AFP “Connection Failure” with Kerberos

[chrigu]

I made all the Configurations on my OS X Server 10.5.5, by setup Open Directory and AFP Shares with the Server Admin Tool. My Client with OS X 10.5.5 get succesfully a “krbtgt/server.pixelmania.private@SERVER.PIXELMANIA.PRIVATE” Ticket in the Kerberos Application, which means in my opinion that Kerberos will working fine, I also couldn’t find any crashes or problems in the DirectoryService.server.log or AppleFileServiceError.log files.

But when I set AFP authentication type from “Any Method” to “Kerberos” I couldn’t access my AFP Shares anymore. I receive only an error “connection failure” in the Finder.

I only get a successfully kerberos authentification on AFP when I mount the AFP shares by terminalwindow:

mkdir /Volumes/manualmount;
mount_afp "afp://;AUTH=Client%20Krb%20v2@server.pixelmania.private/Backups" /Volumes/manualmount;

And then the Kerberos Applications shows a “afpserver/server.pixelmania.private@SERVER.PIXELMANIA.PRIVATE” ticket and I can access any shares.

I’m not sure, if the problem occurs by Kerberos. After some research I found this topic in the Apple support pages #107702, they suggested that there may be duplicate keys in the keytab file, so here is the output from sudo klist -kte:

Keytab name: FILE:/etc/krb5.keytab
KVNO Timestamp         Principal
---- ----------------- --------------------------------------------------------
   3 09/14/08 20:59:36 host/server.pixelmania.private@SERVER.PIXELMANIA.PRIVATE (Triple DES cbc mode with HMAC/sha1) 
   3 09/14/08 20:59:36 host/server.pixelmania.private@SERVER.PIXELMANIA.PRIVATE (ArcFour with HMAC/md5) 
   3 09/14/08 20:59:36 host/server.pixelmania.private@SERVER.PIXELMANIA.PRIVATE (DES cbc mode with CRC-32) 
   3 09/14/08 20:59:36 smtp/server.pixelmania.private@SERVER.PIXELMANIA.PRIVATE (Triple DES cbc mode with HMAC/sha1) 
   3 09/14/08 20:59:36 smtp/server.pixelmania.private@SERVER.PIXELMANIA.PRIVATE (ArcFour with HMAC/md5) 
   3 09/14/08 20:59:36 smtp/server.pixelmania.private@SERVER.PIXELMANIA.PRIVATE (DES cbc mode with CRC-32) 
   3 07/12/08 07:33:33 vnc/LKDC:SHA1.9CCA90E928CB27613A3E3601A6B4947D910F5D0E@LKDC:SHA1.9CCA90E928CB27613A3E3601A6B4947D910F5D0E (Triple DES cbc mode with HMAC/sha1) 
   3 07/12/08 07:33:33 vnc/LKDC:SHA1.9CCA90E928CB27613A3E3601A6B4947D910F5D0E@LKDC:SHA1.9CCA90E928CB27613A3E3601A6B4947D910F5D0E (ArcFour with HMAC/md5) 
   3 07/12/08 07:33:33 vnc/LKDC:SHA1.9CCA90E928CB27613A3E3601A6B4947D910F5D0E@LKDC:SHA1.9CCA90E928CB27613A3E3601A6B4947D910F5D0E (DES cbc mode with CRC-32) 
   3 09/14/08 20:59:36 xgrid/server.pixelmania.private@SERVER.PIXELMANIA.PRIVATE (ArcFour with HMAC/md5) 
   3 09/14/08 20:59:36 xgrid/server.pixelmania.private@SERVER.PIXELMANIA.PRIVATE (DES cbc mode with CRC-32) 
   3 09/14/08 20:59:36 vpn/server.pixelmania.private@SERVER.PIXELMANIA.PRIVATE (DES cbc mode with CRC-32) 
   3 09/14/08 20:59:36 vpn/server.pixelmania.private@SERVER.PIXELMANIA.PRIVATE (Triple DES cbc mode with HMAC/sha1) 
   3 09/14/08 20:59:36 vpn/server.pixelmania.private@SERVER.PIXELMANIA.PRIVATE (ArcFour with HMAC/md5) 
   3 09/14/08 20:59:36 cifs/server.pixelmania.private@SERVER.PIXELMANIA.PRIVATE (DES cbc mode with CRC-32) 
   3 09/14/08 20:59:36 xgrid/server.pixelmania.private@SERVER.PIXELMANIA.PRIVATE (Triple DES cbc mode with HMAC/sha1) 
   3 09/14/08 20:59:36 cifs/server.pixelmania.private@SERVER.PIXELMANIA.PRIVATE (ArcFour with HMAC/md5) 
   3 09/14/08 20:59:36 http/server.pixelmania.private@SERVER.PIXELMANIA.PRIVATE (DES cbc mode with CRC-32) 
   3 09/14/08 20:59:36 http/server.pixelmania.private@SERVER.PIXELMANIA.PRIVATE (ArcFour with HMAC/md5) 
   3 09/14/08 20:59:36 ldap/server.pixelmania.private@SERVER.PIXELMANIA.PRIVATE (DES cbc mode with CRC-32) 
   3 09/14/08 20:59:36 ipp/server.pixelmania.private@SERVER.PIXELMANIA.PRIVATE (DES cbc mode with CRC-32) 
   3 09/14/08 20:59:36 ldap/server.pixelmania.private@SERVER.PIXELMANIA.PRIVATE (ArcFour with HMAC/md5) 
   3 09/14/08 20:59:36 afpserver/server.pixelmania.private@SERVER.PIXELMANIA.PRIVATE (DES cbc mode with CRC-32) 
   3 09/14/08 20:59:36 ftp/server.pixelmania.private@SERVER.PIXELMANIA.PRIVATE (DES cbc mode with CRC-32) 
   3 09/14/08 20:59:36 cifs/server.pixelmania.private@SERVER.PIXELMANIA.PRIVATE (Triple DES cbc mode with HMAC/sha1) 
   3 09/14/08 20:59:36 XMPP/server.pixelmania.private@SERVER.PIXELMANIA.PRIVATE (ArcFour with HMAC/md5) 
   3 09/14/08 20:59:36 XMPP/server.pixelmania.private@SERVER.PIXELMANIA.PRIVATE (DES cbc mode with CRC-32) 
   3 09/14/08 20:59:36 http/server.pixelmania.private@SERVER.PIXELMANIA.PRIVATE (Triple DES cbc mode with HMAC/sha1) 
   3 09/14/08 20:59:36 xmpp/server.pixelmania.private@SERVER.PIXELMANIA.PRIVATE (ArcFour with HMAC/md5) 
   3 09/14/08 20:59:36 xmpp/server.pixelmania.private@SERVER.PIXELMANIA.PRIVATE (DES cbc mode with CRC-32) 
   3 09/14/08 20:59:36 ldap/server.pixelmania.private@SERVER.PIXELMANIA.PRIVATE (Triple DES cbc mode with HMAC/sha1) 
   3 09/14/08 20:59:36 HTTP/server.pixelmania.private@SERVER.PIXELMANIA.PRIVATE (ArcFour with HMAC/md5) 
   3 09/14/08 20:59:36 HTTP/server.pixelmania.private@SERVER.PIXELMANIA.PRIVATE (DES cbc mode with CRC-32) 
   3 09/14/08 20:59:36 afpserver/server.pixelmania.private@SERVER.PIXELMANIA.PRIVATE (ArcFour with HMAC/md5) 
   3 09/14/08 20:59:36 ipp/server.pixelmania.private@SERVER.PIXELMANIA.PRIVATE (ArcFour with HMAC/md5) 
   3 09/14/08 20:59:36 imap/server.pixelmania.private@SERVER.PIXELMANIA.PRIVATE (DES cbc mode with CRC-32) 
   3 07/12/08 07:45:11 nfs/server.pixelmania.private@SERVER.PIXELMANIA.PRIVATE (Triple DES cbc mode with HMAC/sha1) 
   3 07/12/08 07:45:11 nfs/server.pixelmania.private@SERVER.PIXELMANIA.PRIVATE (ArcFour with HMAC/md5) 
   3 07/12/08 07:45:11 nfs/server.pixelmania.private@SERVER.PIXELMANIA.PRIVATE (DES cbc mode with CRC-32) 
   3 09/14/08 20:59:36 XMPP/server.pixelmania.private@SERVER.PIXELMANIA.PRIVATE (Triple DES cbc mode with HMAC/sha1) 
   3 09/14/08 20:59:36 ftp/server.pixelmania.private@SERVER.PIXELMANIA.PRIVATE (ArcFour with HMAC/md5) 
   3 09/14/08 20:59:36 pop/server.pixelmania.private@SERVER.PIXELMANIA.PRIVATE (DES cbc mode with CRC-32) 
   3 09/14/08 20:59:36 xmpp/server.pixelmania.private@SERVER.PIXELMANIA.PRIVATE (Triple DES cbc mode with HMAC/sha1) 
   3 09/14/08 20:59:36 imap/server.pixelmania.private@SERVER.PIXELMANIA.PRIVATE (ArcFour with HMAC/md5) 
   3 09/14/08 20:59:36 ipp/server.pixelmania.private@SERVER.PIXELMANIA.PRIVATE (Triple DES cbc mode with HMAC/sha1) 
   3 09/14/08 20:59:36 pop/server.pixelmania.private@SERVER.PIXELMANIA.PRIVATE (ArcFour with HMAC/md5) 
   3 09/14/08 20:59:36 HTTP/server.pixelmania.private@SERVER.PIXELMANIA.PRIVATE (Triple DES cbc mode with HMAC/sha1) 
   3 09/14/08 20:59:36 ftp/server.pixelmania.private@SERVER.PIXELMANIA.PRIVATE (Triple DES cbc mode with HMAC/sha1) 
   3 09/14/08 20:59:36 afpserver/server.pixelmania.private@SERVER.PIXELMANIA.PRIVATE (Triple DES cbc mode with HMAC/sha1) 
   3 09/14/08 20:59:36 imap/server.pixelmania.private@SERVER.PIXELMANIA.PRIVATE (Triple DES cbc mode with HMAC/sha1) 
   3 09/14/08 20:59:36 pop/server.pixelmania.private@SERVER.PIXELMANIA.PRIVATE (Triple DES cbc mode with HMAC/sha1) 

Should recreate the keytab file as directed, supplying my realm, ladap-admin and password, or is there other troubleshooting steps I should try first?

[Author]

Posts