AFP548 Changing the world one server at a time.

10.6 Clients Can’t use Login Window

Home › Forums › OS X Server and Client Discussion › Open Directory › 10.6 Clients Can’t use Login Window

Viewing 2 posts - 1 through 2 (of 2 total)
  • Author
    Posts
  • February 16, 2010 at 8:32 pm #377985
    ghutchis
    Participant

    I’m upgrading my desktop clients to use Mac OS X 10.6.2, and I’m having real trouble. Network users can’t login using the login window. This works fine with 10.5.x clients.

    I can also ssh as a network user to the affected computer and it works great. I just can’t use the GUI login window.

    Here’s what I’ve tried:

    • I set the Login Options using the Accounts PreferencePane. I enabled network login and my OD master was set as the “Network Account Server.”
    • Login window didn’t work.
    • Restart. Didn’t work.
    • Disabled and re-enabled “allow network users to log in at login window”. Didn’t work. Restarted. Didn’t work.
    • Checked server OD security settings. Restarted server. Doesn’t work.

    Again, I can login via SSH, but the GUI login window doesn’t work!

    Any suggestions?

    February 17, 2010 at 8:07 pm #378008
    ghutchis
    Participant

    I’ll answer my own question.

    The key clue in this puzzle was the EAPOL connection that I found in secure.log. This is responsible for 802.1X authentication, which is needed for our wireless network. Of course this is a desktop computer and had wireless disabled, so I never even considered that.

    However, when I investigated the AirPort “Advanced” settings, I saw that there was a “LoginWindow” profile for 802.1X. In short, the Mac was attempting to authenticate to the wireless network with the login user/password. Of course that failed. Removing this 802.1X setting solved the problem.

    I don’t know why this only happened after the 10.6 upgrade.

    Here’s Apple’s KB article:
    http://support.apple.com/kb/HT3326

    > At the login screen, one enters a name
    > and password. If LoginWindow can’t
    > find a local user account with that
    > name, it initiates an 802.1X session
    > using the same name and password and
    > in the case of an 802.11 network, it
    > associates to the wireless network.
    > After the 802.1X authentication
    > completes, LoginWindow authenticates
    > the user against the directory
    > service. If that authentication
    > succeeds, the user is logged in.

    So for Google purposes… here’s the secure.log:

        Dec 16 12:20:39 tritium SecurityAgent[171]: Network Authentication will be attempted
    Dec 16 12:20:39 tritium SecurityAgent[171]: Attempting EAPOL connection
    Dec 16 12:20:39 tritium SecurityAgent[171]: EAPOLConnectTimeout = 60.000000
    Dec 16 12:20:39 tritium SecurityAgent[171]: DSBindTimeout = 60.000000
    Dec 16 12:20:39 tritium SecurityAgent[171]: EAPOL NOT connected
  • Author
    Posts
Viewing 2 posts - 1 through 2 (of 2 total)
  • You must be logged in to reply to this topic.