Re: [PATCH 0/2] ksmbd: NTLM pass-through to a domain controller

[Wang Zhaolong <wangzhaolong3@outlook.com>]

Hi Stefan, Namjae, Jan,

Thanks for bringing me into the discussion, and sorry for the delayed response.

> And Wang, what are the AD/DC features?

I'm working on adding Active Directory Domain Controller support to ksmbd,
rather than just allowing ksmbd to join an existing AD domain as a member
server.

The initial goal is a single writable AD domain controller, supporting one
forest, one domain and one site, with most of the new AD services implemented
in Rust userspace components.

The planned functionality includes:

- AD directory services, including LDAP, DNS and CLDAP discovery.
- Kerberos KDC and PAC support.
- NETLOGON and domain secure-channel functionality.
- Integration with ksmbd authentication, identity mapping and authorization.
- Windows domain join and logon, including SYSVOL/NETLOGON and Group Policy support.

The existing ksmbd kernel SMB data path would remain in place, while the
AD services and directory/account management would primarily live in userspace.

The implementation is still at an early stage, with some initial discovery,
directory and credential-management components in place. A fully functional
AD DC is still a long way off.

> why making this NTLM specific, I think it would be good to the whole session setup
> blob exchange to userspace, so that authentication is not used in kernel at all?
> And it will also help when IAKERB and other things will be implemented later.
> It would also be good to have the infrastructure working with winbindd being
> the bridge to the domain.

I think keeping authentication protocol handling and identity services in
userspace is worth considering, particularly as support for additional
authentication mechanisms is introduced.

However, I haven't evaluated the implications of moving the entire SMB Session
Setup authentication exchange to userspace yet, so I don't have a concrete
proposal for that interface at this point.

I also understand Namjae's preference for keeping the current NTLM pass-through
changes minimal.

Jan's patches primarily address authentication against an existing domain controller,
while my work aims to implement the domain controller services themselves. These are
different goals, but there may be opportunities to share or align some of the
userspace authentication and NETLOGON infrastructure.

I'd be happy to discuss the architecture and coordinate the development to avoid
overlapping work.

Best regards,
Wang Zhaolong