[tintin77]

I’m still having problems with this. I don’t think that changeip does enough. The system log has this section which may relate to the LDAP problems:

Jan 13 12:06:27 server servermgrd: servermgr_dns: Reloaded named
Jan 13 12:06:27 server servermgrd: servermgr_dns: configured name and reverse DNS name do not match 
    (server.opine.art != cpe-67-11-33-73.satx.res.rr.com), 
    various services may not function properly - use changeip to repair and/or correct DNS
Jan 13 12:06:29 server DirectoryService[64]: Search connection failure: During an attempt to bind to [127.0.0.1] LDAP server.
Jan 13 12:06:29 server DirectoryService[64]: Search connection failure: Disabled future attempts to bind to [127.0.0.1] 
    LDAP server for next 0 seconds.
Jan 13 12:06:29 server servermgrd: servermgr_dns: Reloaded named
Jan 13 12:06:29 server servermgrd: servermgr_dns: configured name and reverse DNS name do not match 
    (server.opine.art != cpe-67-11-33-73.satx.res.rr.com), 
    various services may not function properly - use changeip to repair and/or correct DN

When I connect to the WM I connect to the domain: opine.art, I use the diradmin user and password. When the WM window opens, at the top of the window it has a title bar that reads as:

“Workgroup Manager: cpe-67-11-33-73.satx.res.rr.com”

When I am in WM and viewing Accounts and select an account, under the Account Summary it reads as:

Location: cpe-67-11-33-73.satx.res.rr.com/LDAPv3/127.0.0.1

Is this still the problem? if so, what would the remedy be?

[tintin77]

As a follow up to the last post, the Password Service Server Log has this for my login attmept:

Jan  9 2008 23:39:56	GETPOLICY: user {0x477c461f503e436f0000000500000005, someguy}, 
policies: isDisabled=0 isAdminUser=0 newPasswordRequired=0 usingHistory=0 canModifyPasswordforSelf=1 
usingExpirationDate=0 usingHardExpirationDate=0 requiresAlpha=0 requiresNumeric=0 
expirationDateGMT=4294967295 hardExpireDateGMT=4294967295 maxMinutesUntilChangePassword=0 
maxMinutesUntilDisabled=0 maxMinutesOfNonUse=0 maxFailedLoginAttempts=0 minChars=0 maxChars=0 
passwordCannotBeName=0 requiresMixedCase=0 notGuessablePattern=0 isSessionKeyAgent=0
Jan  9 2008 23:39:56	QUIT: {no user} disconnected.

[tintin77]

sorry for the delay in the reply. i had to upgrade php to php5 today. it broke some things. all is well now. mostly.

so i tried to connect to the share point with the connect to server through the finder. Here is what i did:

afp://serverip/Users/someguy

I get the authentication window, i put in someguy’s short name and password and I get the message:

“Unknown user, incorret password, or login is disabled. Please retype the name and password or contact the server’s administrator”

I try again and authenticate using the server admin name and password and it mounts, no problems. I even get the Logon Greeting that i had set in Server Admin.

So for giggles i tried the same basic thing accept i replaced the ip with the dns name and i got the same thing, someguy gets an error, admin logs in.

Is there a setting in AFP server that i need to look at? or LDAP? it seems that dns is okay.

I don’t know if this matters but Kerbos is not on. I know even less about Kerbos. I thought that by promoting the server to ODC master that Kerbos was automatically started? though maybe not because at the time DNS/hostname was fubar-ed? the kdc and kadmin logs are both empty. if i matters here for authentication. this is an interesting section of the slapconfig log:

2007-12-27 09:30:41 -0600 - removing GUID 63F94BBE-AA1B-459D-805F-BEBD8CC69150 from local admin group.
2007-12-27 09:30:41 -0600 - removing short name diradmin from local admin group.
2007-12-27 09:30:41 -0600 - removing short name kyle from local admin group.
2007-12-27 09:30:41 -0600 - removing short name tintin from local admin group.
2007-12-27 09:30:41 -0600 - command: /usr/sbin/sso_util remove -k -d -s -c -n -v 1
2007-12-27 09:30:51 -0600 - sso_util command output:
shutting down kadmind
kadmind shut down
shutting down kdc
No such process
No such process
kdc shut down
removing kdc database files
2007-12-27 09:30:55 -0600 - Stopping LDAP server (slapd)
2007-12-27 09:30:55 -0600 - Stopping LDAP replicator (slurpd)
2007-12-27 09:30:55 -0600 - Removed file at path /var/db/openldap/openldap-data/__db.001.
2007-12-27 09:30:55 -0600 - Removed file at path /var/db/openldap/openldap-data/__db.002.
2007-12-27 09:30:55 -0600 - Removed file at path /var/db/openldap/openldap-data/__db.003.
2007-12-27 09:30:55 -0600 - Removed file at path /var/db/openldap/openldap-data/__db.004.
2007-12-27 09:30:55 -0600 - Removed file at path /var/db/openldap/openldap-data/__db.005.
2007-12-27 09:30:55 -0600 - Removed file at path /var/db/openldap/openldap-data/apple-generateduid.bdb.
2007-12-27 09:30:55 -0600 - Removed file at path /var/db/openldap/openldap-data/apple-group-memberguid.bdb.
2007-12-27 09:30:55 -0600 - Removed file at path /var/db/openldap/openldap-data/apple-group-nestedgroup.bdb.
2007-12-27 09:30:55 -0600 - Removed file at path /var/db/openldap/openldap-data/cn.bdb.
2007-12-27 09:30:55 -0600 - Removed file at path /var/db/openldap/openldap-data/DB_CONFIG.
2007-12-27 09:30:55 -0600 - Removed file at path /var/db/openldap/openldap-data/dn2id.bdb.
2007-12-27 09:30:55 -0600 - Removed file at path /var/db/openldap/openldap-data/gidNumber.bdb.
2007-12-27 09:30:55 -0600 - Removed file at path /var/db/openldap/openldap-data/id2entry.bdb.
2007-12-27 09:30:55 -0600 - Removed file at path /var/db/openldap/openldap-data/log.0000000001.
2007-12-27 09:30:55 -0600 - Removed file at path /var/db/openldap/openldap-data/memberUid.bdb.
2007-12-27 09:30:55 -0600 - Removed file at path /var/db/openldap/openldap-data/objectClass.bdb.
2007-12-27 09:30:55 -0600 - Removed file at path /var/db/openldap/openldap-data/ou.bdb.
2007-12-27 09:30:55 -0600 - Removed file at path /var/db/openldap/openldap-data/sn.bdb.
2007-12-27 09:30:55 -0600 - Removed file at path /var/db/openldap/openldap-data/uid.bdb.
2007-12-27 09:30:55 -0600 - Removed file at path /var/db/openldap/openldap-data/uidNumber.bdb.
2007-12-27 09:30:55 -0600 - Removed file at path /etc/openldap/slapd_macosxserver.conf.
2007-12-27 09:30:55 -0600 - Removed file at path /etc/openldap/slapd.conf.
2007-12-27 09:30:55 -0600 - Copied file from /etc/openldap/slapd.conf.default to /etc/openldap/slapd.conf.
2007-12-27 09:30:55 -0600 - command: /usr/sbin/NeST -pwsstandalone
2007-12-27 09:31:04 -0600 - slapconfig -setstandalone
2007-12-27 09:31:04 -0600 - slapconfig -setmacosxodpolicy
2008-01-02 20:14:33 -0600 - slapconfig -createldapmasterandadmin
2008-01-02 20:14:33 -0600 - Creating password server slot
2008-01-02 20:14:33 -0600 - command: /usr/sbin/mkpassdb -a -u diradmin -p -q
2008-01-02 20:14:33 -0600 - command: /usr/sbin/mkpassdb -a -u root -p -q
2008-01-02 20:14:33 -0600 - command: /usr/sbin/NeST -startpasswordserver
2008-01-02 20:14:35 -0600 - Copied file from /etc/openldap/slapd.conf to /etc/openldap/slapd.conf.backup.
2008-01-02 20:14:36 -0600 - Starting LDAP server (slapd)
2008-01-02 20:14:37 -0600 - command: /usr/bin/ldapadd -c -x -D uid=root,cn=users,dc=opine,dc=art -w ****
2008-01-02 20:14:38 -0600 - Could not resolve hostname crap-IN-ARPA.isp
2008-01-02 20:14:38 -0600 - Skipping Kerberos configuration
2008-01-02 20:14:39 -0600 - command: /usr/sbin/vpnaddkeyagentuser -q /LDAPv3/127.0.0.1
2008-01-02 20:14:39 -0600 - slapconfig -setldapconfig
2008-01-02 20:14:39 -0600 - command: /usr/sbin/mkpassdb -setreplicationinterval 300 SyncDefault
2008-01-07 22:39:31 -0600 - slapconfig -changeip

There are several references to skipping kerbos and kdc not existing as a process. Does this have anything to do with the inability of LDAP users to log in?

[tintin77]

We are getting somewhere. I used the inspector (the command line utility you mentioned looks really powerful but a bit confusing at first. I couldn’t quite get it.) Anyway, i deleted all of my share points and then went through the inspector to verify and there were no enteries under Mount. I then created a new share point with a new name and made it the location for users home folders. I went to look at a the Accounts section of WM and then selected a user and then went to the home tab. Sure enough there was an entry for that damned IN.ARPA !!! So i went to the inspector, per your suggestion, and poked around abit and found that under Mounts there was an entry that had the name:

server.my.changeip.name:/Volumes/Harddrive/Users

When I selected this and looked at the inspector there were two enteries that had the little drop-down arrow next to them:

VFSOpts(2)
and
dsAttrTypeNative:mountOption(2)

The value for both was “net” so i hit the arrow and they both had a value that looked like this:

url==afp://;AUTH=NO%20USER%20AUTHENT@crap.IN.ARPA.isp/Users

which i changed to look like this:

url==afp://;AUTH=NO%20USER%20AUTHENT@server.my.changeip.name/Users

I went back to the Accounts>Home tab and the entry there now looks correct! I selected it, selected “Create Home Now” (which has never ever worked) and then hit “Save”. I checked to see if the home folder had been created and it was there! yea! I then went to a client machine and tried to log in with that user BUT i got the SAME error about being unable to login in due to an error, home folder on an afp mount. I then tried to login in with the connect to server dialog (same machine but through a local user) and I again got a familiar message, that the user was invalid or the password was wrong. I don’t get it. You’ve gotten me to the gate but i can’t seem to get it open. Any more words of wisdom?

[tintin77]

okay ran changeip. used my same ip as suggested. I changed a setting in Network Control Panel. For my external card I changed the setting from DHCP to Manual. I then restarted. Everything seems to come up in server admin and system prefs. internet is working. when i run hostname i get the correct host name, but i am getting some other problems. I will fiddle a bit and post back. the IN.ARPA still seems to be affecting AFP though. It’s very strange. There are now two options in the box for “home” in WM. one is the old setting and there is a new one that has the correct qualified name but then a new one that is reversed. I’ll post details after i explore some more.

[tintin77]

thanks for the reply. i’m glad to hear that you are second-ing my hostname suspicion. can you help out with running changeip?

the man page and apple support docs are a bit limited (or I am, i suspect the latter).

in this case i do not want to change the ip, only the hostname. I am also hosting a LDAP parent directory so that “node” path must be explicitly stated when changeip is run. does the node path come from WM? where WM shows “Authenticated as diradmin to directory: /LDAPv3/127.0.0.1”? if so would my changeip command look like this:

Code display:

crap.IN.ARPA.HOST.name: ~USER$  changeip /LDAPv3/127.0.0.1 crap.IN.ARPA.HOST.name  new.hotness

or do i need to include the ip? I used changeip earlier and had a lot of problems afterward. the man page says to change the settings in Network Control Panel and restart. In this case, since there isn’t an ip change then is there anything in Network Contol Panel that I need to change? or just restart?

thank you for the guidence.

[Author]

Posts