Samba 4 AD SmartCard Login Your credentials could not be verified - active-directory

Question

i have build an AD with Samba 4.17.4 under Debian 11. So far everything works. I wanted to test smarcard login and encountered the following problem when logging in on a windows client:
‘Your credentials could not be verified’
Eventlog ID 4625
status 0xC000006D
substatus 0x0
FailReason %%2304
The PKI infrastructure consists of root ca and inter ca. My Kerberos Config on the DC:
/etc/krb5.conf
[libdefaults]
default_realm = SUB.TEST.DE
dns_lookup_realm = false
dns_lookup_kdc = true
pkinit_anchors = FILE:/var/lib/samba/private/tls/cacert.pem
pkinit_pool= FILE:/var/lib/samba/private/tls/interca.pem
[appdefaults]
pkinit_anchors = FILE:/var/lib/samba/private/tls/cacert.pem
pkinit_pool = FILE:/var/lib/samba/private/tls/interca.pem
[realms]
SUB.TEST.DE = {
default_domain = sub.test.de
pkinit_require_eku = true
}
[domain_realm]
dc0 = SUB.TEST.DE
[kdc]
enable-pkinit = yes
pkinit_identity = FILE:/var/lib/samba/private/tls/dc-cert.pem,/var/lib/samba/private/tls/secure/dc-privkey.pem
pkinit_anchors = FILE:/var/lib/samba/private/tls/cacert.pem
pkinit_pool = FILE:/var/lib/samba/private/tls/interca.pem
pkinit_revoke = FILE:/var/lib/samba/private/tls/sub.crl,/var/lib/samba/private/tls/rootca.crl
pkinit_principal_in_certificate = yes
pkinit_win2k = no
pkinit_win2k_require_binding = yes
my smb.conf:
GNU nano 5.4 /etc/samba/smb.conf
# Global parameters
[global]
dns forwarder = 10.0.0.10
netbios name = DC
realm = SUB.TEST.DE
server role = active directory domain controller
dns forwarder = 10.0.0.1
workgroup = SUB
idmap_ldb:use rfc2307 = yes
log level = 1 auth_audit:3 auth_json_audit:3
tls enabled = yes
tls certfile = /var/lib/samba/private/tls/dc-cert.pem
tls keyfile = /var/lib/samba/private/tls/secure/dc-privkey.pem
tls cafile = /var/lib/samba/private/tls/cacert.pem
tls crlfile = /var/lib/samba/private/tls/sub.crl
tls dhparams file = /var/lib/samba/private/tls/dc-dhparams.pem
[sysvol]
path = /var/lib/samba/sysvol
read only = No
[netlogon]
path = /var/lib/samba/sysvol/sub.test.de/scripts
read only = No
GPO with Root CA (Trusted Root Certificates) and Inter CA (Intermediate Certificates) under computer configuration > windows setting > secruity settings > public key policies is set. Works perfectly.
Root and Inter CA Certificates are imported with certutil, works without problems. Time between DC an Client are synchronized.
The certificates were created like this
openssl req -new -addext 'subjectAltName = otherName:msUPN;UTF8:m.mustermann#sub.contoso.de,email:copy' -newkey rsa:2048 -keyout private/mmustermann-key.pem -out mmustermann-req.pem -config openssl.cnf
openssl ca -config openssl.cnf -extensions usr_cert_scarduser -in mmustermann-req.pem -out mmustermann-cert.pem
cat mmustermann-cert.pem chain.pem > mmustermann-chain.pem
openssl pkcs12 -in mmustermann-chain.pem -inkey private/mmustermann-key.pem -export -out mmustermann.p12
The p12 is imported to a yubikey and bundled with PIN.
Auth Log says following:
[2023/02/09 13:46:29.247497, 2] ../../auth/auth_log.c:647(log_authentication_event_human_readable)
Auth: [Kerberos KDC,PK-INIT(ietf) Pre-authentication] user [(null)]\[m.mustermann\\#sub.test.de#SUB.TEST.DE] at [Thu, 09 Feb 2023 13:46:29.24748
7 CET] with [(null)] status [NT_STATUS_PKINIT_FAILURE] workstation [(null)] remote host [ipv4:10.0.0.100:61127] mapped to [SUB]\[m.mustermann]. local host [NULL]
{"timestamp": "2023-02-09T13:46:29.247547+0100", "type": "Authentication", "Authentication": {"version": {"major": 1, "minor": 2}, "eventId": 4625, "logonId": "51cf6b969
999c23e", "logonType": 3, "status": "NT_STATUS_PKINIT_FAILURE", "localAddress": null, "remoteAddress": "ipv4:10.0.0.100:61127", "serviceDescription": "Kerberos KDC", "authDe
scription": "PK-INIT(ietf) Pre-authentication", "clientDomain": null, "clientAccount": "m.mustermann\\#sub.test.de#SUB.TEST.DE", "workstation": nu
ll, "becameAccount": "m.mustermann", "becameDomain": "SUB", "becameSid": "S-1-5-21-3437283345-98153231-3800821964-1119", "mappedAccount": "m.mustermann", "mappedDomain": "SUB", "netlogonComputer": null, "netlogonTrustAccount": null, "netlogonNegotiateFlags": "0x00000000", "netlogonSecureChannelType": 0, "netlogonTrustAccountSid": null, "passw
ordType": null, "duration": 4175}}
Anyone have any ideas what else I could check? I need a Direction.
regards
I tried different forms of user certificates. With chain, without, CRLs included. At the Certificate creation i tried different UPN types, like: "SUB\m.mustermann", "m.mustermann#sub.test.de" or "m.mustermann".
I rebuilt the whole structure oriented on this:
https://wiki.samba.org/index.php/Samba_AD_Smart_Card_Login#Set_up_the_CRL_Distribution_Point
The only difference is that there was only a root CA in use. On other system tried this, and it works. But with InterCA i have the explained problem. Thias must be a trick somewhere. I cant see it.