Re: Attribut msDS-KeyCredentialLink is missing

On Tue, 16 Jun 2026 14:08:42 +0000
Bruno MOREL via samba <[email protected]> wrote:

> Hello,
> 
> So now I have all of attribute (I don't know why they are not
> implemented) and continue trying WHfB integration. I have forgotten
> to say that we are in hybrid with on-premises ad and entra connect to
> sync user and password to Microsoft. I have activated writeback and
> update the schema. So now, my msDS-KeyCredentialLink attribute is
> write by Entra. I think the schema is the next: WHfB created
> =>Attribut put in Azure AD=>writeback=>AD samba. With this I have an
> error: # samba-tool user keytrust view user
> ndr_pull_value: ndr_pull_error(Bad Array Size): Invalid size of (16)
> for KeyID should be (32), at byte 4 at
> librpc/ndr/ndr_keycredlink.c:279 None ERROR: Could not parse value as
> KEYCREDENTIALLINK_BLOB  (internal error: (1, 'Bad Array Size'))
> 
> # ldbsearch -H /var/lib/samba/private/sam.ldb   -b
> "DC=domain,DC=local"   "(sAMAccountName=user)"
> msDS-KeyCredentialLink msDS-KeyCredentialLink:
> B:854:..........................
> 
> Any ideas what's wrong?

I do not know why it isn't working, perhaps it relies on code that
Windows has, but Samba lacks. I also cannot understand why you were
missing the list of attributes you posted, they are all in
/usr/share/samba/setup/ad-schema/AD_DS_Attributes__Windows_Server_2016.ldf
and more importantly in
/usr/share/samba/setup/adprep/WindowsServerDocs/Schema-Updates.md

Schema-Updates.md is one of the files that 'samba-tool domain
schemaupgrade' uses to upgrade the schema, so if the schema was
upgraded correctly, you should have had all those attributes, but
thinking about it, if you do not have the attributes, you may also not
have the relevant objectclass.

My main thought is, if your 'objectVersion' is '88', why do you not
have all the attributes and objectclasses ?
If you provision a new domain you automatically get upgraded to '88',
but earlier domains must be manually upgraded.

Rowland


-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba