- This topic has 1 reply, 1 voice, and was last updated 18 years, 8 months ago by
.
-
Posts
-
Currently, I have setup a kerberos and LDAP server for user authentication/authorization. When I switch our users to mobile accounts using the createMobileAccount utility, user password changes on our kerberos server are no longer recognized by Leopard. Seems Leopard always wants the old user password to log on.
As an experiment, I deleted the users mobile account using the dscl utility ,but not the home directory. Once this was done, Leopard allowed me to log on using the new password. I changed the password several times and was able to log on fine each time using the new password. However, when I changed back to a mobile account, Leopard stopped recognizing password changes.
I’m at a loss at what to do about this. I can’t go around deleting / recreating user accounts each time the user changes their password.
Any ideas?
ThanksMacTroll wrote:
So you’re changing the passwords on something other than the system with the mobile accounts?
Did not seem to matter where I changed the password. I tried both from the change password menu in Leopard as well as directly on the KDC using kadmin.
However, I figured out the problem. I was just picking a random 6 digit number for the “generatedUid” LDAP field. After reading the Apple Developer documentation, I found out the generatedUid field has to be a character string similar to:
45677CF3-5438-17F9-E8A3-03006572DDC1
in format. I’m not sure how Apple comes up with this number.
As soon as I entered a correctly formatted generatedUid ( even though it is still a bunch of random characters I just came up with ) and recreated the mobile user account, cached passwords started working and I was able to change passwords and still be able to log on.
Kind of weird but it seems to have fixed the issue
- You must be logged in to reply to this topic.