[kvichak]

I did see that, and I did remove the lines, but as I remember it the box was not hitting my MIT KDC.

I assumed that there was some other sort of magic going on.

[kvichak]

I can use “kerberosautoconfig -r REALM -m kdc-fqdn -u”
This dynamically creates a new /Library/Preferences/edu.mit.Kerberos (krb5.conf) file —
— until the ad plugin writes over it.

I changed the permissions to system:admin 444 and it still over wrote it.

I locked the file and it seems to be holding.

But the requests are for [email protected], not [email protected] like I would expect

[kvichak]

So has anyone tried this with 10.4 yet or seen any documentation for this?

Thanks

[kvichak]

Thanks!

[kvichak]

Thanks for your reply.

My follow up question would be that the list of AD users and their group membership is fairly dynamic 7K users.

If I use OD group populated with AD users, isn’t that a manual process? If I could use an OD group that used an AD group for its membership, would that work?

Can you point me to any information to create the “login” hook to check AD group membership for login access control?

Thanks!

[Author]

Posts