Hi Yeti,

I had the same problem and it took me ages to work it out.

Turns out, it has to do with the default Kerberos settings on OSX:

Edit the file: “Macintosh HD/Library/Preferences/edu.mit.kerberos”

Under the section “libdefaults” add:
forwardable = yes
proxiable = yes

I believe it is the ‘proxiable’ portion that is the key here.

I’m not sure, but I think you also have to do the following:
i. Open a terminal on the reference workstation
ii. Type in ‘sudo pico /etc/authorization’
iii. Authenticate with the root password
iv. Press ‘Control’ & ‘W’ to start a search
v. Type in “authenticate,privileged” in the search prompt
vi. Change the text to “krb5authnoverify,privileged”. Ie. It should look like “builtin:krb5authnoverify,privileged”
vii. Press ‘Control’ & ‘X’ to exit
viii. Restart the system for the changes to apply

This tells OSX to invoke a Kerberos request when the user logs in.

Once I finally got Kerberos to work, I found a lot of accounts were being locked because of the way OSX uses the Kerberos tickets. Specifically, I was getting KRB_PRE_AUTH errors logged on the AD servers. If this is the case, let me know and I’ll post the solution to that problem as well 😀

Cheers,
The_Rug