Leopard 10.5 Server cross realm trust to AD issues

Howdy all,

Our main system is an Xserve running 10.5 Server. All users are in this system, and I have a number of linux boxen (via kerberos and ldap) and Windows boxen (via samba as domain members) authenticating to the Xserve, no problem. I even have group policies via Samba working like a champ.

What I am attempting to do is setup a new domain with a Windows 2003 AD controller and a few windows boxen hanging off it. This is mostly because I want a very different default policy on these machines, and I can’t figure out how to make a user group policy apply per machine (while still allowing administrators to have full access). Basically, the new machines are terminal servers that I want way locked down to run a single application, using some strict group policies, but I want admin users exempt, and I want all this applied to just a single machine or two, not all my Windows machines. I figured the easiest way of handling it would be to just create a new domain.

My problem is I want to authenticate users via Kerberos from OD, so everyone has just one username/password. I’ve setup a cross realm trust, and it appears to be working. However, any of my OD users who try to login to a service in the new AD domain get a cryptic ‘Insufficient resources exist to complete your logon’ from Windows. After very deep debugging, I have found the issue to be in the way that Workgroup Manager creates the Kerberos principals. If I use kadmin on the command line to create a principal for a user who does not exist in the LDAP database, login works! But if I create a user via Workgroup Manager, I can’t logon to the AD domain, even if I had previously created the kerberos principal.

The only thing I can think of is that Workgroup Manager uses the -x option to set the db_args if the user has an LDAP entry, and that AD is seeing this and having issues. I have no idea of how to disable this, if it would break things, or even actually view the tickets to see if they contain this info. Otherwise, my encryption types seem to be working just fine, and the kerberos principals look identical between working or not when viewed with a ‘kadmin -q getprinc username’.

To recap:

Kerberos principals that exist without a similarly named user in the OD LDAP database are able to login.

Any user who has an entry in the OD LDAP database fails to logon to the Windows AD with ‘Insufficient resources’.

Anyone run into this, or have some ideas for proceeding? Or can tell me how to selectively apply User group policies on a per-machine basis via Samba?

I suppose I could make AD the master auth source and bind OD to it, but I really want the OD to be the main auth source on this network.