antoinell

Q: Cannot authenticate in Directory Utility

I have just upgraded to Mac OS X El Capitan a Mac Mini and installed the new version of Mac OS X Server.

I am trying to logon to Directory Utility.

I click on the lock and a popup appears saying : Enter name and password for node /LDAPv3/127.0.0.1

I choose as user "Directory Administrator" and type a password.

I am getting a popup saying "failed to connect a copy of connection (5000)"

 

/var/log/slapd.log contains this message :

May 25 01:46:45 agilebuild slapd[14799]: SASL [conn=2173] Failure: client evidence does not match what we calculated. Probably a password error

 

/var/log/accountpolicy.log has this :

May 25 01:46:45 (14799.31.2) AuthenticationAllowed completed: record "diradmin", result: Success (0).

 

 

I would be thankful for insight into what is going wrong and ideas how to fix it.

Posted on May 24, 2016 11:02 PM

Close

Q: Cannot authenticate in Directory Utility

  • All replies
  • Helpful answers

  • by antoinell,

    antoinell antoinell May 25, 2016 3:52 AM in response to antoinell
    Level 1 (4 points)
    Servers Enterprise
    May 25, 2016 3:52 AM in response to antoinell

    The Mac mini has OS X El Capitan 10.11.5 with Server 5.1.5. The Mac Mini also runs email but the acccess to my email account using Mail 9.3 in OS X El Capitan fails on password authentication. Similarly I cannot authenticate for wiki. I have tried resetting my password as well as diradmin using ldapapdmin based on this document OS X Server: How to reset the Open Directory administrator password - Apple Support.

     

    When I try to authenticate from the wiki authentication dialog, the /var/log/system.log contains these messages :

     

    May 25 06:46:19 agilebuild slapconfig[26100]: 2016-05-25 10:46:19 +0000 CopyPrimaryMaster: Could not locate PrimaryMaster key

    May 25 06:46:19 agilebuild servermgr_dirserv[17975]: Unable to convert OD tree from PrimaryMaster to a property list: Error Domain=NSCocoaErrorDomain Code=3840 "Unexpected character 2 at line 1" UserInfo={NSDebugDescription=Unexpected character 2 at line 1, kCFPropertyListOldStyleParsingError=Error Domain=NSCocoaErrorDomain Code=3840 "Unexpected ';' or '=' after key at line 1" UserInfo={NSDebugDescription=Unexpected ';' or '=' after key at line 1}}

    May 25 06:46:38 agilebuild collabd[25983]: [CSAuthService.m:334 2a0000 +158ms] Digest did not validate; clientIP=fe80::da30:62ff:fe4b:1ca9 May 25 06:46:38 agilebuild collabd[25983]: [CSServiceDispatcher.m:261 2a0000 +0ms] Caught exception "Invalid Credentials" [CSAuthBadDigest] executing [http]Request{AuthService.validateUsernameAndPasswordDigest:remember:(<>)}:        (                0  CoreFoundation                      0x00007fff944584f2 __exceptionPreprocess + 178                1  libobjc.A.dylib                    0x00007fff8491073c objc_exception_throw + 48                2  CSService                          0x00000001002b83cf -[CSAuthService sessionForDigest:remember:] + 1964                3  CSService                          0x00000001002b7bcb -[CSAuthService validateUsernameAndPasswordDigest:remember:] + 65                4  CoreFoundation                      0x00007fff943c9a6c __invoking___ + 140                5  CoreFoundation                      0x00007fff943c98fe -[NSInvocation invoke] + 286                6  CSService                          0x0000000100239146 -[CSServiceDispatcher executeRequest:asPartOfBatch:usingServiceImpl:] + 4567                7  CSService                          0x0000000100239ccc __43-[CSServiceDispatcher executeBatchRequest:]_block_invoke_3 + 83                8  CSService                          0x000000010023e8cf -[NSArray(CollabBlockMethods) map:] + 249                9  CSService                          0x0000000100239c25 __43-[CSServiceDispatcher executeBatchRequest:]_block_invoke_2 + 160                10  CSService                          0x000000010023efac +[CSExecutionTimer recordTime:ofBlock:] + 76                11  CSService                          0x000000010023ede5 +[CSExecutionTimer timerNamed:aroundBlock:] + 76                12  CSService                          0x0000000100239975 __43-[CSServiceDispatcher executeBatchRequest:]_block_invoke + 323                13  PostgreSQLClient                    0x0000000100192ea2 -[PGCConnection transactionInBlock:onError:] + 157                14  CSService                          0x00000001002397ab -[CSServiceDispatcher executeBatchRequest:] + 277                15  CSService                          0x00000001002ac292 +[CSServiceDispatchHTTPRouter routeServiceRequest:response:] + 594                16  CSService                          0x000000010023f822 __21-[CSServiceBase init]_block_invoke_6 + 48                17  CSService                          0x00000001002a98ef __53-[CSRoutingHTTPConnection httpResponseForMethod:URI:]_block_invoke + 110                18  CSService                          0x00000001002ac800 -[CSHTTPBackgroundResponse bounce:] + 284                19  Foundation                          0x00007fff96017e64 __NSThread__start__ + 1351                20  libsystem_pthread.dylib            0x00007fff89f4399d _pthread_body + 131                21  libsystem_pthread.dylib            0x00007fff89f4391a _pthread_body + 0                22  libsystem_pthread.dylib            0x00007fff89f41351 thread_start + 13        ) May 25 06:46:38 agilebuild mds[76]: (DiskStore.Warning:127) Failed messaging flag writer M

     

    No idea what is going on here.

  • by ablayne,

    ablayne ablayne May 25, 2016 6:03 AM in response to antoinell
    Level 1 (4 points)
    May 25, 2016 6:03 AM in response to antoinell

    So I have some bad news. This looks rather reminiscent of a server I was working with a couple of years ago, where (I honestly don't know how this happened) two simultaneous sessions of Active Directory were running at the same time. When trying to authenticate to a session, it would check against the other and I would be rejected with a "wrong authorization". Apple was stumped on how this even managed to happen.

    You have a few solutions dependent on your situation. Do you have a backup from before it started rejecting you?

    Can you wipe the server and start again? With a clean install of El Capitan instead of an upgrade? Did you previously have a different version of server software and install Apple Server on top of the remains of an old one?

    If you can wipe the HD and start over, I would start afresh and build up from scratch.

  • by Linc Davis,

    Linc Davis Linc Davis May 25, 2016 7:44 AM in response to antoinell
    Level 10 (207,926 points)
    Applications
    May 25, 2016 7:44 AM in response to antoinell

    Many Open Directory problems can be resolved by taking the following steps. Please test after each one that you haven't already taken, and back up all data before making any changes.

    1. The OD master must have a static IP address on the local network, not a dynamic address. It must not be connected to the same network with more than one interface; e.g., Ethernet and Wi-Fi.

    2. You must have a working DNS service, and the server's hostname must match its fully-qualified domain name. To confirm, select the server by name in the sidebar of the Server application window, then select the Overview tab. Click the Edit button on the Host Name line. On the Accessing your Server sheet, Domain Name should be selected. Change the Host Name, if necessary. The server must have at least a three-level name (e.g. "server.yourdomain.com"), and the name must not be in the ".local" top-level domain, which is reserved for Bonjour.

    3. The primary DNS server used by the server must be itself, unless you're using another server for internal DNS. The only DNS server set on the clients should be the internal one, which they should get from DHCP if applicable.

    4. If you have accounts with network home directories, make sure the URL's are correct in the user settings. A return status of 45 from the authorizationhost daemon in the log may mean that the URL for mounting the home directory was not updated after a change in the hostname or in the file-sharing protocol (from AFP to SMB or vice versa.) If the server and clients are all running OS X 10.10 or later, directories should be shared with SMB rather than AFP.

    5. Follow these instructions to rebuild the Kerberos configuration on the server.

    6. If you use authenticated binding, check the validity of the master's certificate. The common name must match the hostname and domain name. Deselecting and then reselecting the certificate in Server.app has been reported to have an effect in some cases. Otherwise delete all certificates and create new ones.

    In the case of a self-signed certificate, create a trust profile in Profile Manager and deploy it on the clients. On the server, you may need to create the folder

    /etc/openldap/certs

    and put a copy of the server's certificate in it; for example:

    /etc/openldap/certs/server-name

    Also add a directive to the file

    /etc/openldap/ldap.conf

    of the form

    TLS_CACERT /etc/openldap/certs/server-name

    7. Unbind and then rebind the clients in the Users & Groups preference pane. Use the fully-qualified domain name of the master.

    8. Reboot the master and the clients.

    9. Don't log in to the server with a network user's account.

    10. Disable any internal firewalls in use, including third-party "security" software.

    11. If you've created any replica servers, delete them.

    12. If OD has only recently stopped working when it was working before, you may be able to restore it from the automatic backup in /var/db/backups, or from a Time Machine snapshot of that backup.

    13. If there are slapd errors in the log, try the following steps.

    Turn off Open Directory in the Server app.

    Enter in a shell:

    cd /var/db/openldap
    sudo -s
    db_recover -c -h authdata
    db_recover -c -h openldap-data

    Turn Open Directory back on.

    14. Reset the password policy database:

    sudo pwpolicy -clearaccountpolicies

    15. As a last resort, export all OD users. In the Open Directory pane of Server, delete the OD server. In some cases, you may have to use the shell to delete the server. Then recreate it and import the users. Ensure that the UID's are in the 1001+ range.

  • by antoinell,

    antoinell antoinell May 26, 2016 7:19 PM in response to Linc Davis
    Level 1 (4 points)
    Servers Enterprise
    May 26, 2016 7:19 PM in response to Linc Davis

    Thanks Linc for the explanation. I went through all this steps. There is a small improvement that I do not get the error popup any more saying "failed to connect a copy of connection (5000)" when I enter a user and a password at a prompt for a directory administatror password.

    But I cannot login to open directory to perform changes to network users, such as resetting their password.


    My slapd.log contains this :


    May 26 21:53:57 ilantoutseul slapd[1490]: odusers_copy_enabledmechs: could not locate cn=dirserv,cn=config,dc=ilantoutseul,dc=agilebuild,dc=com

    May 26 22:07:43 ilantoutseul slapd[1490]: SASL [conn=1185] Failure: client evidence does not match what we calculated. Probably a password error

     

    Does it mattern that this cn=dirserv does not exist ? Is it just a warning ?

     

    My slapd is not corrupt, it is just that I cannot use any of my network users because the passwords do not work.

     

    Thanks in advance again,

     

    Antoine

  • by antoinell,

    antoinell antoinell May 26, 2016 8:01 PM in response to antoinell
    Level 1 (4 points)
    Servers Enterprise
    May 26, 2016 8:01 PM in response to antoinell

    My other question is :

    Does this OS X Server: How to reset the Open Directory administrator password - Apple Support article apply to my server running Mac OS X El Capitan and Server 5.1.5 ? I had tried to use the information here to reset the password for this diradmin to something known. I see a strange looking password KioqKioqKio= when I do a ldapquery and I look at the entry

    dn: uid=diradmin,cn=users,dc=ilantoutseul,dc=agilebuild,dc=com

  • by antoinell,

    antoinell antoinell May 26, 2016 9:35 PM in response to antoinell
    Level 1 (4 points)
    Servers Enterprise
    May 26, 2016 9:35 PM in response to antoinell

    When I try to change the diradmin password with ldappasswd, the following shows up in the slapd.log :

     

    May 27 00:30:54 ilantoutseul slapd[4507]: odusers_copy_enabledmechs: could not locate cn=dirserv,cn=config,dc=ilantoutseul,dc=agilebuild,dc=com

    May 27 00:30:54 ilantoutseul slapd[4507]: odusers_set_password: Could not find enabled mech list

    May 27 00:30:54 ilantoutseul slapd[4507]: odusers_accountpolicy_updatedata: set password for user uid=diradmin,cn=users,dc=ilantoutseul,dc=agilebuild,dc=com failed

    May 27 00:30:54 ilantoutseul slapd[4507]: passwd_extop: (null) changed password for uid=diradmin,cn=users,dc=ilantoutseul,dc=agilebuild,dc=com

     

    I am sure the developers of slapd should understand all this.

     

    Best,

     

    Antoine

  • by Linc Davis,

    Linc Davis Linc Davis May 27, 2016 9:03 PM in response to antoinell
    Level 10 (207,926 points)
    Applications
    May 27, 2016 9:03 PM in response to antoinell

    Enter name and password for node /LDAPv3/127.0.0.1

    That should not be the node address. The node address should be the FQDN of the server. It sounds like your DNS setup is wrong.

  • by antoinell,

    antoinell antoinell Jun 1, 2016 12:59 AM in response to Linc Davis
    Level 1 (4 points)
    Servers Enterprise
    Jun 1, 2016 12:59 AM in response to Linc Davis

    I would like to thank Linc Davis and ablayne.

    My Mac Mini running OS X El Capitan and Server is  now nearly fully operational again.

    I followed this post Re: How to rebuild OpenDirectory databases / replica agreements etc? from Jolin Warren about how to rebuild Open Directory. Open Directory restarted spontaneously before I was able to finish the complete process. The slapd then died immediately.

    I then overwrote the /var/db/openldap/openldap-data/ and /var/db/openldap/openldap-data/ and /var/db/openldap/authdata from a backup. At this point it became possitble to restart slapd successfully.

    At this point local users were present in the system, but my network users - or at least my own user - was absent. I realized I was then able to recreate my user manually. Then I realized that my manually recreated user had a different GUID, so I used the import function to overwrite it. I was able to reset the password of my user.

    It ifrustrating that it took so long to get back in business. I think I spent some 10 hours on this OS upgrade, and I still have SSL certificate errors reported in mail-info.log. Maybe I should be using debian instead of Mac OS X or get out of the business of running my own server. The frustrating aspect is to work by Google searches on systems that one is far from understanding fully. For instance I see that there are different log files under /Library/Server/Mail/log such as mail-info.log, mail-err.log, amavis.log, clamav.log but I do not know which process is generating which log and which is the function of the process in the mail ecosystem. Is this documented somewhere ?