Apple Event: May 7th at 7 am PT

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Level 2

384 points

Mavericks Server Keychain not properly storing information network users.

OS 10.9.1, Server 3.0.2. Clients OS 10.9.1 bound to server Open Directory and managed with Profile Manager. 10.6.8 Mail server bound to 10.9.1 server Open Directory. Messages is running on the 10.9.1 server which hosts the users.

Changeip -checkhostname indicates DNS is correct for the server. Server is running on a FQDN, no .local or other DNS issues.

For everything below: the Keychain for any of the users does not need to be repaired.

Generally things are going well with one exception which is a big problem.

Each time a network user logs and tries to use either Mail to connect to our mail server via IMAP or Messages in they are prompted for passwords. Messages takes the password and logs in. Mail acts as though the password was incorrect and asks for it again, it does not pass the connection to the mail server. There is no trace of the attempted login on the mail server logs.

Functional workarounds:

1 - OS reinstall allows immediate login on the mail server and connections as expected. This is a little too much for day to day use.

2 - (From somewhere in the forums forgot who, sorry), User login, go to User's network home/Library/Keychains and move any keychains with long strings of letters and numbers as name to another folder or put in trash, immediately reboot, User login again, enter passwords in Mail, immediate connection to mail server and expected behavior from Mail.app.

As a network user machine in a multi user environment, the next user will have to repeat the entire procedure above, including the reboot, to get access to the contents of the mail server. The first user in the example above will have to repeat it, if they come back to the same machine and log in again.

This is what we are doing now. It appears that it would work on a personal machine with local users and has solved a lot of issues in the forum. It is helping but does not solve the keychain problem for network users.

Does anyone have any advice.

Thanks.

-Erich

OS X Server

Posted on Jan 10, 2014 6:34 PM

Best reply

John Lockwood

Level 6

13,685 points

Posted on Jan 28, 2017 12:32 PM

It is our experience that it is still problem, in fact several different problems. 😟

Whilst there are many issues two of the major ones are -

The 'new' local items keychain used for Apple programs passwords e.g. Mail, Contacts, etc. is stored in a per machine specific folder rendering it unusable for hot-desking
Each new version of OS X has increased the use of SQLite databases to store settings and data and when used over a network as with network home directories these either get corrupted or locked so they cannot be used making programs like Mail, Contacts, and even Safari unusable, recent new uses include local items keychain itself and the new suggestions database for spotlight and looking up contacts and calendar entries in emails etc.

While I am still in the processing of reporting these issues to Apple especially the new SQLite problems I am in the process of changing all our users and giving up on network home directories. 😟

View in context

278 replies

Feb 11, 2014 3:33 PM in response to Erich Wetzel

Has anyone found a solution for this? I don't understand how there are not more people experiencing this issue. Surely it is a global with OD and Network login?

Feb 12, 2014 2:52 AM in response to robertoraskovsky

I have this problems to, this is surely a global Mail/Calendar/Contacts/InternetAccounts problem.

I postet the Bug to Apple lets see and hope for 10.9.2...

Feb 12, 2014 3:30 AM in response to Benjamin Losch

How have you got around the issue for now? Local users?

Feb 12, 2014 4:06 AM in response to robertoraskovsky

Using Thunderbird until then...

Mar 1, 2014 8:12 AM in response to Benjamin Losch

Have you found a way to deploy managed preferences for thunderbird?

elmojnr

Level 1

5 points

Mar 6, 2014 6:51 PM in response to Erich Wetzel

Hey Erich,

Same issue here. It breaks for Mail, Calendars, Messanger and Contacts. Actually anything that needs to autheicate with the OD.

Any joy from anyone on a proper fix? The Reboot machine kinda gets tiring 🙂

Mar 6, 2014 7:23 PM in response to elmojnr

I've been able to use profile manager to deliver a payload that works for messages. Have not tried calendars and contacts.

I could not get anything working for mail. Instead, i'm using an app called postbox which is working just fine with network users and no loss of passwords.

elmojnr

Level 1

5 points

Mar 8, 2014 12:21 AM in response to ajm_from_WA

It seems to be around the Keychain that the problem is. Only reason is that none of my website passwords are saved either. 😟

I'm not ready to commit to a new mail program yet but thats for the suggestions of postbox.

Apr 30, 2014 8:23 PM in response to Benjamin Losch

10.9.2 has the same issue for me. Only a reboot of the clients after user logs out allows the next user to login and enter their mail password (and sometimes iCloud password) and then mail works. But this is really disappointing for Apple to leave the Network Home User community high-and-dry?!?

Apr 30, 2014 8:38 PM in response to ziondotcom

Postbox. Just use postbox. I've had no troubles since changing to postbox.

May 7, 2014 10:09 PM in response to Erich Wetzel

Same problem here. 70 users and it is a disaster. Ever wondered, what's the problem. Maybe 10.9.3 does anything. If someone has a workaround, except rebooting all the time, please post it. Enterprise support, please help. This is a major issue in Server! Am using 10.9.2 and 3.1.1.

May 8, 2014 1:46 PM in response to Sebastian Johannsen

Call Apple Enterprise Support and open a ticket. Otherwise they won't know you are affected. Forums don't count. This is ridiculous though...

Erich Wetzel Author

Level 2

384 points

May 8, 2014 2:25 PM in response to Erich Wetzel

Alternately or additionally submit a bug report https://bugreport.apple.com. I have been submitting reports on this by way of Appleseed since the release of 10.9. I suppose that a larger volume of submissions will draw more attention.

May 8, 2014 2:37 PM in response to Erich Wetzel

I have just submitted a bug report. If everyone else who encounters this problem can do the same, mayb Apple will listen and fix this frustrating problem!! It's rediculous!

May 13, 2014 5:16 AM in response to ziondotcom

Thanks for the advise. Done.

The support was excellent. We had gone through all the trouble and made several reports, which then had been uploaded to Apple. The support is coming back to me this week. I will let you know, what they found.

The problem is acutally well known at Apple and should have been fixed already in 3.0.1.

Mavericks Server Keychain not properly storing information network users.