[kevsmith]

Nevermind. Called Apple support.

Turns out the OD database is corrupt. (Indicated by -14xxx errors in the System.log)

fun.

[kevsmith]

Playing with some settings I discovered that changing the password type to Crypt (saving) then changing back to Open Directory allowed a problematic account to be disabled permanently. This leads me to believe there’s something wrong with the password service — why would that affect account deactivation?

Looking more closely at the logs… this may not be related but the Password Service Replication log throws out something like this:

May 5 2008 16:38:19 Synchronizing with “Replica1”
May 5 2008 16:38:20 Connecting to 10.0.0.2, synchronizing all records since 05/05/2008 04:38:18 PM
May 5 2008 16:38:20 The remote replica list has 1 parent and 1 replica.
May 5 2008 16:38:20 Updating the list of replicas. There is 1 parent and 1 replica in the list.
May 5 2008 16:38:20 syncfile: /var/db/authserver/apsSyncFi1210030700.289841
May 5 2008 16:38:20 sent 412 records, accepted 0, superceded 0
May 5 2008 16:38:20 No Kerberos records to update
May 5 2008 16:38:20 DoSync: the next replication will occur on 05/05/2008 at 04:40:00 PM
May 5 2008 16:38:21 merging conflicting replica lists
May 5 2008 16:38:26 No Kerberos records to update
May 5 2008 16:38:26 Updated 7 records, rejected 404 from Replica1
May 5 2008 16:38:27 SYNC PULL: providing data to 10.0.0.12 after 05/05/2008 04:38:21 PM
May 5 2008 16:38:27 SYNC PULL: updating 416 records

What confuses me is the “sent 412 records…” and the “Updated 7 records, rejected 404…” lines. We have roughly 850 user records (dozen or so groups) and only a handful have been changed today. Can anyone make heads or tails of these log entries for me?

thanks.

[Author]

Posts