OD Integration Error with Kerio Mail Server

[kevingibb]

I am having an issue binding my Kerio Server to my OD. Everything binds OK from the Kerio side of the world but if I try to login to the Kerio Server from web mail it times out and will not authenticate. This is the error I get from OD:

Aug 08 11:49:35 bpgserver.bpg.lan krb5kdc[67](info): AS_REQ (7 etypes {18 17 16 23 1 3 2}) 192.168.11.5: CLIENT_NOT_FOUND: test1@BPGSERVER.BPG.LAN for krbtgt/BPGSERVER.BPG.LAN@BPGSERVER.BPG.LAN, Client not found in Kerberos database
Aug 08 11:49:35 bpgserver.bpg.lan krb5kdc[67](info): AS_REQ (7 etypes {18 17 16 23 1 3 2}) 192.168.11.5: CLIENT_NOT_FOUND: test1@BPGSERVER.BPG.LAN for krbtgt/BPGSERVER.BPG.LAN@BPGSERVER.BPG.LAN, Client not found in Kerberos database

I am not a huge OD guru so hoping this is simple for someone who is..

Thx, Kevin

[st3w13]

Hey, Kevin.

Are you sure you have a user entry in Workgroup Manager for “test1”? What happens if you open Terminal.app & do “kinit test1” on your OD server? And on your Kerio server?

[kevingibb]

This is what I got:
bpgserver:~ bpgadmin$ kinit test1
kinit: Unable to acquire credentials for ‘test1@BPGSERVER.BPG.LAN’: Client not found in Kerberos database

Weird since I can see it in Workgroup Manager with the rest of the OD Users. It replicates this user database to 2 other OS X Servers

[kevingibb]

I can pull the directory up from Kerio and add a user to the Kerio Server. Here is the log when I do that:

Aug 9 2011 15:18:35 KERBEROS-LOGIN-CHECK: user {0x4e402b2f70735fdb0000005b00000821, test1} authentication failed.
Aug 9 2011 15:19:44 RSAVALIDATE: success.
Aug 9 2011 15:19:44 USER: {0x00000000000000000000000000000001, diradmin} is the current user.
Aug 9 2011 15:19:44 AUTH2: {0x00000000000000000000000000000001, diradmin} CRAM-MD5 authentication succeeded.
Aug 9 2011 15:20:01 HUP
Aug 9 2011 15:20:31 KERBEROS-LOGIN-CHECK: user {0x00000000000000000000000000000001, diradmin} is in good standing.
Aug 9 2011 15:20:31 KERBEROS-LOGIN-CHECK: user {0x00000000000000000000000000000001, diradmin} authentication succeeded.
Aug 9 2011 15:20:31 GETPOLICY: user {0x4e402b2f70735fdb0000005b00000821, test1}.
Aug 9 2011 15:21:49 RSAVALIDATE: success.
Aug 9 2011 15:21:49 USER: {0x00000000000000000000000000000001, diradmin} is the current user.
Aug 9 2011 15:21:49 AUTH2: {0x00000000000000000000000000000001, diradmin} CRAM-MD5 authentication succeeded.
Aug 9 2011 15:23:22 RSAVALIDATE: success.
Aug 9 2011 15:23:22 USER: {0x00000000000000000000000000000001, diradmin} is the current user.
Aug 9 2011 15:23:22 AUTH2: {0x00000000000000000000000000000001, diradmin} CRAM-MD5 authentication succeeded.
Aug 9 2011 15:23:22 RSAVALIDATE: success.
Aug 9 2011 15:23:22 USER: {0x00000000000000000000000000000001, diradmin} is the current user.
Aug 9 2011 15:23:22 AUTH2: {0x00000000000000000000000000000001, diradmin} CRAM-MD5 authentication succeeded.
Aug 9 2011 15:23:22 RSAVALIDATE: success.
Aug 9 2011 15:23:22 USER: {0x00000000000000000000000000000001, diradmin} is the current user.
Aug 9 2011 15:23:22 AUTH2: {0x00000000000000000000000000000001, diradmin} CRAM-MD5 authentication succeeded.
Aug 9 2011 15:24:30 RSAVALIDATE: success.
Aug 9 2011 15:24:30 USER: {0x00000000000000000000000000000001, diradmin} is the current user.
Aug 9 2011 15:24:30 AUTH2: {0x00000000000000000000000000000001, diradmin} CRAM-MD5 authentication succeeded.
Aug 9 2011 15:25:34 KERBEROS-LOGIN-CHECK: user {0x00000000000000000000000000000001, diradmin} is in good standing.
Aug 9 2011 15:25:34 KERBEROS-LOGIN-CHECK: user {0x00000000000000000000000000000001, diradmin} authentication succeeded.
Aug 9 2011 15:26:06 AUTH2: {0x00000000000000000000000000000001, diradmin} DHX authentication succeeded.
Aug 9 2011 15:26:06 NEWUSER: {0x00000000000000000000000000000001, diradmin} created new user {0x4e41b3fe5b7465460000005c00000054, test2}

[st3w13]

Unfortunately, if kinit fails on the OD master then nothing for this user will work.

In Workgroup Manager, create a new user to test with. Create test2 & assign some password & save. Then do “kinit test2” in Terminal. When prompted for the user’s password, enter it & press return. Ideally you just return back to the shell prompt which means the OD master successfully authenticated the user. (You can enter “kdestroy” to remove the ticket you just created with kinit.)

Now go to your Kerio box & do the same thing. If you successfully authenticate then all that’s left is to open the Kerio admin web page & select the “test2” user from the Directory Services list & enable the account. You should then be able to login via webmail (or any other client).

[Author]

Posts