With a system “connected to a directory system”, meaning its not a replica or a master, but you want people to be able to log into it via their OD name and kerberos password (single sign on), you need to bind it to your OD system using Directory Access. Then, if you haven’t already, add the new system to a computer list in WGM on your OD system and make sure you use the fully qualified domain name of the server. (ie server.example.com, as opposed to just ‘server’). And then finally in Server Admin click the “join kerberos” button. The first step establishes communication with the LDAP server, and the third step creates entries in the OD master called “service principals” for your new server. This third part is what tells your OD master to hand out kerberos authentication tickets for services on your new server, even though its not an OD server itself. Its considered part of the “realm”. If you really want to check it out on a more detailed level you can log into the OD master and use the kadmin.local command to run the “listprincs” command. This will allow you to list from the KDC all of the known hosts and services they offer via kerberos. Kerberos service principals are in the format of “service/[email protected]”. By default, when you click the “join kerberos” button in server admin, OSX server creates on the ODM’s KDC 3 of these entries for each service on the it provides for the host you are “joining kerberos” from…