AFP/SMB shares not Kerberos’n/Single SignOn

[mcorey]

I have a couple issues going on right now.
Xservers have 2 NICs eth0 has to be plugged in for OS X OD to work so I’ve never plugged in eth1. The other night I did to try and simplify external administration. During the day while eth1 was plugged in and everything was working as it always has but the next morning…
The system apparently did a reconfig on it’s daily cron/launchd process and wrecked DHCP which then screwed up all clients AFP/SMB connections.
OD was running with Kerberos but when I try logging in as a use the Group share asks for an AFP password not the auto Single SignOn process which just mounts the share. When I try to auth with the user’s short name and password it fails but the long name and password works.

We are now running Mac OS X.5.7 Server and the one with this issue is running DHCP, DNS, OD Master, AFP, and SMB.
The log files look fine to me.
Why won’t the AFP/SMB shares allow the user to connect via Kerberos/Single SignOn?
It was working fine yesterday and I’ve restored the settings on the server to match those of yesterday…

AFP Logs look fine.
IP ip.add.re.ss – – 08/Jul/2009:17:32:23 -0500 “Login username” 0 0 0
IP ip.add.re.ss – – 08/Jul/2009:17:32:23 -0500 “CreateFile .dat00dd.005” 0 0 0
IP ip.add.re.ss – – 08/Jul/2009:17:32:23 -0500 “OpenFork .dat00dd.005” 0 0 0
IP ip.add.re.ss – – 08/Jul/2009:17:32:24 -0500 “Delete .mhd-write-to-root-of-remote-home-to-check-for-nfs-connection-file” 0 0 0

OD Directory Service Log
2009-07-08 17:09:48 EDT – T0xA0B77820 – DirectoryService 5.7 (v514.25) starting up…
2009-07-08 17:09:48 EDT – T0xF0185000 – Initializing TCP …
2009-07-08 17:09:48 EDT – T0xF0207000 – Plugin , Version <1.0>, processed successfully.
2009-07-08 17:09:48 EDT – T0xF0207000 – Plugin , Version <3.0>, processed successfully.
2009-07-08 17:09:48 EDT – T0xF0207000 – Plugin , Version <1.1>, processed successfully.
2009-07-08 17:09:48 EDT – T0xF0207000 – Plugin , Version <3.1>, processed successfully.
2009-07-08 17:09:48 EDT – T0xF0207000 – Plugin

, Version <3.1>, processed successfully.
2009-07-08 17:09:48 EDT – T0xF0207000 – Plugin , Version <2.0>, processed successfully.
2009-07-08 17:09:48 EDT – T0xF038D000 – Registered node /Configure
2009-07-08 17:09:48 EDT – T0xF038D000 – Plug-in Configure state is now active.
2009-07-08 17:09:48 EDT – T0xF0491000 – Plug-in LDAPv3 state is now active.
2009-07-08 17:09:48 EDT – T0xF0595000 – Registered Locally Hosted Node /BSD/local
2009-07-08 17:09:48 EDT – T0xF0595000 – Registered node /BSD/local
2009-07-08 17:09:48 EDT – T0xF0595000 – Plug-in BSD state is now active.
2009-07-08 17:09:48 EDT – T0xF040F000 – Registered Locally Hosted Node /Local/Default
2009-07-08 17:09:48 EDT – T0xF040F000 – Registered node /Local/Default
2009-07-08 17:09:48 EDT – T0xF040F000 – Plug-in Local state is now active.
2009-07-08 17:09:48 EDT – T0xF0513000 – Registered node /Search
2009-07-08 17:09:48 EDT – T0xF0513000 – Registered node /Search/Contacts
2009-07-08 17:09:48 EDT – T0xF0513000 – Registered node /Search/Network
2009-07-08 17:09:48 EDT – T0xF0513000 – Plug-in Search state is now active.
2009-07-08 17:09:48 EDT – T0xF0491000 – Local Plugin – index passed integrity check
2009-07-08 17:09:48 EDT – T0xF030B000 – BSD Plugin – index passed integrity check
2009-07-08 17:09:48 EDT – T0xF030B000 – Registered node /Cache
2009-07-08 17:09:48 EDT – T0xF030B000 – Plug-in Cache state is now active.
2009-07-08 17:09:48 EDT – T0xF0207000 – Plugin “Active Directory”, Version “1.6.5”, is set to load lazily.
2009-07-08 17:09:48 EDT – T0xF0207000 – Plugin “PasswordServer”, Version “4.0.3”, is set to load lazily.
2009-07-08 17:09:54 EDT – T0xF0081000 – Network transition occurred.
2009-07-08 17:09:55 EDT – T0xF0081000 – Network transition occurred.
2009-07-08 17:09:56 EDT – T0xF0081000 – Network transition occurred.
2009-07-08 17:09:56 EDT – T0xF0081000 – Network transition occurred.
2009-07-08 17:11:37 EDT – T0xF0103000 – Plugin “PasswordServer”, Version “4.0.3”, loaded on demand successfully.

OD Config Log
2009-07-08 17:06:56 -0400 – Stopping LDAP server (slapd)
2009-07-08 17:06:57 -0400 – Stopping LDAP replicator (slurpd)
2009-07-08 17:07:03 -0400 – slapconfig -startldapserver
2009-07-08 17:07:03 -0400 – Starting LDAP server (slapd)
2009-07-08 17:07:29 -0400 – slapconfig -startreplicator
2009-07-08 17:07:29 -0400 – Starting LDAP replicator (slurpd)

Kerberos username Log
Jul 08 17:08:48 domain kusernamed43(debug): Got signal to request exit
Jul 08 17:08:48 domain kusernamed43(debug): Got signal to request exit
Jul 08 17:08:48 domain kusernamed43(info): finished, exiting
Jul 08 17:08:48 domain kusernamed43(info): finished, exiting
Jul 08 17:09:55 domain kusernamed43(info): No dictionary file specified, continuing without one.
Jul 08 17:09:55 domain kusernamed43(info): No dictionary file specified, continuing without one.
Jul 08 17:09:55 domain kusernamed43(info): Seeding random number generator
Jul 08 17:09:55 domain kusernamed43(info): Seeding random number generator
Jul 08 17:09:55 domain kusernamed43(info): starting
Jul 08 17:09:55 domain kusernamed43(info): starting

Kerberos Server Log
Jul 08 17:16:26 domain krb5kdc91(debug): handling authdata
Jul 08 17:16:26 domain krb5kdc91(debug): handling authdata
Jul 08 17:16:26 domain krb5kdc91(debug): .. .. ok
Jul 08 17:16:26 domain krb5kdc91(debug): .. .. ok
Jul 08 17:16:26 domain krb5kdc91(info): AS_REQ (7 etypes {18 17 16 23 1 3 2}) 10.1.0.2: ISSUE: authtime 1247087786, etypes {rep=16 tkt=16 ses=16}, username@DOMAIN for krbtgt/DOMAIN@DOMAIN
Jul 08 17:16:26 domain krb5kdc91(info): AS_REQ (7 etypes {18 17 16 23 1 3 2}) 10.1.0.2: ISSUE: authtime 1247087786, etypes {rep=16 tkt=16 ses=16}, username@DOMAIN for krbtgt/DOMAIN@DOMAIN

LDAP Log
Jul 8 17:09:54 localhost slapd39: @(#) $OpenLDAP: slapd 2.3.27 (Jan 26 2009 09:49:21) $
Jul 8 17:09:55 fileserver slapd39: overlay_config(): warning, overlay “dynid” already in list
Jul 8 17:09:55 fileserver slapd39: overlay_config(): warning, overlay “dynid” already in list
Jul 8 17:09:55: — last message repeated 3 times —
Jul 8 17:09:55 fileserver slapd39: slapd starting
Jul 8 17:11:36 fileserver slapd39: <= bdb_substring_candidates: (authAuthority) index_param failed (18) Jul 8 17:14:49 fileserver slapd39: <= bdb_substring_candidates: (authAuthority) index_param failed (18) Jul 8 17:15:19: --- last message repeated 2 times --- Jul 8 17:16:23 fileserver slapd39: <= bdb_substring_candidates: (authAuthority) index_param failed (18) Jul 8 17:16:53: --- last message repeated 1 time --- Password Service Log Jul 8 2009 17:16:26 KERBEROS-LOGIN-CHECK: user {0x488ba136066568c60000000200000002, username} is in good standing. Jul 8 2009 17:16:26 KERBEROS-LOGIN-CHECK: user {0x488ba136066568c60000000200000002, username} authentication succeeded. Jul 8 2009 17:21:35 AUTH2: {0x488c0143336f4df30000002600000025, username} DIGEST-MD5 authentication succeeded. Jul 8 2009 17:24:29 AUTH2: {0x488c01446fcf6e4b0000002700000026, username} DIGEST-MD5 authentication succeeded. Jul 8 2009 17:30:20 RSAVALIDATE: success. Jul 8 2009 17:30:20 USER: {0x488c014265f833770000002500000024, username} is the current user. Jul 8 2009 17:30:20 AUTH2: {0x488c014265f833770000002500000024, username} CRAM-MD5 authentication succeeded. Jul 8 2009 17:31:53 AUTH2: {0x488c013d6b8db8590000001e0000001d, username} DIGEST-MD5 authentication succeeded. Jul 8 2009 17:32:22 AUTH2: {0x488bc39350b1b8040000000500000005, username} DIGEST-MD5 authentication succeeded. Jul 8 2009 17:33:50 RSAVALIDATE: success. Jul 8 2009 17:33:50 USER: {0x488c013872ac8c680000001600000015, username} is the current user. Jul 8 2009 17:33:50 AUTH2: {0x488c013872ac8c680000001600000015, username} CRAM-MD5 authentication succeeded. Jul 8 2009 17:38:20 AUTH2: {0x488c014f703ecdea0000003800000037, username} DIGEST-MD5 authentication succeeded. Jul 8 2009 17:38:51 AUTH2: {0x488bc39350b1b8040000000500000005, username} DIGEST-MD5 authentication succeeded. Password Service Error Log Jul 8 2009 17:08:48 Registration is finished error: (10, -72000). Jul 8 2009 17:08:48 Registration is finished error: (10, -72000). Password Service Replica Log Jul 8 2009 17:40:13 Synchronizing with "Replica5" Jul 8 2009 17:40:13 Replica5:Connecting to 10.1.0.3, synchronizing all records since 07/08/2009 09:35:57 PM GMT Jul 8 2009 17:40:13 Replica5:The remote replica list has 1 parent and 1 replica. Jul 8 2009 17:40:13 Replica5:sending 2 records from tid 3628 Jul 8 2009 17:40:13 Replica5:sent 2 records, 44 kerberos principals Jul 8 2009 17:40:13 DoSync: the next scheduled replication will occur on 07/08/2009 at 05:45:00 PM Xserver G5 Mac OS X (10.5.7)

[Author]

Posts