<html dir="ltr"><head></head><body style="text-align:left; direction:ltr;"><div>On Thu, 2023-08-10 at 10:03 +0300, Michael Tokarev wrote:</div><blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex"><pre>Control: tag -1 - moreinfo + wontfix</pre><pre>Control: severity -1 minor</pre><pre><br></pre><pre>15.04.2023 00:03, Daniel Lakeland wrote:</pre><pre>...</pre><blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex"><pre>Hi Michael, my concern is mainly to document the existence of this problem for others who might use this similar config. I'm 100% sure I'm not the </pre><pre>only one in the world. There are debian bugs going back a while where others have this kind of set up and had issues. I'll continue to try to figure </pre><pre>out the work around, and then document the method I came up with here, and then we can close the bug so it's preserved for others with similar issues?</pre></blockquote><pre><br></pre><pre>It looks like you're one of maybe just a few people in the world</pre><pre>who uses this config with samba and stand-alone ldap and kdc, after</pre><pre>samba made everything to be internal because separate components</pre><pre>were basically unmanageable.</pre><pre><br></pre><pre>In order for this bug report to not disturb my workflow (not to pay</pre><pre>more attention to it every time I look at samba bugs), - since it</pre><pre>is for documentation purpose only, I'm lowering severity of it and</pre><pre>adding a "wontfix" tag.</pre><pre><br></pre><pre>Thanks,</pre><pre><br></pre><pre>/mjt</pre></blockquote><pre>Per <a href="https://lists.samba.org/archive/samba/2023-April/244999.html">https://lists.samba.org/archive/samba/2023-April/244999.html</a> it *might* work if the MIT KDC were adjusted not to issue a PAC</pre><pre><a href="https://web.mit.edu/kerberos/krb5-1.20/">https://web.mit.edu/kerberos/krb5-1.20/</a> suggests disable_pac in the realm configuration on the KDC.</pre><pre><br></pre><pre>Andrew Bartlett</pre><div><span><pre>-- <br></pre><div style="width: 71ch;">Andrew Bartlett (he/him) <a href="https://samba.org/~abartlet/">https://samba.org/~abartlet/</a></div><div style="width: 71ch;" data-evo-signature-plain-text-mode="">Samba Team Member (since 2001) <a href="https://samba.org">https://samba.org</a></div><div style="width: 71ch;" data-evo-signature-plain-text-mode="">Samba Team Lead <a href="https://catalyst.net.nz/services/samba">https://catalyst.net.nz/services/samba</a></div><div style="width: 71ch;" data-evo-signature-plain-text-mode="">Catalyst.Net Ltd</div><div style="width: 71ch;" data-evo-signature-plain-text-mode=""><br></div><div style="width: 71ch;" data-evo-signature-plain-text-mode="">Proudly developing Samba for Catalyst.Net Ltd - a Catalyst IT group company</div><div style="width: 71ch;" data-evo-signature-plain-text-mode=""><br></div><div style="width: 71ch;" data-evo-signature-plain-text-mode="">Samba Development and Support: <a href="https://catalyst.net.nz/services/samba">https://catalyst.net.nz/services/samba</a></div><div style="width: 71ch;" data-evo-signature-plain-text-mode=""><br></div><div style="width: 71ch;" data-evo-signature-plain-text-mode="">Catalyst IT - Expert Open Source Solutions</div><div style="width: 71ch;"></div></span></div></body></html>