Deactivated accounts reactivating (Tiger OD)

[kevsmith]

We noticed early this afternoon that some accounts that had been disabled (via WGM) were suddenly enabled again. These were accounts that had been disabled in the late morning. Other accounts disabled earlier in the morning or days prior are still disabled as they should be.

I’m not seeing anything in the logs that points to Directory Service issues. I made some other changes (e.g. added a user to a group or changed an entry in the “Info” pane) and those changes did stick.

Our setup is pretty straight forward: MOSXS 10.4.10, xserve G5, OD Master (no Kerberos) with an OD Replica — no recent changes to the system(s).

Any ideas?

[kevsmith]

Playing with some settings I discovered that changing the password type to Crypt (saving) then changing back to Open Directory allowed a problematic account to be disabled permanently. This leads me to believe there’s something wrong with the password service — why would that affect account deactivation?

Looking more closely at the logs… this may not be related but the Password Service Replication log throws out something like this:

May 5 2008 16:38:19 Synchronizing with “Replica1”
May 5 2008 16:38:20 Connecting to 10.0.0.2, synchronizing all records since 05/05/2008 04:38:18 PM
May 5 2008 16:38:20 The remote replica list has 1 parent and 1 replica.
May 5 2008 16:38:20 Updating the list of replicas. There is 1 parent and 1 replica in the list.
May 5 2008 16:38:20 syncfile: /var/db/authserver/apsSyncFi1210030700.289841
May 5 2008 16:38:20 sent 412 records, accepted 0, superceded 0
May 5 2008 16:38:20 No Kerberos records to update
May 5 2008 16:38:20 DoSync: the next replication will occur on 05/05/2008 at 04:40:00 PM
May 5 2008 16:38:21 merging conflicting replica lists
May 5 2008 16:38:26 No Kerberos records to update
May 5 2008 16:38:26 Updated 7 records, rejected 404 from Replica1
May 5 2008 16:38:27 SYNC PULL: providing data to 10.0.0.12 after 05/05/2008 04:38:21 PM
May 5 2008 16:38:27 SYNC PULL: updating 416 records

What confuses me is the “sent 412 records…” and the “Updated 7 records, rejected 404…” lines. We have roughly 850 user records (dozen or so groups) and only a handful have been changed today. Can anyone make heads or tails of these log entries for me?

thanks.

[kevsmith]

Nevermind. Called Apple support.

Turns out the OD database is corrupt. (Indicated by -14xxx errors in the System.log)

fun.

[Author]

Posts