No Kerberos for AFP

[cneely]

Kerberos will not work for AFP, but does for other services. All was working fine before a reboot last week. I have tried everything I can think of, including:

Unbind from AD
Delete keytab file
Delete /Library/Preferences/Directory Services/
Delete /Library/Preferences/edu.mit.kerberos
Rebind to AD
run sudo dsconfigad -enableSSO

Checked serveradmin settings afp:kerberosPrincipal, all looks good.

Also, no recent DNS server changes.
xserve G5, 10.4.11

Any suggestions?

[samv]

It looks like a lot of people are having problems with AFP and Kerberos on Leopard Server. Apple forums have a lot of people reporting the same frustration.

[url]http://discussions.apple.com/forum.jspa?forumID=1233&start=0[/url]

I am also experiencing this problem.

My mail server is Open Directory Master. My file server is an Open Directory Replica. I am therefore using Kerberos. I don’t fiddle with any Kerberos configurations under the hood (ie beyond the GUI). For a while after booting the file server allows AFP connections. After a while (the period of time varies) all attempts to connect to the file server via AFP are refused citing incorrect username or password. Restarting AFP temporarily fixes the problem. It seems most people think the problem is related to Kerberos. Administrators are reporting that this problem persists after the Mac OS 10.5.2 Server update. Indeed, I can report the problem persists for me after upgrading to Mac OS 10.5.2 Server even if I apply the update immediately after Leopard Server installation.

I’ve been forced to revert to Mac OS 10.4 (Tiger) Server until I find a solution to this major headache.

Is anyone else experiencing this problem and does anyone have a solution?

Sam
Melbourne, Australia

[cneely]

Sorry to hear about your problems. I guess you did not notice, but I am running 10.4.11 server.

[Author]

Posts