Login problems for Network users, DNS or other problems?

[tintin77]

I have a machine that is running 10.4.11 that is acting as a home router/gateway for my home/office. The machine handles small amounts of traffic for web pages and my email for several employees and myself. It is set up with two network cards, one is from the modem/ISP and the other is the local network. The DNS is set up to handle requests for both of my domains (www.example1.com and http://www.example2.com). Inside the network I have dns set up to use my own domain, lets call it creative.art. All works well for both forward and reverse look ups. I originally created users on the server using the System Prefrences panel. (this was because i really didn’t know a thing about Workgroup Manager and was intimidated by it.) Each person also had a matching log in name on the various computers in the building and i wrote an applescript to automatically mount the a folder on the server for everyone when they logged in. This worked okay for awhile but now i would like to try out the Workgroup Manager/Open Directory approach to things. Now, with that background, here is what i have:

1) If I create a user in WM and DO NOT assign them a homefolder I have problems. When I log onto a client machine in the network a folder is created at the root of the drive, called “99”. Then when the next user logs in (assuming the user is not a local user) then they also use the /99 folder as a home BUT they don’t have permissions on the folder. So after that I tried to assign home folders in WM.

2) I create a share point and “Enable network mounting of this share point” and “Use for User Home Directories”. I then go to the users account>Home and now I have an option to choose, besides (None) under the Where: section. I select this default point and save. I try to log in on a client computer and I get shook off with the error “you are unable to log in to the user account “someuser” at this time. Logging in to the account failed because an error occured. The home folder for the user account is located on an AFP or SMB server. Contact your system adminstrator for help.” So I try to log into the AFP volume using the “Connect to server” option in the finder (I do this to see if the AFP is even there. I try to login with the same user id) and I get this error “Connection Failed. Unknown user, incorrect password, or login is disabled. Please retype the name and password or contact the server’s administrator.” BUT when i try the same thing and use an adminstrator account on the server the share point/home folder mount without protest. So the users i create in WM can login but without a home folder. They cannot login to any AFP share point.

3) Prior to binding the stations to the internal domain, “creative.art”, I can see and conect to the server under /Network/Servers/server.creative.art. BUT when i use the Directory Access program to bind a client to the domain I then see the server as /Network/Server/my.IN.ARPA.my.isp.com/. I understand that the hostname is determined by a set of rules but why isn’t the DNS working here? I means i can do a lookup from the client, whether it is bound or not and it works forward and reverse. But the host name with the IN.ARPA never really worried me because I can’t do anything about it. I have tried the changeip command to change my hostname but when i do that, i can’t get on my ISP with DHCP or manually. So the changeip command changes more things than i want.

Any help would be appreciated. I have been searching the forums and am pretty out of gas on this. I will post logs and have no real problem trying anything to the server. I keep a back up of the system disk and have had to reboot off of the cloned disk several times. I have destroyed the OD several times and started over. Thanks a bunch.

[tintin77]

thanks for the reply. i’m glad to hear that you are second-ing my hostname suspicion. can you help out with running changeip?

the man page and apple support docs are a bit limited (or I am, i suspect the latter).

in this case i do not want to change the ip, only the hostname. I am also hosting a LDAP parent directory so that “node” path must be explicitly stated when changeip is run. does the node path come from WM? where WM shows “Authenticated as diradmin to directory: /LDAPv3/127.0.0.1”? if so would my changeip command look like this:

Code display:

crap.IN.ARPA.HOST.name: ~USER$  changeip /LDAPv3/127.0.0.1 crap.IN.ARPA.HOST.name  new.hotness

or do i need to include the ip? I used changeip earlier and had a lot of problems afterward. the man page says to change the settings in Network Control Panel and restart. In this case, since there isn’t an ip change then is there anything in Network Contol Panel that I need to change? or just restart?

thank you for the guidence.

[tintin77]

okay ran changeip. used my same ip as suggested. I changed a setting in Network Control Panel. For my external card I changed the setting from DHCP to Manual. I then restarted. Everything seems to come up in server admin and system prefs. internet is working. when i run hostname i get the correct host name, but i am getting some other problems. I will fiddle a bit and post back. the IN.ARPA still seems to be affecting AFP though. It’s very strange. There are now two options in the box for “home” in WM. one is the old setting and there is a new one that has the correct qualified name but then a new one that is reversed. I’ll post details after i explore some more.

[tintin77]

We are getting somewhere. I used the inspector (the command line utility you mentioned looks really powerful but a bit confusing at first. I couldn’t quite get it.) Anyway, i deleted all of my share points and then went through the inspector to verify and there were no enteries under Mount. I then created a new share point with a new name and made it the location for users home folders. I went to look at a the Accounts section of WM and then selected a user and then went to the home tab. Sure enough there was an entry for that damned IN.ARPA !!! So i went to the inspector, per your suggestion, and poked around abit and found that under Mounts there was an entry that had the name:

server.my.changeip.name:/Volumes/Harddrive/Users

When I selected this and looked at the inspector there were two enteries that had the little drop-down arrow next to them:

VFSOpts(2)
and
dsAttrTypeNative:mountOption(2)

The value for both was “net” so i hit the arrow and they both had a value that looked like this:

url==afp://;AUTH=NO%20USER%20AUTHENT@crap.IN.ARPA.isp/Users

which i changed to look like this:

url==afp://;AUTH=NO%20USER%20AUTHENT@server.my.changeip.name/Users

I went back to the Accounts>Home tab and the entry there now looks correct! I selected it, selected “Create Home Now” (which has never ever worked) and then hit “Save”. I checked to see if the home folder had been created and it was there! yea! I then went to a client machine and tried to log in with that user BUT i got the SAME error about being unable to login in due to an error, home folder on an afp mount. I then tried to login in with the connect to server dialog (same machine but through a local user) and I again got a familiar message, that the user was invalid or the password was wrong. I don’t get it. You’ve gotten me to the gate but i can’t seem to get it open. Any more words of wisdom?

[tintin77]

sorry for the delay in the reply. i had to upgrade php to php5 today. it broke some things. all is well now. mostly.

so i tried to connect to the share point with the connect to server through the finder. Here is what i did:

afp://serverip/Users/someguy

I get the authentication window, i put in someguy’s short name and password and I get the message:

“Unknown user, incorret password, or login is disabled. Please retype the name and password or contact the server’s administrator”

I try again and authenticate using the server admin name and password and it mounts, no problems. I even get the Logon Greeting that i had set in Server Admin.

So for giggles i tried the same basic thing accept i replaced the ip with the dns name and i got the same thing, someguy gets an error, admin logs in.

Is there a setting in AFP server that i need to look at? or LDAP? it seems that dns is okay.

I don’t know if this matters but Kerbos is not on. I know even less about Kerbos. I thought that by promoting the server to ODC master that Kerbos was automatically started? though maybe not because at the time DNS/hostname was fubar-ed? the kdc and kadmin logs are both empty. if i matters here for authentication. this is an interesting section of the slapconfig log:

2007-12-27 09:30:41 -0600 - removing GUID 63F94BBE-AA1B-459D-805F-BEBD8CC69150 from local admin group.
2007-12-27 09:30:41 -0600 - removing short name diradmin from local admin group.
2007-12-27 09:30:41 -0600 - removing short name kyle from local admin group.
2007-12-27 09:30:41 -0600 - removing short name tintin from local admin group.
2007-12-27 09:30:41 -0600 - command: /usr/sbin/sso_util remove -k -d -s -c -n -v 1
2007-12-27 09:30:51 -0600 - sso_util command output:
shutting down kadmind
kadmind shut down
shutting down kdc
No such process
No such process
kdc shut down
removing kdc database files
2007-12-27 09:30:55 -0600 - Stopping LDAP server (slapd)
2007-12-27 09:30:55 -0600 - Stopping LDAP replicator (slurpd)
2007-12-27 09:30:55 -0600 - Removed file at path /var/db/openldap/openldap-data/__db.001.
2007-12-27 09:30:55 -0600 - Removed file at path /var/db/openldap/openldap-data/__db.002.
2007-12-27 09:30:55 -0600 - Removed file at path /var/db/openldap/openldap-data/__db.003.
2007-12-27 09:30:55 -0600 - Removed file at path /var/db/openldap/openldap-data/__db.004.
2007-12-27 09:30:55 -0600 - Removed file at path /var/db/openldap/openldap-data/__db.005.
2007-12-27 09:30:55 -0600 - Removed file at path /var/db/openldap/openldap-data/apple-generateduid.bdb.
2007-12-27 09:30:55 -0600 - Removed file at path /var/db/openldap/openldap-data/apple-group-memberguid.bdb.
2007-12-27 09:30:55 -0600 - Removed file at path /var/db/openldap/openldap-data/apple-group-nestedgroup.bdb.
2007-12-27 09:30:55 -0600 - Removed file at path /var/db/openldap/openldap-data/cn.bdb.
2007-12-27 09:30:55 -0600 - Removed file at path /var/db/openldap/openldap-data/DB_CONFIG.
2007-12-27 09:30:55 -0600 - Removed file at path /var/db/openldap/openldap-data/dn2id.bdb.
2007-12-27 09:30:55 -0600 - Removed file at path /var/db/openldap/openldap-data/gidNumber.bdb.
2007-12-27 09:30:55 -0600 - Removed file at path /var/db/openldap/openldap-data/id2entry.bdb.
2007-12-27 09:30:55 -0600 - Removed file at path /var/db/openldap/openldap-data/log.0000000001.
2007-12-27 09:30:55 -0600 - Removed file at path /var/db/openldap/openldap-data/memberUid.bdb.
2007-12-27 09:30:55 -0600 - Removed file at path /var/db/openldap/openldap-data/objectClass.bdb.
2007-12-27 09:30:55 -0600 - Removed file at path /var/db/openldap/openldap-data/ou.bdb.
2007-12-27 09:30:55 -0600 - Removed file at path /var/db/openldap/openldap-data/sn.bdb.
2007-12-27 09:30:55 -0600 - Removed file at path /var/db/openldap/openldap-data/uid.bdb.
2007-12-27 09:30:55 -0600 - Removed file at path /var/db/openldap/openldap-data/uidNumber.bdb.
2007-12-27 09:30:55 -0600 - Removed file at path /etc/openldap/slapd_macosxserver.conf.
2007-12-27 09:30:55 -0600 - Removed file at path /etc/openldap/slapd.conf.
2007-12-27 09:30:55 -0600 - Copied file from /etc/openldap/slapd.conf.default to /etc/openldap/slapd.conf.
2007-12-27 09:30:55 -0600 - command: /usr/sbin/NeST -pwsstandalone
2007-12-27 09:31:04 -0600 - slapconfig -setstandalone
2007-12-27 09:31:04 -0600 - slapconfig -setmacosxodpolicy
2008-01-02 20:14:33 -0600 - slapconfig -createldapmasterandadmin
2008-01-02 20:14:33 -0600 - Creating password server slot
2008-01-02 20:14:33 -0600 - command: /usr/sbin/mkpassdb -a -u diradmin -p -q
2008-01-02 20:14:33 -0600 - command: /usr/sbin/mkpassdb -a -u root -p -q
2008-01-02 20:14:33 -0600 - command: /usr/sbin/NeST -startpasswordserver
2008-01-02 20:14:35 -0600 - Copied file from /etc/openldap/slapd.conf to /etc/openldap/slapd.conf.backup.
2008-01-02 20:14:36 -0600 - Starting LDAP server (slapd)
2008-01-02 20:14:37 -0600 - command: /usr/bin/ldapadd -c -x -D uid=root,cn=users,dc=opine,dc=art -w ****
2008-01-02 20:14:38 -0600 - Could not resolve hostname crap-IN-ARPA.isp
2008-01-02 20:14:38 -0600 - Skipping Kerberos configuration
2008-01-02 20:14:39 -0600 - command: /usr/sbin/vpnaddkeyagentuser -q /LDAPv3/127.0.0.1
2008-01-02 20:14:39 -0600 - slapconfig -setldapconfig
2008-01-02 20:14:39 -0600 - command: /usr/sbin/mkpassdb -setreplicationinterval 300 SyncDefault
2008-01-07 22:39:31 -0600 - slapconfig -changeip

There are several references to skipping kerbos and kdc not existing as a process. Does this have anything to do with the inability of LDAP users to log in?

[tintin77]

As a follow up to the last post, the Password Service Server Log has this for my login attmept:

Jan  9 2008 23:39:56	GETPOLICY: user {0x477c461f503e436f0000000500000005, someguy}, 
policies: isDisabled=0 isAdminUser=0 newPasswordRequired=0 usingHistory=0 canModifyPasswordforSelf=1 
usingExpirationDate=0 usingHardExpirationDate=0 requiresAlpha=0 requiresNumeric=0 
expirationDateGMT=4294967295 hardExpireDateGMT=4294967295 maxMinutesUntilChangePassword=0 
maxMinutesUntilDisabled=0 maxMinutesOfNonUse=0 maxFailedLoginAttempts=0 minChars=0 maxChars=0 
passwordCannotBeName=0 requiresMixedCase=0 notGuessablePattern=0 isSessionKeyAgent=0
Jan  9 2008 23:39:56	QUIT: {no user} disconnected.

[tintin77]

I’m still having problems with this. I don’t think that changeip does enough. The system log has this section which may relate to the LDAP problems:

Jan 13 12:06:27 server servermgrd: servermgr_dns: Reloaded named
Jan 13 12:06:27 server servermgrd: servermgr_dns: configured name and reverse DNS name do not match 
    (server.opine.art != cpe-67-11-33-73.satx.res.rr.com), 
    various services may not function properly - use changeip to repair and/or correct DNS
Jan 13 12:06:29 server DirectoryService[64]: Search connection failure: During an attempt to bind to [127.0.0.1] LDAP server.
Jan 13 12:06:29 server DirectoryService[64]: Search connection failure: Disabled future attempts to bind to [127.0.0.1] 
    LDAP server for next 0 seconds.
Jan 13 12:06:29 server servermgrd: servermgr_dns: Reloaded named
Jan 13 12:06:29 server servermgrd: servermgr_dns: configured name and reverse DNS name do not match 
    (server.opine.art != cpe-67-11-33-73.satx.res.rr.com), 
    various services may not function properly - use changeip to repair and/or correct DN

When I connect to the WM I connect to the domain: opine.art, I use the diradmin user and password. When the WM window opens, at the top of the window it has a title bar that reads as:

“Workgroup Manager: cpe-67-11-33-73.satx.res.rr.com”

When I am in WM and viewing Accounts and select an account, under the Account Summary it reads as:

Location: cpe-67-11-33-73.satx.res.rr.com/LDAPv3/127.0.0.1

Is this still the problem? if so, what would the remedy be?

[Author]

Posts