Help! Kerberos is making me lose my hair!

[fireman_664]

On a “fresh” (I put it in quotes because I just arived on the job and accroding to the outgoing guy this XServe was never used) install of Mac OS X Tiger Server I am trying to impliment a new Open Directory (create the master). I have configured DNS correctly (it certainly looks that way) and then go and try to promote the server the results are less than encouraging, Workgroup manager tells me that users are not mapped to the node I am trying to administer, the diradmin username is useless and the server did not kerberize automatically when trying to kerberize from the Server Admin util the diradmin will not authenticate. Here is the output from slapdconfig.log

Workaround Bonjour: Unknown error: 0
2006-12-21 08:05:00 -0600 – slapconfig -setstandalone
2006-12-21 08:05:00 -0600 – slapconfig -setmacosxodpolicy
2006-12-21 08:09:04 -0600 – slapconfig -createldapmasterandadmin
2006-12-21 08:09:04 -0600 – Creating password server slot
2006-12-21 08:09:04 -0600 – command: /usr/sbin/mkpassdb -a -u diradmin -p -q
2006-12-21 08:09:04 -0600 – command: /usr/sbin/mkpassdb -a -u root -p -q
2006-12-21 08:09:04 -0600 – command: /usr/sbin/NeST -startpasswordserver
2006-12-21 08:09:35 -0600 – NeST command output:
Workaround Bonjour: Unknown error: 0
2006-12-21 08:09:35 -0600 – Workaround Bonjour: Unknown error: 0
2006-12-21 08:09:35 -0600 – Copied file from /etc/openldap/slapd.conf to /etc/openldap/slapd.conf.backup.
2006-12-21 08:09:36 -0600 – Starting LDAP server (slapd)
2006-12-21 08:09:36 -0600 – command: /usr/bin/ldapadd -c -x -D uid=root,cn=users,dc=tiger,dc=education -w ****
2006-12-21 08:09:37 -0600 – ldapadd command output:
ldap_add: No such object (32)
matched DN: dc=tiger,dc=education
ldap_add: No such object (32)
matched DN: dc=tiger,dc=education
ldap_add: No such object (32)
matched DN: dc=tiger,dc=education
ldap_add: No such object (32)
matched DN: dc=tiger,dc=education
ldap_add: No such object (32)
matched DN: dc=tiger,dc=education
ldap_add: No such object (32)
matched DN: dc=tiger,dc=education
ldap_add: No such object (32)
matched DN: dc=tiger,dc=education
ldap_add: No such object (32)
matched DN: dc=tiger,dc=education
ldap_add: No such object (32)
matched DN: dc=tiger,dc=education
ldap_add: No such object (32)
matched DN: dc=tiger,dc=education
ldap_add: No such object (32)
matched DN: dc=tiger,dc=education
2006-12-21 08:09:37 -0600 – ldapadd command failed with status 32
2006-12-21 08:09:37 -0600 – ldap_add: No such object (32)
matched DN: dc=tiger,dc=education
ldap_add: No such object (32)
matched DN: dc=tiger,dc=education
ldap_add: No such object (32)
matched DN: dc=tiger,dc=education
ldap_add: No such object (32)
matched DN: dc=tiger,dc=education
ldap_add: No such object (32)
matched DN: dc=tiger,dc=education
ldap_add: No such object (32)
matched DN: dc=tiger,dc=education
ldap_add: No such object (32)
matched DN: dc=tiger,dc=education
ldap_add: No such object (32)
matched DN: dc=tiger,dc=education
ldap_add: No such object (32)
matched DN: dc=tiger,dc=education
ldap_add: No such object (32)
matched DN: dc=tiger,dc=education
ldap_add: No such object (32)
matched DN: dc=tiger,dc=education
2006-12-21 08:09:37 -0600 – Authentication to LDAP failed with error -14090 (eDSAuthFailed)
2006-12-21 08:09:37 -0600 – Configuring Kerberos server, realm is EDUCATION
2006-12-21 08:09:37 -0600 – command: /sbin/kerberosautoconfig -r EDUCATION -m tiger.education -u -v 1
2006-12-21 08:09:37 -0600 – command: /usr/sbin/kdcsetup -f /LDAPv3/127.0.0.1 -w -a diradmin -p **** -v 1 EDUCATION
2006-12-21 08:09:37 -0600 – kdcsetup command output:
Contacting the Directory Server
Authenticating to the Directory Server
Authentication failed error is -14090
2006-12-21 08:09:37 -0600 – kdcsetup command failed with status 255
2006-12-21 08:09:37 -0600 – command: /usr/sbin/sso_util configure -r EDUCATION -f /LDAPv3/127.0.0.1 -a diradmin -p **** -v 1 all
2006-12-21 08:09:38 -0600 – sso_util command output:
Contacting the directory server
Creating the service list
Creating the service principals
kadmin: Cannot contact any KDC for requested realm while initializing kadmin interface
kadmin: Cannot contact any KDC for requested realm while initializing kadmin interface
kadmin: Cannot contact any KDC for requested realm while initializing kadmin interface
kadmin: Cannot contact any KDC for requested realm while initializing kadmin interface
kadmin: Cannot contact any KDC for requested realm while initializing kadmin interface
kadmin: Cannot contact any KDC for requested realm while initializing kadmin interface
kadmin: Cannot contact any KDC for requested realm while initializing kadmin interface
kadmin: Cannot contact any KDC for requested realm while initializing kadmin interface
kadmin: Cannot contact any KDC for requested realm while initializing kadmin interface
kadmin: Cannot contact any KDC for requested realm while initializing kadmin interface
kadmin: Cannot contact any KDC for requested realm while initializing kadmin interface
kadmin: Cannot contact any KDC for requested realm while initializing kadmin interface
2006-12-21 08:09:38 -0600 – sso_util command failed with status 2
2006-12-21 08:09:38 -0600 – command: /usr/sbin/sso_util configure -r EDUCATION -f /LDAPv3/127.0.0.1 -a diradmin -p **** -v 1 ldap
2006-12-21 08:09:38 -0600 – sso_util command output:
Contacting the directory server
Creating the service list
Creating the service principals
kadmin: Cannot contact any KDC for requested realm while initializing kadmin interface
2006-12-21 08:09:38 -0600 – sso_util command failed with status 2
2006-12-21 08:09:38 -0600 – command: /sbin/kerberosautoconfig -u -v 1
2006-12-21 08:09:38 -0600 – kerberosautoconfig command output:
The machine is standalone
Removing /Library/Preferences/edu.mit.Kerberos
2006-12-21 08:09:38 -0600 – kerberosautoconfig command failed with status 255
2006-12-21 08:09:38 -0600 – command: /usr/sbin/mkpassdb -kerberize
2006-12-21 08:09:38 -0600 – mkpassdb command output:
kadmin.local: unable to get default realm
kadmin.local: unable to get default realm
kadmin.local: unable to get default realm
2006-12-21 08:09:38 -0600 – command: /usr/sbin/vpnaddkeyagentuser -q /LDAPv3/127.0.0.1
2006-12-21 08:09:38 -0600 – vpnaddkeyagentuser command failed with status 206
2006-12-21 08:09:38 -0600 – ldap_add: No such object (32)
matched DN: dc=tiger,dc=education
ldap_add: No such object (32)
matched DN: dc=tiger,dc=education
ldap_add: No such object (32)
matched DN: dc=tiger,dc=education
ldap_add: No such object (32)
matched DN: dc=tiger,dc=education
ldap_add: No such object (32)
matched DN: dc=tiger,dc=education
ldap_add: No such object (32)
matched DN: dc=tiger,dc=education
ldap_add: No such object (32)
matched DN: dc=tiger,dc=education
ldap_add: No such object (32)
matched DN: dc=tiger,dc=education
ldap_add: No such object (32)
matched DN: dc=tiger,dc=education
ldap_add: No such object (32)
matched DN: dc=tiger,dc=education
ldap_add: No such object (32)
matched DN: dc=tiger,dc=education
2006-12-21 08:09:38 -0600 – slapconfig -setldapconfig
2006-12-21 08:09:38 -0600 – command: /usr/sbin/mkpassdb -setreplicationinterval 300 SyncDefault

Any help would be much appreciated!

[fireman_664]

Not as of yet, what command would I use, you’ll have to forgive me I’m just coming over to Macs from the PC/Linux side of the house. I’ve been following Mike Bombich’s guide for Leveraging AD onto OD. Thanks

[relume]

Hello

I have/had the same troubles. I had to configure 3 different MacOSX Servers, all 10.4.8 with the latest Updates, in the recent days at different customers. I was experiencing 3 times a real nightmare, hours to promote a standalone server to a opendirectory master. Always the same error logs. I have to say, that I had followed step by step all official Apple manuals, also the Book “Mac OS X Server 10.4 Tiger” from Schoun Regan, but also advices from different forums. DNS was always perfect before trying the first promoting attempt. In the end after several attempts to promote and depromote, the opendirectory master worked correctly (but without any change to the DNS settings etc.!!) No way to explain why it did not work the first four – five attempts (hours of useless work) neither why it worked in the end but at a certain time it does … no further comments, but I am really scared to setup a next XServe, better I will change the job.

[Author]

Posts