- This topic has 4 replies, 2 voices, and was last updated 18 years, 1 month ago by
.
-
Posts
-
No 10.5.4 clients can mount smb shared folders on 10.4.11 XServe, but 10.4.11 clients have no problems. Here are the details.
1. XServe 10.4.11 is bound to 2003 AD.
2. All clients, including 10.5.4 clients, are bound to AD.
3. All servers and clients are in the same AD domain.
2. OD is not used for anything.
3. XServe provides smb shared folders, and ACLs allow AD users to access the folders.
4. The smb shares can be mounted by 10.4.11 clients and Windows XP clients.
5. The same shares cannot be mounted by any 10.5.4 clients.A user can log into a 10.5.4 client with AD credentials. At the point in the login process where the “Home folder” is mounted with the path from the profile in AD, a dialog box appears with the message
A volume failed to mount.
The volume “XYZ” could not be mounted.If the share is mounted manually with Go->Connect to server…, the same dialog is displayed, and then a second dialog box is displayed with the message
Sorry, the operation could not be completed because an unexpected error occurred.
(Error code -6602)At the same time, /var/log/system.log shows the error
lwMountWithArrayOfPaths: failed to mount prefPath=smb://xserve.example.com/XYZ, error=13
I have changed the owner and group (and permissions) of the shares to no avail. Allowing Everyone full access does not help. As a test, I created a local account in Netinfo on XServe and smb shared a folder that is accessible by the local account. I logged into a 10.5.4 client with AD credentials, and manually mounted the new share, authenticating with the local (Netinfo) account. That was successful. So, at some level, smb sharing is working. The 10.5.4 clients can access shares on Windows servers without any problems.
Any suggestions or ideas of things I can check would be much appreciated. Thank you! 😀
mose
In my experiences, Kerberos is not passed correctly from 10.5.x clients to the 10.4.x Xserve. This was supremely frustrating, especially around the 1st quarter of this year when you couldn’t buy a new mac that had Tiger still installed on it (ie they all came with Leopard).
Here is how I came up with a workaround.
Log into the account as usual.
Open up the Kerberos app (System/Libary/Core Services)
You should see your Kerberos ticket listed there. Destroy the ticket.
Use the Finder to Connect to Server. Find your SMB share, and it should prompt you for a username and password.
Enter your the correct AD username and password, and check the Save Password in Keychain box.
Log out and back in.
Now, when you connect to the SMB shares, you’ll be authenticated via your saved password in the keychain, thus getting around the kerberos issue with 10.5.x clients and the 10.4.x Xserve.Unfortunately, if you run strictly SMB on your network with your Xserve, upgrading to Leopard Server is not IMO a good solution. We have struggled with SMB on Leopard Server for a couple of months now, and will be switching to a Windows based file serving solution as soon as we can get the hardware in.
That seems so close, but after I destroy the ticket and attempt to mount the folder, I get a dialog box saying
Connection failed
You do not have permission to access this server.Try enabling Guest access for SMB (on the Xserve) and see if you get the username/password prompt. I know that’s not an ideal long term solution, but it could help the troubleshooting process.
After quite a bit of poking around, I discovered the cause of the problem. In the user’s profile in AD, the Account tab has a Log On To button where you can add the names of computers where the user is allowed to login. Accounts that didn’t work with 10.5.4 clients happened to have an entry that allowed them to login to the XServe. After I removed all entries and selected the option for the user to be able to login to all computers, the volume automatically mounted when the user logged into a 10.5.4 client and mounted a volume on a 10.4.11 XServe.
- You must be logged in to reply to this topic.