Help with SSO

[gssny]

I have made the changes to the smb.conf file. Does my OD Master need to be bind to AD also for SSO to work? I’ve read this will not be supported in Tiger. ?

First I want to get SSO working via SMB then AFP afterwards.

[gssny]

Thanks, I added Mac server to AD. Then made changes to smb.conf file.
I also made changes to edu.mit.Kerberos file. I am able to get a ticket, but I can not join to the domain using the net command. Error message below:
net ads join
unable to open file (No such file or directory)
[2004/12/05 15:20:15, 0] /SourceCache/samba/samba-59/samba/source/passdb/secrets.c:secrets_init(47)
Failed to open /private/var/db/samba/secrets.tdb

I’m also getting these errors from the Windows file server log:

Module ‘/etc/pdb/opendirectorysam.so’ loaded
[2004/12/05 16:47:46, 0] /SourceCache/samba/samba-59/samba/source/lib/util_sock.c:read_socket_data(383)
read_socket_data: recv failure for 4. Error = Connection reset by peer
[2004/12/05 16:47:46, 2] /SourceCache/samba/samba-59/samba/source/smbd/server.c:exit_server(568)
Closing connections
[2004/12/05 16:47:46, 2] /SourceCache/samba/samba-59/samba/source/smbd/sesssetup.c:setup_new_vc_session(602)
setup_new_vc_session: New VC == 0, if NT4.x compatible we would close all old resources.
[2004/12/05 16:47:46, 1] /SourceCache/samba/samba-59/samba/source/libads/kerberos_verify.c:ads_verify_ticket(74)
ads_verify_ticket: failed to fetch machine password
[2004/12/05 16:47:46, 1] /SourceCache/samba/samba-59/samba/source/smbd/sesssetup.c:reply_spnego_kerberos(174)
Failed to verify incoming ticket!
[2004/12/05 16:47:46, 2] /SourceCache/samba/samba-59/samba/source/smbd/server.c:exit_server(568)
Closing connections

Anyone have any ideas on what this means and what to do next?

[Anonymous]

Probably not relevant any more but here are some thoughts…

1. Run “net join” command as root. I assume this command needs to be root in order to read secrets.tdb, or to create it perhaps if missing?

2. See if /private/var/db/samba exists, and is owned by root. If not try creating it and setting to root/wheel, owner rw, everyone else no access.

In my case the directory/file existed, but I had to be root in order to succesfully join and make the above errors go away.

Rob

[Author]

Posts