Problem getting Intel Xserve 10.4.10

I am having trouble binding a second Xserve into
an OD system–the first one binds fine “Connected to Directory
Server”, but the 2nd one does not. The only difference
that I can see is that the one that works is PowerPC
(binding to a PowerPC OD Master), and the one that isn’t
working is Intel.

Here are the servers:

od.pretendco.com ODM Xserve PowerPC G5
mail.pretendco.com CtDS Xserve PowerPC G5
afp.pretendco.com CtDS Xserve Intel

CtDS: Connected to Directory Server
ODM: Old Dirty Master (um, Open Directory Master)

Right now, services on the machines are minimal:
mail server is running mail, afp server is running afp and
internal DNS. All machines are on a NAT network with
non-routable 10.X IP addresses, with the 2nd ethernet of
the OD Master also on the WAN (but running a firewall).

On mail.pretendco.com (PPC):

mail:~ adminuser$ sudo /usr/sbin/sso_util useconfig -u -R mail.pretendco.com  -f /LDAPv3/od.pretendco.com -a diradmin -p *** -v 1
Contacting the directory server
Obtaining the Computer record
Get the key for the current user
Decrypting secure config record
Creating the keytab file
Configuring services
WriteSetupFile: setup file path = /temp.iwCp/setup
Mail config file at /etc/MailServicesOther.plist updated successfully
Mail config file at /etc/MailServicesOther.plist updated successfully
Mail config file at /etc/MailServicesOther.plist updated successfully
AFP config file at /Library/Preferences/com.apple.AppleFileServer.plist updated successfully
Hupping the AFP Server
Cleaning up 
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
        <key>errorValue</key>
        <integer>0</integer>
</dict>
</plist>

Lookin’ good (and works great).

On afp.pretendco.com (Intel), using the exact same OD credentials:

afp:~ adminuser$ sudo /usr/sbin/sso_util useconfig -u -R afp.pretendco.com  -f /LDAPv3/od.pretendco.com -a diradmin -p *** -v 1
Contacting the directory server
Obtaining the Computer record
Get the key for the current user
GetKeyFromRecipient: Could not authenticate to the Password Server theError = -14079
The user is not authorized to use this config record, error = 80
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
        <key>errorValue</key>
        <integer>80</integer>
</dict>
</plist>

I tried re-generating the computer record info
on the OD Master for both machines, and no visible effect
that I could see (same results as above) using:

od:/ root# /usr/sbin/sso_util generateconfig -r KERBREALM.PRETENDCO.COM -R mail.pretendco.com -f /LDAPv3/od.pretendco.com -U diradmin -a diradmin -p *** all
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
        <key>errorValue</key>
        <integer>2</integer>
</dict>
</plist>


od:/ root# /usr/sbin/sso_util generateconfig -r KERBREALM.PRETENDCO.COM -R afp.pretendco.com -f /LDAPv3/od.pretendco.com -U diradmin -a diradmin -p *** all
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
        <key>errorValue</key>
        <integer>2</integer>
</dict>
</plist>

I’m not sure if an error code of 2 is good (I
have no idea where these lists of errors are…)

I can, from both CtDS machines, kinit and run
kadmin across the network (when I open up port 749).
But the keytab file on afp.pretendco.com does not
get generated…

Any ideas? I have never had this much trouble
getting an OD master to accept a “Connected to Directory
Server” system…

Scott
https://www.afp548.com/forum/viewtopic.php?showtopic=17895