https://bugzilla.novell.com/show_bug.cgi?id=794744 https://bugzilla.novell.com/show_bug.cgi?id=794744#c Lars Müller <lmuelle@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |ASSIGNED CC| |samba-maintainers@SuSE.de AssignedTo|samba-maintainers@SuSE.de |lmuelle@suse.com -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=794744 https://bugzilla.novell.com/show_bug.cgi?id=794744#c3 Rob Verduijn <rob.verduijn@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|RESOLVED |REOPENED Resolution|UPSTREAM | --- Comment #3 from Rob Verduijn <rob.verduijn@gmail.com> 2013-02-17 10:03:30 UTC --- Hello, Samba 4 can be compiled with MIT kerberos in stead of heimdal kerberos. After hitting the open build service to package it myself, i noticed there is a build option to use MIT kerberos in stead of heimdal kerberos, thus rendering the kerberos argument void. Therefore I reopened this ticket. the entire samba4 source4 tree is missing from the build (including samba-tool). It can be build with MIT kerberos (I've done it myself with samba 4.0.3) opensuse would be able to take advantage off all the cool samba4 features. Rob Verduijn -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=794744 https://bugzilla.novell.com/show_bug.cgi?id=794744#c5 Lars Müller <lmuelle@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|REOPENED |NEEDINFO InfoProvider| |rob.verduijn@gmail.com --- Comment #5 from Lars Müller <lmuelle@suse.com> 2013-02-17 14:56:29 CET --- Thanks for your contribution! Please file a submit request from your project against the network:samba:TESTING/samba project. Please close this defect report as soon as you filed your submit request. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=794744 https://bugzilla.novell.com/show_bug.cgi?id=794744#c Rob Verduijn <rob.verduijn@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEEDINFO |REOPENED InfoProvider|rob.verduijn@gmail.com | -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=794744 https://bugzilla.novell.com/show_bug.cgi?id=794744#c8 --- Comment #8 from Rob Verduijn <rob.verduijn@gmail.com> 2013-02-18 11:56:59 UTC --- I've been looking at your package for some time now. I've tried adding a pushd/popd for the source4 to your package, but this fails mainly due to the fact that there is no autogen.sh like there is for the source3 directory. I get the impression that it needs a major overhaul to enable compiling the source4 directory since it needs a different approach in my oppinion. ( no pushd and popd but build it from the root folder and adjust for exceptions for older builds from there. ) Which would lead to such a major change to the package that I doubt that would be accepted. Besides the acceptance this also requires a serious amount of time, more time than I got to spare. What is your view on this matter ? -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=794744 https://bugzilla.novell.com/show_bug.cgi?id=794744#c10 --- Comment #10 from Rob Verduijn <rob.verduijn@gmail.com> 2013-02-19 13:07:38 UTC --- Hello, Because I think we got a misunderstanding let me clarify my reasoning and my goals. A while ago I saw that the samba:STABLE contained samba4. I was rejoiced because now I can run samba4 on opensuse. (Wrong line of thought I know now, due to the mit/heimdal kerberos problem.) So I tried and found that the howtos from wiki.samba.org were all talking about samba-tool and that it was not available in the suse build. Thus I created this ticket. you told me about the heimdal/mit problem. I saw that somewhere between samba4.0.0 and 4.0.3 the --with-system-mitkrb5 options was created. I found out that this was only for the samba3 tools and samba4 client. I reported this to you and you replied , put out a submit request. I have branched your samba package and tried to put the --with-system-mitkrb5 option in there. Which I failed to do mainly due to the complexity of the samba package. So I'm not going to put out a submit request since I can't get it to compile for me on the obs using your package as a base. Since I sense a bit of lack of support for this feature I'm going to stick with my own build package and leave the samba package building to you. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=794744 https://bugzilla.novell.com/show_bug.cgi?id=794744#c12 Rob Verduijn <rob.verduijn@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEEDINFO |REOPENED InfoProvider|rob.verduijn@gmail.com | --- Comment #12 from Rob Verduijn <rob.verduijn@gmail.com> 2013-03-06 19:10:19 UTC --- Hello, I have no doubt there is a lot of demand for the 'samba4 ad controller' support. I've found a lot of the annoyances that samba3 has where dealt with in samba4. But as long as the heimdal/MIT kerberos problem isn't solved I think your idea for an AD DC enabled build is a good one. I would suggest adding another build that uses the --with-system-mitkrb5 switch, since that one restricts the build to the samba3 binaries and samba4 client only. (since it's not used in samba:TESTING) I think the community will apreciate the availability of the packages even if they are :"use at your own risk". It will allow everybody to try it and see what it's worth. Just make sure it is known that it will be a serious problem when its not a dedicated server. (big warning when enabling samba4 ad and again when starting up, links to website with warnings all over the screen and in the logs) Also if you want me to help in getting the package on the level of quality or any other opensuse community member a bit more info from the side of opensuse would be apreciated. Regarding all the magic that is required on how to build samba3/4 deserves some more attention, why are certain buildrequirements needed and why is this option on and that one off. Or why the mit/heimdal kerberos thing is an issue, and maybe an explanation on why MIT and not heimdal for system wide use in opensuse. (just to name a few that come to mind) I know a few of the answers from redhat/fedora for those that don't : http://fedoraproject.org/wiki/Features/Samba4 https://wiki.samba.org/index.php/Samba4/MIT_KDC Regards Rob -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=794744 https://bugzilla.novell.com/show_bug.cgi?id=794744#c14 --- Comment #14 from Bruno Friedmann <bruno@ioda-net.ch> 2013-05-27 13:45:49 UTC --- My bug noted as duplicate. and I'm fully aware of the thread (especially the heimdal/MIT war). So first the samba package should use now the waf samba method. Previous packager could help a lot the community by adding (at choice) comments in the spec file (What is important, why/who/when choice of doing things like they are is done) A clear description about the limits : say samba4 will be only a file server, don't count on AD with our package. And handle feedback of community about it. (Ad support as replacement is certainly the looong awaiting feature) I would like to thanks Rob for his try. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=794744 https://bugzilla.novell.com/show_bug.cgi?id=794744#c16 --- Comment #16 from Rob Verduijn <rob.verduijn@gmail.com> 2013-05-27 14:30:13 UTC --- Hi, Did the idea 'AD DC enabled build' in the obs die a quiet death or is this still an option ? Rob p.s. I see that the bug is reopened, I must have missed the 'this bug is closed' email. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=794744 https://bugzilla.novell.com/show_bug.cgi?id=794744#c18 Lars Müller <lmuelle@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |motionseverywhere@gmx.net --- Comment #18 from Lars Müller <lmuelle@suse.com> 2013-10-07 23:24:27 CEST --- *** Bug 844349 has been marked as a duplicate of this bug. *** http://bugzilla.novell.com/show_bug.cgi?id=844349 -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=794744 https://bugzilla.novell.com/show_bug.cgi?id=794744#c19 --- Comment #19 from Rob Verduijn <rob.verduijn@gmail.com> 2014-02-05 20:44:40 UTC --- Hello again, It's been over a year since I first opened this bug and I know the samba-tool isn't going to happen on suse before mit kerberos has been patched to support the required features for a samba dc or samba4 patched to be able to deal with mit kerberos. I guess they both need work for this to happen. I was rather curious, and google finds no page that is not at least as old as the first entry of this bug. How far along are we towards a samba4 dc running on mit kerberos ? Any links towards some page that is not older than this incident are apreciated. Rob Verduijn -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=794744 http://bugzilla.novell.com/show_bug.cgi?id=794744#c29 Rob Verduijn <rob.verduijn@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|RESOLVED |REOPENED Resolution|FEATURE |--- --- Comment #29 from Rob Verduijn <rob.verduijn@gmail.com> --- Hi all, It's been a while. In the other week I got an email from the samba notification list. 4.7.0 was released However the interesting bit was in the release notes: https://www.samba.org/samba/history/samba-4.7.0.html I noticed this bit : Samba AD with MIT Kerberos -------------------------- After four years of development, Samba finally supports compiling and running Samba AD with MIT Kerberos. You can enable it with: ./configure --with-system-mitkrb5 Samba requires version 1.15.1 of MIT Kerberos to build with AD DC support. The krb5-devel and krb5-server packages are required. The feature set is not on par with the Heimdal build but the most important things, like forest and external trusts, are working. Samba uses the KDC binary provided by MIT Kerberos. Missing features, compared to Heimdal, are: * PKINIT support * S4U2SELF/S4U2PROXY support * RODC support (not fully working with Heimdal either) The Samba AD process will take care of starting the MIT KDC and it will load a KDB (Kerberos Database) driver to access the Samba AD database. When provisioning an AD DC using 'samba-tool' it will take care of creating a correct kdc.conf file for the MIT KDC. For further details, see: https://wiki.samba.org/index.php/Running_a_Samba_AD_DC_with_MIT_Kerberos_KDC As James McDonough mentioned in comment 25. Until MIT kerberos is supported in the AD DC, we simply will not ship anything related to the AD DC code. It is now being shipped with MIT-kerberos supported AD DC. Looking forward to the release on suse :-P Rob Verduijn -- You are receiving this mail because: You are on the CC list for the bug.