You can make a difference in the Apple Support Community!

When you sign up with your Apple Account, you can provide valuable feedback to other community members by upvoting helpful replies and User Tips.

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Mavericks Server Keychain not properly storing information network users.

OS 10.9.1, Server 3.0.2. Clients OS 10.9.1 bound to server Open Directory and managed with Profile Manager. 10.6.8 Mail server bound to 10.9.1 server Open Directory. Messages is running on the 10.9.1 server which hosts the users.


Changeip -checkhostname indicates DNS is correct for the server. Server is running on a FQDN, no .local or other DNS issues.


For everything below: the Keychain for any of the users does not need to be repaired.


Generally things are going well with one exception which is a big problem.


Each time a network user logs and tries to use either Mail to connect to our mail server via IMAP or Messages in they are prompted for passwords. Messages takes the password and logs in. Mail acts as though the password was incorrect and asks for it again, it does not pass the connection to the mail server. There is no trace of the attempted login on the mail server logs.


Functional workarounds:


1 - OS reinstall allows immediate login on the mail server and connections as expected. This is a little too much for day to day use.


2 - (From somewhere in the forums forgot who, sorry), User login, go to User's network home/Library/Keychains and move any keychains with long strings of letters and numbers as name to another folder or put in trash, immediately reboot, User login again, enter passwords in Mail, immediate connection to mail server and expected behavior from Mail.app.


As a network user machine in a multi user environment, the next user will have to repeat the entire procedure above, including the reboot, to get access to the contents of the mail server. The first user in the example above will have to repeat it, if they come back to the same machine and log in again.


This is what we are doing now. It appears that it would work on a personal machine with local users and has solved a lot of issues in the forum. It is helping but does not solve the keychain problem for network users.


Does anyone have any advice.


Thanks.


-Erich

OS X Server

Posted on Jan 10, 2014 6:34 PM

Reply
Question marked as Top-ranking reply

Posted on Jan 28, 2017 12:32 PM

It is our experience that it is still problem, in fact several different problems. 😟


Whilst there are many issues two of the major ones are -


  1. The 'new' local items keychain used for Apple programs passwords e.g. Mail, Contacts, etc. is stored in a per machine specific folder rendering it unusable for hot-desking
  2. Each new version of OS X has increased the use of SQLite databases to store settings and data and when used over a network as with network home directories these either get corrupted or locked so they cannot be used making programs like Mail, Contacts, and even Safari unusable, recent new uses include local items keychain itself and the new suggestions database for spotlight and looking up contacts and calendar entries in emails etc.


While I am still in the processing of reporting these issues to Apple especially the new SQLite problems I am in the process of changing all our users and giving up on network home directories. 😟

278 replies

Jun 21, 2016 11:56 AM in response to Gerard Dirks

This is not just a non-english configuration issue. I'm in Indiana in the US and have the same problem. This is definitely an OS thing. I really think Apple is trying to push users out of a Mac server-client environment and just wants to have their devices used for entertainment purposes. Apple seems to have no interest in their devices being used for productivity anymore. We can all just sit back and watch their market share wane as people move to Windows and Linux environments. Sad.

Jun 21, 2016 4:29 PM in response to EOC Admin

Like i said in my last post, we are already looking at Windows 2012R2 and Exchange for all our 700+ users in our school. I don't think Apple will ever fix this issue, as this is not where their main money cow is, very unfortunate.


We have all come up with workarounds, why cannot a company that has billions of dollars come up with decent engineering and development, or heard of a saying "if it ain't broke, don't try to fix it"?


It is coming to an end of our school year, so we will be reinstalling the 120 machines, this now means an extra job in saving all users redirected keychain folders and then moving them back again.


Whatever....

Jun 22, 2016 11:20 PM in response to John Agapitos

Hello John!


Apple did not react on bug reports, they did not react on discussions, they did not respond to feedbacks!


After one and a half year they start removing items because of NDA - that´s all.


Think about any other way to make you heard - if you have the possibility tell it to some tech journalist - maybe they are strong enough to stand against the stupidity of Apples bug management.


I gave up.


Bye,

Christoph


P.S. If Apple want to go the mass-market way - no problem, they should tell us, so we can make right decisions for our business.

Jun 22, 2016 11:39 PM in response to Christoph Ewering1

Hello Christoph


As you maybe know this is called in the German Areas as "Salami-Taktik". Their are no clean statements. You need to analyse their behaviour and then the conclusion would be the same as you write. Apple want to leave the Corporate Market, and sell only Gadgets like iPhones, iPads, iPhones and maybe a Electric Car


As you see how long it take before they bring new iMacs, Macminis, MacBooks Pro. That is not the market for them. At the WWDC they rename OS X to MacOS, next year they probable rename it again to iOS and then you know which device will run with it.


Very nice that Management Based US Companies doesn't learn from mistakes in the past. The only difference with 1992-1997 will be that they have now plenty money in their "petty cash"


Gérard

Jul 18, 2016 9:55 AM in response to John Agapitos

Hello


I am still debugging. I have 2 questions to the followers of this thread?

1) What is default path for the NetworkUser Directories? a) /Users/ or b) e.g. /HomeFolders/ both on the root of the boot volume.

2) Is someone using the Program "Passengers" to reset the permissions? (http://macinmind.com/?area=app&app=passenger&pg=info)


Regards

Gérard

Jul 18, 2016 1:22 PM in response to Gerard Dirks

Gerard Dirks wrote:


My question is if this users folder is the default /Users/ on the root of the boot volume of OS X or have you define an new User Sharepoint like /HomeFolders/


And I answered that.


On the Mac server a folder or volume is shared and marked as a special type of share to be used for network home directories. This then gets mounted automatically by client Macs as /Network/Servers/server.domain.com/Volumes/Users/ when a network user logins in to that client Mac. If a network user with a shortname of jsmith logs in then their home directory would be


/Network/Servers/server.domain.com/Volumes/Users/jsmith


The usual shortcut for a users home directory of ~/ still works if you want to use that.


Note: server.domain.com will be whatever is appropriate for your server, and the /Users at the end will be the name of the folder or volume shared by that server. It does not have to be Users but that is a common choice.

Jul 18, 2016 1:48 PM in response to John Lockwood

I feel that you don't understand me!


It is clear that the networkuser will be redirected to the SharedPoint definied in the Server.app. I want to know where it es physicaly on the mac

(Macintosh HD/Users/). I would like to know if the problem also occurred if the HomeDirectories is defined as e.g. (Macintosh HD/HomeFolders/) or another Volume used for storing the HomeDirectories!

Jul 18, 2016 2:28 PM in response to Gerard Dirks

With network logins and network home directories the users home directory is never stored on the local client Mac. It is stored on the server. The network login accesses it by logging in to their client Mac which triggers the mounting of the network share from the server. This share is as I have repeatedly explained is mounted in /Network/Servers/server.domain.com/Volumes/Users/


It is not repeat not stored on the client Mac. Nor is it copied to the client Mac.


If one can describe something which is not stored on the client Mac as having a location then once again as I have already explained it is in /Network/Servers/insert-name-of-your-server/Volumes/insert-name-of-share/


This is not normally visible in the Finder but can be navigated to via Terminal.app and typing -


cd /Network/Servers/insert-name-of-your-server/Volumes/insert-name-of-share/


Normal network shares would be in /Volumes again not a location normally visible in the Finder. However network home directory shares are special shares and get mounted in the location I keep telling you.

Jul 18, 2016 3:09 PM in response to Gerard Dirks

I did answer what happens on the server as well.


To repeat, you can select any folder or an entire dedicated volume and tell Server.app to share it. You then edit the settings of that share in Server.app and enable the option to use it for holding network home directories. The folder or volume you share can be called anything. Some people advise not sharing the entire volume of e.g. an external drive but instead to share a folder on the external volume. I would agree this can in the longer run be a better option.


As an example I have an external drive connected to my server. I have shared a folder called Users on that drive via Server.app and enabled the option to use it for network home directories.


You also use Server.app to set user accounts to use that share as the location for home directories. It is possible to have two or more volumes and therefore shared folders and allocate some users to one and some to the other.

Jul 18, 2016 3:41 PM in response to Gerard Dirks

/Users (on the boot drive) is for user accounts used on the server itself i.e. the local admin account. It is not impossible but it is not a good idea to use that for network login accounts.


/HomeFolders is not a standard folder it is merely an ordinary folder someone - presumably you has created. It is no better or worse than creating any other folder which you would then share via Server.app and enable for the use of network home directories.


The various keychain problems discussed in this and other threads apply to any folder being shared for network home directories. The name and location is totally irrelevant. (There are actually at least five maybe six different network home directories bugs, none of them are related to the name or location of the shared folder on the server, they are merely down to the fact you are using network home directories.)

Mavericks Server Keychain not properly storing information network users.

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.