WGM Error eDSAuthFailed (-14090) | eDSCannotAccess Session (-14006)

Problem 1:
We are experiencing a eDSAuthFailed (-14090) error when authenticating to WGM using Domain Admin credentials AND when attempting to create new user accounts. It occurs every time new accounts are created in OD, after hitting Save. I should mention that user accounts do get created, but results in a malformed Kerberos principal, along the lines of “untitled_1@somehost.somedomain.com@SOMEHOST.SOMEDOMAIN.COM”. Not sure if it is related, assume that it is, but network home folders also fail to apply proper ACLs at time of creation (instead a UNIX user by the same shortname gets created, and no ACLS).

What’s odd is that the user can still login with the malformed principal, but on the KDC it reports authentication failed, as you would expect.

Problem 2:
As a workaround to problem 1, I am authenticating as the built-in directory admin. I no longer receive the eDSAuthFailed (-14090) error, and Kerberos principals are created correctly, but custom parameters like home folder paths and group memberships don’t always take hold on the first save and have to be re-applied. WGM also throws an error, but this time it is eDSCannotAccess Session (-14006) error.

There is no official Apple provided solution online even though there is evidence to suggest the problem is widespread. It appears to be a Password Server-related issue, and the only real solution is to nuke the authserver main and overflow files. Yikes!

Server Version: 10.5.8 OS X Server