NS8 Samba join-domain masks samba-tool failures in tee pipeline

In NethServer/ns8-samba 3.5.0, samba-dc/usr/local/sbin/join-domain executes samba-tool domain join inside a brace group piped to tee:

{ samba-tool domain join ... || exit_code=$?
} | tee "$tmpout"
...
exit "${exit_code:-0}"

Bash runs the left pipeline component in a subshell, so its assignment to exit_code is lost. The pipeline returns tee's status (usually zero), and non-credential join failures are reported as success. The NS8 module's configure-module/40start_provisioning then may start and advertise a partially provisioned DC. A failed join may leave a stale computer account in the remote AD.

Minimal reproduction:

bash -c 'unset exit_code; { false || exit_code=$?; } | cat; printf "reported=%s\n" "${exit_code:-0}"'
# reported=0

Capture the exit status with PIPESTATUS[0] immediately after the pipeline or another status-preserving pattern, and retain the LDAP insufficient-rights mapping to exit 34. samba-dc/usr/local/sbin/join-member uses a similar pipeline and should be checked as well.

The ns8-samba repository has Issues disabled (HTTP 410), so I am filing this in the NethServer development tracker.

Thanks for the report. The code error is real, but its impact is likely narrow. Please use the bug template next time: this report is missing the steps to reproduce. I'll consider fixing it, with low priority.

In Testing 3.5.1-dev.1

Test case

Join as a domain controller with valid administrator credentials: the join succeeds as before
Join as a domain controller with a user that lacks administrator rights: the form shows the insufficient permissions error
Make the join fail for another reason (for example, an unreachable DC): the action fails instead of completing
Repeat steps 1–3 for a member server join, with a file server alias set, and check that no alias is created after a failed join

VERIFIED

Annotation:

The alias DNS record and SPN are never created at first configuration. 40start_provisioning doesn't pass NBALIAS into the provisioning container, so the alias block in join-member never runs. After a successful member join with nbalias=fsalias, there was no fsalias CNAME and no HOST/FSALIAS SPN; only the NetBIOS alias was set. The UI's first-configuration form calls the same action, so UI joins are affected too. The gap has been there since 7ef009c, when the alias feature was added. It's worth its own issue; the likely fix is adding --env=NBALIAS to the provisioning podman run.

Navigation Menu

Repository navigation

NS8 Samba join-domain masks samba-tool failures in tee pipeline #8187

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

NS8 Samba join-domain masks samba-tool failures in tee pipeline #8187

Description

Activity

DavidePrincipi commented on Oct 6, 2026

DavidePrincipi commented on Oct 13, 2026

DavidePrincipi commented on Oct 13, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions