Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Two AFP problems

Two problems I can't figure out:

1.) If APF uses Kerberos authentication, in clients I can click in the sidebar and connect. But after the Kerberos certificate expires, clicking in the Finder sidebar fails to login and manually entering the password still fails. It looks like the Kerberos ticket on the client never gets renewed. The only solution on the client seems to be to manually renew the ticket or destroy it and get a new one. It's not supposed to work like this is it? This is an incredible pain. Changing the AFP authentication method to standard works like I expect and client can login all the time. One reason this is important is a have a drive shared for time machine backups. With Kerberos after the first 10 hours, the backups stop since the ticket expires.

2.) I have "standard" logins for user except for mine which on full permissions. When I click in the Finder sidebar on any client machine I get the expected sharepoints. But when I login as any "standard" user I get the sharepoints I expect except also get one called "empty". Looking at the logs on the client it appears it thinks it's mounting a sharepoint named "" (no characters). But on the server I don't have any empty or unnamed sharepoints in either Server Preferences or Server Admin. Looking at the logs I also can't see any sharepoint mounted as empty or "". How do I get rid of this? I'm stumped why this is showing up.

MacBook Pro 2.4GHz 17" HD, Mac OS X (10.5), 4GB RAM, 200GB 7200rpm HD

Posted on Nov 13, 2007 11:23 PM

Reply
Question marked as Best reply

Posted on Nov 14, 2007 11:02 AM

Solution to "Empty" share point.

Open Workgroup Manager.
Click on each user. Click on the home tab. Make sure you erase the default share point home
and set it to "none". The empty share point will no longer be an issue.
10 replies

Nov 15, 2007 7:03 AM in response to Brian Caslis

I've run into the same issue with kerberos and AFP and confirmed t overnight. Yesterday afternoon my kerberos ticket was in place and I was able to access my AFP share points (as well as other kerberized services). This morning I was unable to access my shares until I opened Directory.app and edited my entry (thus forcing the creation of a ticket to my OD serve, which also houses my AFP service). After the ticket was created I was able to access my shares.

Seems like the Finder or whatever service is responsible for creating the kerberos ticket for AFP isn't. Has anyone found a solution that doesn't involve turning of kerberos authentication for AFP?

Nov 20, 2007 8:26 AM in response to Brian Caslis

+If APF uses Kerberos authentication, in clients I can click in the sidebar and connect.+

Yes, AFP +can use+ Kerberos authentication, but it doesn't have to. The authentication methods used by AFP 3 are typically Kerberos 5 or DHX (which Apple calls "Standard"). One, the other, or both can be enabled, as per the authenticationMode key in the com.apple.AppleFileServer.plist file in /Library/Preferences.

You can check and change which authentication methods AFP uses with Server Admin or the command-line version, serveradmin.

+But after the Kerberos certificate expires .... manually entering the password still fails.+

I'm guessing that's the standard AFP connection panel that's failing. Your AFP service is probably configured to only use Kerberos as its authentication method. You can change that back to "Standard and Kerberos" if you want in Server Admin.

+It looks like the Kerberos ticket on the client never gets renewed.+

There are two ways to overcome this:

1. Ask your users to keep their Kerberos application open. (You can add it to their login items via Managed Preferences.) The application is located in /System/Library/CoreServices/Kerberos.app. The default behavior, as defined in the application's preferences, is to automatically renew tickets while it is open. This should work for up to 7 days (the default configuration for the KDC on an Open Directory Master).

2. Adjust your ticket lifetime on the server end. To do so, you must edit the /var/db/krb5kdc/kdc.conf file. For example: *sudo nano /var/db/krb5kdc/kdc.conf*

Look for the max_life variable for your realm under realms. Change that value to whatever you like. The default value is: max_life = 10h 0m 0s.

If you change that, you may also want to change the max renewablelife variable, too.

Reboot your server.

This post may also be helpful: http://www.afp548.com/forum/viewtopic.php?showtopic=16609

--Gerrit

Message was edited by: Gerrit DeWitt

Nov 23, 2007 6:49 PM in response to Jeff Miller2

Yeah, I think we do.

http://discussions.apple.com/thread.jspa?threadID=1244959

I searched and searched to find something to save me from reinstalling tiger on 3 leopard machines.

System Prefs>Security>Firewall
Set to "Set access for specific services and applications"
Then to "advanced". Enable stealth mode.

This has taken all the AFP bugs away from our network. So far.....

Jan 16, 2008 7:33 AM in response to Gerrit DeWitt

Hi Gerrit,

Thanks for your post. We have been battling the same issue with Leopard clients on Leopard server. It looks like we can just avoid any issues by selecting standard auth. What is the downside of this (selecting standard only)?

Also, we are having an issue of AFP disabling/asleep on systems when they go to sleep. Then they can't reconnect Similar to the issue discussed above. The workaround at that point was to simply disable sleep on all systems, then logout and shut down at night.

Two AFP problems

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.