Kerberos Ticket expired on login

Having exactly the same issue. How can default a kerberos principle and make it persistent after reboot?

Already done. Didn't help!

Hope this helps visualising the problem:

What we want is that the system would default the first ticket upon login which is the correct one.

I'm having the same problem but with afp and can now reliably repeat the creation of the 'wellknown' ticket.

On the client

1. Delete all identities in Ticket views

2. Go to finder and click on my server from a local folder - this will generate the '@WELLKNOWN:COM.APPLE.LKDC' ticket every time.

3. Finder hangs for a few moments and then shows the shared directories (I'm guessing not using kerberos)

I think the issue with afp is to do with using .local rather than the full qualified domain name that the other services are using and this might be a similar problem with iChat.

I was having problems with the mail server and clients authenticating to it but fixed that by clearing out the local KDC (LKDC) on the Client using

1. sudo rm -rf /var/db/krb5kdc

2. sudo rm -rf /etc/krb5.keytab

3. sudo rm -rf /Library/Preferences/edu.mit.Kerberos

4. Bind the Client to the Server again.

I have the server running Mail, Calendar and Contact, and watching the ticket viewer Contacts is very reliable at creating the correct tickets when I start it.

Have you tried setting the correct ticket as 'default' using the button in ticket viewer or deleting all the identities and adding the correct ticket directly in ticket viewer then making it default? This might help with the reset on re-login.

For reference both the client and server are running 10.8 and were upgraded from 10.7.4.

Hope this helps and if I find anything else useful out I'll post it

should make no difference if you can make it to work manually under /Library/Preferences then using WGM to push it should do the same job. problem is we can't even get the manual thing to make a difference. this local KDC just keeps coming back whatever i tried.

i've tried to set the correct ticket as a default manually in the Ticket Viewer but didn't survive a logout.

Rambling Man wrote:

I was having problems with the mail server and clients authenticating to it but fixed that by clearing out the local KDC (LKDC) on the Client using

1. sudo rm -rf /var/db/krb5kdc

2. sudo rm -rf /etc/krb5.keytab

3. sudo rm -rf /Library/Preferences/edu.mit.Kerberos

4. Bind the Client to the Server again.

Just wanted to update the discussion on the LKDC element of my post.

I don't believe the LKDC is having any impact on the problem and have reset it by.

1. Ensuring the existing LKDC data is removed
   1. Repeatsudo rm -rf /var/db/krb5kdc
   2. Repeat sudo rm -rf /etc/krb5.keytab
   3. Open Keychain Access and search for 'kdc' then deleting the 3 com.apple.kerberos.kdc items.
2. Run the command to reinstall the LKDC sudo /usr/libexec/configureLocalKDC this is non-destructive so can be rerun without upsetting anything.
3. Re Bind the client to the server.

This will reset the LKDC, I tested it by sharing the screen of my server and looked for the long LKDC ticket to appear in Ticket View which it did.

After logging in I just made a

kdestroy

on the command line.

That destroyd the "WELLKNOWN ..."-Ticket.

Then looking up the Credentials Cache with

klist

showed the correct krbtgt an realm.

Unfortunately I have to to this procedure every time I log in.

here 10.7.4 upgraded to 10.8.1.

using mac mini server, dual ethernet, dual domain, portable homes.

users cant login. There is a window saying that due to an error unable to login.

'@WELLKNOWN:COM.APPLE.LKDC' ticket every time.

users that has been before 10.8 upgrade portable home user can login.

But when desktop opens, the cube transiotion throws u back to login screen. (endless loop, after password) The only way to get "logged" to a staying desktop, was to unbind and login.

i think the afp realm is pointing to the other domain, not sure ..

Same thing here: The the default principal is not persistent.

What I'm doing as a workaround is the following: I wrote a script named "kswitch.command" that is supposed to be executed when the user log's in.

#!/bin/bash

# switch default principal.
# Providing the username seems to be sufficent and uses the "real" realm.
kswitch -p $(whoami)

I put it in the Network-Home-Share /Users/Shared/Scripts and configured it as Login-Item via WGM. There migth be a better solution, but at least it works for me.