English Urdu (Pakistan)
A example script to migrate an old-style configuration to the new style is available in `/usr/share/doc/ctdb/examples/config_migrate.sh`.
Kerberos integration
Local authorization plugin for MIT Kerberos has been added. The plugin controls the relationship between Kerberos principals and AD accounts through winbind. The module receives the Kerberos principal and the local account name as inputs and can then check if they match. This can resolve issues with canonicalized names returned by Kerberos within AD. If the user tries to log in as 'alice', but the samAccountName is set to ALICE (uppercase), Kerberos would return ALICE as the username. Kerberos would not be able to map 'alice' to 'ALICE' in this case and auth would fail. With this plugin, account names can be correctly mapped. This only applies to GSSAPI authentication, not for getting the initial ticket granting ticket.
With this plugin, winbind-based configurations are on par with SSSD in AD environment.
Samba AD DC
Active Directory Domain Controller in Samba 4.9 saw a number of improvements. Most notably, a new experimental LDB backend using LMDB is now available. This allows databases larger than 4Gb (Currently the limit is set to 6Gb, but this will be increased in a future release). To enable lmdb, provision or join a domain using the "`--backend-store=mdb`" option.
Please note this is an experimental feature and is not recommended for production deployments.
Samba AD DC in Fedora is built with MIT Kerberos. As of Samba 4.9, MIT Kerberos support in Samba AD DC is still experimental and may exhibit bugs. There are known and not yet fixed issues in the Samba bug-tracker upstream:
https://bugzilla.samba.org/show_bug.cgi?id=13516
https://bugzilla.samba.org/show_bug.cgi?id=13517
The support for trusted domains/forests has been further improved. External domain trusts, as well a transitive forest trusts, are supported in both directions (inbound and outbound) for Kerberos and NTLM authentication.
The following features are new in 4.9 (compared to 4.8):
It's now possible to add users/groups of a trusted domain into domain groups. The group memberships are expanded on trust boundaries.
foreignSecurityPrincipal objects (FPO) are now automatically created when members (as SID) of a trusted domain/forest are added to a group.
The '`samba-tool group *members`' commands allow members to be specified as foreign SIDs.
However there are currently still a few limitations:
Both sides of the trust need to fully trust each other!
No SID filtering rules are applied at all!
This means DCs of domain A can grant domain admin rights in domain B.
Selective (CROSS_ORGANIZATION) authentication is not supported. It's possible to create such a trust, but the KDC and winbindd ignore them.