dsconfigad unable to configure service http error = 2

[kasha]

Hi,

I’m currently trying to setup a AD/OD service as outlined in the white paper but I seemed to have ran into some issues that I have had no joy in solving. I must be doing something wrong but I can’t spot what it is.

right now I’m building a test enviroment first before we go all out buying severs etc so I install the OSX Server on a G5, followed the white paper at each stage until I had to bind to the Kerberos Domain on AD.

The first time I did this in server Admin it looks like it worked so I moved on to test if authentication was being passed from a windows client machine to the OSX Server to mount the users home Dir but I got the user name and password box which no matter what user name and password I entered it will not let me login unless it was a local admin account on the server which suggest to me it was a kerb issue.

I went back and ran the dsconfigad -enablesoo command as root and also as a AD admin user and I keep getting this error message at the very end “unable to configure service http error = 2”.

I have searched everywhere on the web and I have found loads of people with the same issue but only a few people resolved this. when I tried their solutions it still didn’t work for me.

I have tried setup using the following stages:

1: install OSX Server 10.4 only then
config

2: Install OSX 10.4 update to 10.4.8
then Config

3: install OSX 10.4 then update to 10.4.2
then config

None of the above installs worked and I still keep getting the same error.

I checked the logs and there is loads of errors saying that it can’t find my test user. but if I am on the server I can logon into the using AD user account on 2 differant domains.

any pointers will be great after 4 whole days of reading forums and trying out solutions I thought I better ask someone if they know what I might be doing wrong now.

thanks

[kasha]

In the white paper it mention that if it ask for authentication then you will need to check the edu.mit.Kerberos and smb.conf files. I looked into each of these 2 files and they both seem correct to me.

smb.conf file:
—————————————————————-

[global]
encrypt passwords = yes
workgroup = TOWERSTUDENTS
display charset = UTF-8-MAC
security = ads
deadtime = 5
guest account = unknown
client ntlmv2 auth = no
preferred master = no
defer sharing violations = no
allow trusted domains = no
netbios name = lysithea
vfs objects = darwin_acls
lanman auth = YES
wins support = no
brlm = yes
max smbd processes = 0
server string = Mac OS X
os level = 8
domain logons = no
passdb backend = opendirectorysam guest
dos charset = CP437
realm = STUDENTS.TOWER
unix charset = UTF-8-MAC
auth methods = guest opendirectory
local master = no
domain master = no
map to guest = Never
use spnego = yes
printer admin = @admin, @staff
ntlm auth = YES
log level = 0
[homes]
read only = no
browseable = no
comment = User Home Directories
[Groups]
vfs objects = darwin_acls
map archive = no
path = /Groups
read only = no
inherit permissions = no
comment = macosx
create mask = 0644
guest ok = 0
directory mask = 0755
[Public]
vfs objects = darwin_acls
map archive = no
path = /Shared Items/Public
read only = no
inherit permissions = no
comment = macosx
create mask = 0644
guest ok = 0
directory mask = 0755
[Users]
vfs objects = darwin_acls
map archive = no
path = /Users
read only = no
inherit permissions = no
comment = macosx
create mask = 0644
guest ok = 0
directory mask = 0755
[printers]
printable = yes
path = /tmp
[Homes]
oplocks = 0
map archive = no
vfs objects = darwin_acls
path = /Homes
read only = no
strict locking = 1
inherit permissions = 0
comment = macosx
create mask = 0644
guest ok = 0
directory mask = 0755

—————————————————————-

edu.mit.Kerberos

# WARNING This file is automatically created, if you wish to make changes
# delete the next two lines
# autogenerated from : /Active Directory/All Domains
# generation_id : 184498817
[libdefaults]
default_realm = STUDENTS.TOWER
dns_fallback = no
[realms]
ADMIN.TOWER = {
kdc = pladc01.admin.tower.:88
kdc = pladb01.admin.tower.:88
admin_server = pladc01.admin.tower.
admin_server = pladb01.admin.tower.
}
MERCURY.INFO = {
kdc = plmproxy01.mercury.info.:88
kdc = plmproxy02.mercury.info.:88
admin_server = plmproxy01.mercury.info.
admin_server = plmproxy02.mercury.info.
}
STUDENTS.TOWER = {
kdc = plsdc03.students.tower.:88
kdc = bgsdc02.students.tower.:88
admin_server = plsdc03.students.tower.
admin_server = bgsdc02.students.tower.
}
[capaths]
ADMIN.TOWER = {
MERCURY.INFO = .
STUDENTS.TOWER = .
}
MERCURY.INFO = {
ADMIN.TOWER = .
STUDENTS.TOWER = ADMIN.TOWER
}
STUDENTS.TOWER = {
ADMIN.TOWER = .
MERCURY.INFO = ADMIN.TOWER
}

—————————————————————-

Can anyone see anything wrong in these 2 files at all?

We also use an exsiting DNS server but for the sake of this experiment I decided to run my own DNS server from the same box so as someone said that a lot of the issues with OS X server seems to be resolved through DNS.

thanks for taking your time to read this and any pointers will be great.

[kasha]

Another thing, I just tried to run the dsconfigad as a AD user with admin rights and it ask me for a password, when I enter this I get a “Unable to obtain rights to change Directory Services”.

Does t his mean anything to anyone?

[Author]

Posts