arthur145
Level 1 (0 points)

Q: i cannot login as local network user

I am using Yosemite Server on a MacMini.  I did a clean install on the device 3 weeks ago.  I want to set up local network user accounts so that my wife can conveniently have larger home folders despite being on a MacBook Air with a small SSD.

 

I have used Todd Olthoff's videos on youTube to help with the set up.  VPN works, on the server, my MacBook Pro has been bound to the server, and I have made a test Local Net User name after creating a Open Directory.  I have created a Share to use for home folders, and have set up the user accordingly.

 

I can log in to the user name from my MacMiniServer directly, but when I logout on my MBP and try and login with the Local Net User username/password, It does not work.

When I attempt to login, I get an alert window:  "You are unable to log in to the user account "[username]" at this time.  Logging in to the account failed because an error occurred."

 

I have tried to destroy and recreate my open directory and users.  Ensure that permissions are to everyone read/write to the home folders and that everyone has file sharing permissions.

 

I have rebinded my MBP to the server.

 

When I attempt to login, I get an alert window:  "You are unable to log in to the user account "[username]" at this time.  Logging in to the account failed because an error occurred."

 

Edit:

I seem to have a few log entries that may be related:

user has no SRP keys

Server not found in database: krbtgt/LOCAL@domain.COM: no such entry found in hdb

Failed building TGS-REP to [local MBP IP]

DSUpdateLoginStatus: Unable to synchronize login time for [local network username]

requested flags: renewable, forwardable

Got a canonicalize request for a LKDC realm from local-ipc

kdc[93]: Asked for LKDC, but there is none

 

Message was edited by: arthur145

Mac Mini Server (Late 2012), OS X Yosemite (10.10.5), null

Posted on Aug 19, 2015 6:58 PM

by arthur145,Solvedanswer
arthur145 arthur145
Level 1 (0 points)
A:

Hi Everyone,

I had given up for a while when none of this helped, but I appreciate everyone's contributions.

After going through all my settings with fresh eyes recently, I figured out what it was.  I had created home folders for remote accounts on my server, but had only provided secure communication methods in order to access that share.  I'm not sure which setting allowed remote login to work (SMB,AFP) but by opening up communication channels, I finally solved my issue. 

Posted on Mar 6, 2016 11:15 AM

Close
arthur145

Q: i cannot login as local network user

  • All replies
  • Helpful answers

  • by Grant Bennet-Alder,

    Grant Bennet-Alder Grant Bennet-Alder Aug 19, 2015 7:49 PM in response to arthur145
    Level 9 (61,073 points)
    Desktops
    Aug 19, 2015 7:49 PM in response to arthur145

    I can log in to the user name from my MacMiniServer directly,

    No, you can't. That keeps the other users from being able to log in at all.

     

    OS X Server: Don't log in to the server with a network user's account - Apple Support

     

    .

  • by arthur145,

    arthur145 arthur145 Aug 20, 2015 4:25 AM in response to Grant Bennet-Alder
    Level 1 (0 points)
    Aug 20, 2015 4:25 AM in response to Grant Bennet-Alder

    Thanks for the article, I did not know this could be an issue.  However, I have restarted my server, and tried to log in again remotely from my MBP with no success.  I had logged in previously from server just to verify the accounts themselves worked (if that makes sense), however I have never once successfully logged in remotely to them. 

  • by Antonio Rocco,

    Antonio Rocco Antonio Rocco Aug 21, 2015 2:43 AM in response to arthur145
    Level 6 (10,606 points)
    Desktops
    Aug 21, 2015 2:43 AM in response to arthur145

    All of what follows you probably know or are aware of? So please excuse me if I'm teaching granny to suck eggs.

     

    But, based on what you've presented:

     

    Logging in with a network account (or anything/everything else) onto a client workstation absolutely requires working DNS. Before you start avoid using .local as the TLD for your domain. Why? Because .local is reserved for Bonjour.


    What is working DNS?


    The ability for the server itself to resolve its own hostname (more on this later) on both the forward and reverse pointers. The ability for client workstations to resolve the server hosting user home folders (plus anything else) on both the forward and reverse pointers. Typically you'd use the DHCP service to 'serve' this information over the network to your clients.


    Time.


    Server and clients must be using the same network time protocol server for their time. By default the time differential must be within 5 minutes. One of the error messages you've posted refers to un-synchronized time. The other LKDC error is because the user name and password you're using is not local to that workstation. If you've not bound the workstation to the server and/or their's bad DNS or an ill-thought out network then how is your workstation going to present those credentials to a server it can't properly find?


    The above is not an exhaustive list by any means but it is a good start. A server's hostname is always going to be server.domain.something (but not .local) and it's never server.local. This would be its multicast/Bonjour name. Macs announce and discover themselves using this protocol. Bonjour is a zero-config networked environment (ie: just cables, a switch, hub, router or firewall and nothing else). Zero-config does not require the person setting it up to know anything other than switching the computers on and connecting the 'dots'. This is as simple as it gets. Once you decide you want to use OS X Server (or any other server) it's necessary to deal with DHCP and DNS first before moving onto anything else.

     

    My 2p

  • by arthur145,

    arthur145 arthur145 Aug 21, 2015 4:53 AM in response to Antonio Rocco
    Level 1 (0 points)
    Aug 21, 2015 4:53 AM in response to Antonio Rocco

    Thanks Antonio,

     

    I have set up DNS to a subdomain of a domain I know.  If I'm in terminal on the server hostname resolves to the name of the computer.  I have done some of  types of checks to ensure DNS is working properly (please tell me if you know others).  I have also bound my computer and the network account server light is always green in Users & Groups settings. 

     

    I have noticed and worried that on server.app my computer name is server.local, but it won't let me change the .local part if I rename it.  Is this an issue?  If i make it anything but server.local  e.g. abdefgh.local will this help do you think?  I tried doing it just now, but my MBP said that it could not login to network accounts as soon as I said that... even though the light for the bind is still green.  Thoughts?

     

    Also, where do I find the time variables to try and make sure it is synched?

  • by Grant Bennet-Alder,

    Grant Bennet-Alder Grant Bennet-Alder Aug 21, 2015 8:31 AM in response to arthur145
    Level 9 (61,073 points)
    Desktops
    Aug 21, 2015 8:31 AM in response to arthur145

    There are multiple parts to the DNS story.

     

    1. you must have chosen a three-part name such as server.mydomain.com, and added that into your DNS

     

    2. Your workstations must be able to Lookup this name FORWARD (Network Utility resolves by this name to its appropriate IP Address); and BACKWARD (Network Utility finds that the IP Address looks up to server.mydomain.com).

    Network Utility is available in System/Library/CoreServices/Applications  folder.

     

    3. Your workstations must include your local DNS resolver in their Preferences > Network > .whatever interface. > DNS. If you can get your Router to pass out this DNS reference with the DHCP, so much the better. If not, each must have it added manually.

     

    4. Your workstations must be bound to the Open Directory Server as the "Network Account Server", preferably by server.mydomain.com reference

    in System Preferences > Users&Groups > Login Options, and the light must be green.

     

     

    5. Your Server must be bound ONLY to itself ONLY by numerical 127.0.0.1 reference in

    System Preferences > Users&Groups > Login Options, and the light must be green.

     

    6. seeing your computer-name on the (Edit) screen in

    System Preferences > Sharing ...

    is a red herring, as long as it shows as NOT .local in the main Sharing screen.

  • by arthur145,

    arthur145 arthur145 Aug 22, 2015 8:36 AM in response to Grant Bennet-Alder
    Level 1 (0 points)
    Aug 22, 2015 8:36 AM in response to Grant Bennet-Alder

    1. Check

    2. Check

    3. Check

    4. Check

    5. I bind my server to itself?  didn't know that.  Why 127.0.0.1?  When I go into the User & Groups to bind my server it is already set up to local server and if I add again it says 127.0.0.1 is already being used so it must be using that...

    6. Got it.

     

    This doesn't seem to be a DNS problem...

  • by Grant Bennet-Alder,

    Grant Bennet-Alder Grant Bennet-Alder Aug 23, 2015 1:16 PM in response to arthur145
    Level 9 (61,073 points)
    Desktops
    Aug 23, 2015 1:16 PM in response to arthur145

    Next issue already mentioned is Time. To use encryption, the time on each Mac must be similar, within five minutes is the absolute limit. best practice is to use automatic sync to the same Standard. System Preferences > Date & Time:

    Screen Shot 2015-08-23 at 4.14.19 PM.png

     

    .

    what message do you get when you try to log in?

    .

  • by arthur145,

    arthur145 arthur145 Aug 24, 2015 6:12 AM in response to Grant Bennet-Alder
    Level 1 (0 points)
    Aug 24, 2015 6:12 AM in response to Grant Bennet-Alder

    Time is good.  Both were setup same as yours to apple time. 

    Login error is the same as beginning:

    When I attempt to login, I get an alert window:  "You are unable to log in to the user account "[username]" at this time.  Logging in to the account failed because an error occurred."


    I appreciate everyone's help, but haven't gotten anywhere yet.

  • by Grant Bennet-Alder,

    Grant Bennet-Alder Grant Bennet-Alder Aug 24, 2015 7:52 AM in response to arthur145
    Level 9 (61,073 points)
    Desktops
    Aug 24, 2015 7:52 AM in response to arthur145

    You will probably have to get on the Server and use Console.app to look at the System Log (all messages) from exactly the time when you attempted to log in -- And similarly (use Console.app to look at the System Log) on the Workstation itself.

     

    Putting the information from both together, you can sometimes deduce what has happened. Readers here will be glad to help you if you can post concise cut-and-pasted text (not screenshots) for the messages from the attempted logins.

     

    Please do not post thousands of lines of console messages. They are impossible for Volunteers to wade through.

  • by everyb,

    everyb everyb Jan 7, 2016 9:42 PM in response to Grant Bennet-Alder
    Level 1 (0 points)
    Jan 7, 2016 9:42 PM in response to Grant Bennet-Alder

    I'm getting a similar issue,

     

    I'm using the oceanic.pool.ntp.org time server on both machines, the machine with IP 10.0.1.45 has the DNS set to 10.0.1.6, which is the DNS on the server.

     

    But for the life of me i cant log in with my network accounts.

     

    this is the log from the server:

     

    an  8 16:36:04 server kdc[105] <Notice>: Client sent patypes: ENC-TS, REQ-ENC-PA-REP

    Jan  8 16:36:04 server kdc[105] <Notice>: Need to use PA-ENC-TIMESTAMP/PA-PK-AS-REQ

    Jan  8 16:36:04 server kdc[105] <Notice>: AS-REQ bradevery@SERVER.SALTSTUDIOS.COM.AU.PRIVATE from 10.0.1.145:63580 for krbtgt/SERVER.SALTSTUDIOS.COM.AU.PRIVATE@SERVER.SALTSTUDIOS.COM.AU.PRIVATE

    --- last message repeated 1 time ---

    Jan  8 16:36:04 server kdc[105] <Notice>: Client sent patypes: ENC-TS, REQ-ENC-PA-REP

    Jan  8 16:36:04 server kdc[105] <Notice>: Need to use PA-ENC-TIMESTAMP/PA-PK-AS-REQ

    Jan  8 16:36:31 server servermgr_dirserv[1048] <Warning>: idle exit

    Jan  8 16:36:31 server servermgr_devicemgr[1050] <Warning>: idle exit

    Jan  8 16:36:31 server servermgr_info[1021] <Notice>: Dispatcher: servermgr_dirserv plugin disconnected

    Jan  8 16:36:31 server servermgr_info[1021] <Notice>: Dispatcher: servermgr_devicemgr plugin disconnected

    Jan  8 16:36:31 server Server[659] <Notice>: Dispatcher: servermgr_devicemgr plugin disconnected

    Jan  8 16:36:31 server Server[659] <Notice>: Dispatcher: servermgr_dirserv plugin disconnected

  • by everyb,

    everyb everyb Jan 7, 2016 9:46 PM in response to everyb
    Level 1 (0 points)
    Jan 7, 2016 9:46 PM in response to everyb

    Here are the logs from the computer:

     

    Jan  9 16:42:34 STUDIO-B com.apple.xpc.launchd[1] (com.apple.speech.speechsynthesisd) <Notice>: This key does not do anything: OnDemand

    Jan  9 16:42:34 STUDIO-B com.apple.xpc.launchd[1] (com.apple.TrustEvaluationAgent) <Notice>: This key does not do anything: OnDemand

    Jan  9 16:42:34 STUDIO-B.local tccd[1637] <Notice>: Failed to create /var/empty/Library/Application Support/com.apple.TCC (13)

    Jan  9 16:42:34 STUDIO-B.local sandboxd[359] ([1636]) <Notice>: AssetCacheLocato(1636) deny mach-lookup com.apple.cookied

    Jan  9 16:42:34 STUDIO-B.local sandboxd[359] ([1636]) <Notice>: AssetCacheLocato(1636) deny ipc-posix-shm-read-data /tmp/com.apple.csseed.162

    Jan  9 16:44:21 STUDIO-B.local SecurityAgent[1585] <Notice>: User info context values set for bradevery

    Jan  9 16:44:21 STUDIO-B.local authorizationhost[1588] <Error>: Failed to authenticate user <bradevery> (error: 9).

  • by Grant Bennet-Alder,

    Grant Bennet-Alder Grant Bennet-Alder Jan 8, 2016 7:45 AM in response to everyb
    Level 9 (61,073 points)
    Desktops
    Jan 8, 2016 7:45 AM in response to everyb

    fully qualified domain names ending in .private have been troublesome.

     

    It is encouraging that you have actually gotten to the Server, but it appears to be saying your request is not good enough yet.

  • by arthur145,Solvedanswer

    arthur145 arthur145 Mar 6, 2016 11:15 AM in response to arthur145
    Level 1 (0 points)
    Mar 6, 2016 11:15 AM in response to arthur145

    Hi Everyone,

    I had given up for a while when none of this helped, but I appreciate everyone's contributions.

    After going through all my settings with fresh eyes recently, I figured out what it was.  I had created home folders for remote accounts on my server, but had only provided secure communication methods in order to access that share.  I'm not sure which setting allowed remote login to work (SMB,AFP) but by opening up communication channels, I finally solved my issue.