Cannot Login Using Kerberos Authentication

Question

Level 1

6 points

Cannot Login Using Kerberos Authentication

I have a plain vanilla Mac Mini with SLS setup, the mini is the OD master, the DNS checks out OK. The OD says Kerberos up and running with the proper all caps FQDN. I can bind to the OD from the SL client just fine. I can even got to ticket viewer and create a ticket using my user login.

However, if I set Authentication to Kerberos in AFP, on the client when I go to Go -> Connect to Server and select afp://<fqdn>, I get a user ID and password screen, and no matter what I put in for user ID and password, I get "User ID or Password Invalid". If I change AFP to "Any Method" I can log in without problems.

Neither of the AFP logs point to a failed login.

Looking at the Kerberos log I get:

Mar 14 18:35:08 ,<FQDN> krb5kdc[74](info): AS_REQ (7 etypes {18 17 16 23 1 3 2}) 1<ip address>: NEEDED_PREAUTH: <computer name>$@<FQDN realm name> for krbtgt/<FQDN realm name>@<FQDN realm name>, Additional pre-authentication required

Followed by:

Mar 14 18:35:09 <FQDN> krb5kdc[74](info): TGS_REQ (7 etypes {18 17 16 23 1 3 2}) <IP address>: ISSUE: authtime 1300142108, etypes {rep=18 tkt=16 ses=18}, <computer name>$@<FQDN realm name> for ldap/<FQDN>@<FQDN realm name>

Both the server and the client are using time.apple.com to time synch, and I even put both clocks up on the screen at the same time and they were visibly identical.

Searched everything on this board related and nothing points to this problem as far as I can tell.

Help?

MacBook Pro, Mac Mini with Snow Leopard Server, Mac OS X (10.6.6), HP C4280 Printer

Posted on Mar 14, 2011 3:43 PM

Reply

Answer 1

Mar 14, 2011 3:55 PM in response to Morris Zwick

Hi

Something you could quickly try - what's the result of issuing this command on the Server?

sudo defaults read /Library/Preferences/com.apple.AppleFileServer | grep kerberosPrincipal

Tony

Reply

Answer 2

Morris Zwick Author

Level 1

6 points

Mar 14, 2011 4:07 PM in response to Antonio Rocco

Thanks for responding so quickly:

kerberosPrincipal = afpserver;

Reply

Answer 3

Mar 14, 2011 4:16 PM in response to Morris Zwick

Hi

Is that it? Did you mistype it by any chance? It should have returned something like this:

kerberosPrincipal = "afpserver/yourserver.yourdomain.com@YOURSERVER.YOURDOMAIN.COM";

Tony

Reply

Answer 4

Morris Zwick Author

Level 1

6 points

Mar 14, 2011 4:20 PM in response to Antonio Rocco

Nope, that was it...

How it looks directly in the plist file:

<key>kerberosPrincipal</key>
<string>afpserver</string>

I assumed that this service is automatically kerberized when initialized after OD is set up. But I am guessing that didn't happen. How does one fix this?

Reply

Answer 5

Mar 14, 2011 4:39 PM in response to Morris Zwick

Morris

It should have been but sometimes AFP has a mind of its own. You generally see this when the AFP Service was started prior to promotion from Standalone to OD Master. Not that it makes any difference but for your future reference and as a general 'rule of thumb', never use the Server Setup Assistant to configure anything other than the default admin account, the network settings and the desired hostname. After that always DNS before anything else. Thoroughly test it before moving onto OD (if you want it) and whatever you want from the rest of the stack afterwards.

To hopefully 'fix' the problem stop the AFP Service:

sudo serveradmin stop afp

Restart the Server. On successful log in restart the Service again:

sudo serveradmin start afp

Run the defaults command again and see if anything has changed. If that does not fix it, stop the AFP service again and try editing the file itself:

sudo nano /Library/Preferences/com.apple.AppleFileServer.plist

scroll down to the kerberosPrincipal entry and amend it as the example given. Obviously use your domain details. Save the changes with control+o followed with a 'y' and exit the terminal editor with control+x. Restart the Server again, log in, launch Terminal and restart the AFP Service again using the command already given. You could use Server Admin if you want but it's usually quicker if you do this with the command line. It's your choice. Run the defaults command again and verify it lists the correct Kerberos Principal and finally test from a client workstation.

Tony

Reply

Answer 6

Morris Zwick Author

Level 1

6 points

Mar 14, 2011 5:15 PM in response to Antonio Rocco

Thanks!

Direct edit was the solution to the problem. Woo hoo!

Reply