Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In a Mac OS X Server (10.5.7) environment - I've got a user with a Network Home on the server that cannot log in from any of our client Macs.

They cannot even log in locally to the server where their home folder is located. Other users in the directory domain can log in. I've tried changing the password using WGM and making sure access account is available for the user.

Any thoughts?

share|improve this question
Does it give you a specific error or just "shakes" the loginwindow saying you entered something invalid? – Chealion Jun 11 '09 at 23:46
Sadly only a "shake." Haven't looked at the logs though I'll do that now and report if there's anything related... – Meltemi Jun 12 '09 at 15:40
Ya...not a peep from /var/log/system.log. Lemme know if I should be tail(ing) a different one... – Meltemi Jun 12 '09 at 15:46

This is almost definitely an Open Directory authentication issue. Problems with mounting network home directories generally produce an error dialog after login has been successful and the dock and desktop have appeared. A shaking login window means PasswordServer didn't authenticate the user.

Here are some things to try:

Global Open Directory Policies - Look in Server -> Open Directory -> Settings -> Policy. Is the account violating any of these policies?

User Open Directory Policies - Look in Workgroup -> Select the user -> Advanced -> Options. Anything in there that explains why they can't authenticate?

Password Server Log - The log you should be watching while the user attempts to log in is /Library/Logs/PasswordService/ApplePasswordServer.Server.log.

Other Authentication Methods - You could try to isolate the issue by having the user attempt to connect to some other service. You could have them connect to AFP from some other computer that is already logged in. Or on the server, you could log in as an admin user and then type kinit <username> in the terminal. See if it accepts the user's password there.

Look inside PasswordServer DB - As the admin user on your Open Directory master, do sudo mkpassdb -dump and find the user in question. Find the hexidecimal slot ID, and then do sudo mkpassdb -dump 0x42f0a7b01234758e00220189001231ff. Look closely under the Access Features to see if anything is amiss.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.