature for message
[0000] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........
[0000] C1 A6 B1 DE DE D5 5D 6D E5 27 86 90 39 7C 4E 1E ......]m .'..9|N.
SPNEGO login failed: {Access Denied} A process has requested access to an object but has not been granted those access rights.
My AD server is windows server 2012.
I am quite sure there is something wrong configured on AD server, because same Linux host join other AD domain successuflly.
My command is "net ads join -U myaccount -k"
Here, "an object but has not been granted access rights", how can I know what object and what access permission required?
I did follow actions:
using ldapsearch to make sure LDAP interface working fine, yes it is working fine
join other AD domain, success
If I do not use "-k", the error message will be:
error_string : 'Failed to set machine spn:
Operations error
Do you have sufficient permissions to create machine accounts?'
Looks like set service principle name failed, however, I can setspn -S on AD server successfully.
So, I am guessing there is something wrong on kerberos service configuration, any suggestion on how to troubleshoot this issue is welcome.
Thanks in advance.