I work for a small company where there's no dedicated system admin. I was tasked with upgrading our file and calendar server to 10.8, which I did by upgrading the OS then installing the server tools from the app store (as recommended by Apple).
Kerberos is not working properly. The server has a bunch of network users stored in Open Directory. When I try to screen share the server, which uses Kerberos behind the scenes to authenticate, I get informed of an invalid password.
Initially it was failing at
Got a canonicalize request for a LKDC realm from local-ipc, and stating it could not find a LKDC realm. I followed these instructions to regenerate the LKDC on the server:
- Repeat sudo rm -rf /var/db/krb5kdc
- sudo rm -rf /etc/krb5.keytab
- Open Keychain Access and search for 'kdc' then deleting the 3 com.apple.kerberos.kdc items.
- Run the command to reinstall the LKDC sudo /usr/libexec/configureLocalKDC this is non-destructive so can be rerun without upsetting anything.
- Re Bind the client to the server.
After that, the system log states this when I try and log in to screen sharing from another Mac:
kdc: AS-REQ amy@LKDC:SHA1.3489A33F133BAF273138432326E52616444378EA from fe80::cabc:c8ff:fec5:4b93%en0:53175 for krbtgt/LKDC:SHA1.3489A33F133BAF273138432326E52616444378EA@LKDC:SHA1.3489A33F133BAF273138432326E52616444378EA kdc: UNKNOWN -- amy@LKDC:SHA1.3489A33F133BAF273138432326E52616444378EA: no such entry found in hdb screensharingd: Authentication: FAILED :: User Name: amy :: Viewer Address: 192.168.1.44 :: Type: DH
The following is in the opendirectoryd log, which looks suspicious:
38.938 - Client: opendirectoryd, UID: 0, EUID: 0, GID: 0, EGID: 0 38.938, Module: AppleODClientLDAP - unable to create LDAP connection context - no server specified 38.938 - Client: opendirectoryd, UID: 0, EUID: 0, GID: 0, EGID: 0 38.938, Module: AppleODClientLDAP - unable to open connection to LDAP server - unable to create connection context
Also on startup in the system log, I'm getting
servermgrd: servermgr_accounts: got error 5000 trying to auth to local LDAP node
If I call
kinit in the terminal, it asks for my password and then validates it (it tells me if it is incorrect). At that point I get this log (I've replaced our company domain with OURCOMPANY, but it's getting it right):
kdc: AS-REQ amy@OWL.OURCOMPANY.COM from 127.0.0.1:59175 for krbtgt/OWL.OURCOMPANY.COM@OWL.OURCOMPANY.COM kernel: Sandbox: kcm(690) deny mach-lookup com.apple.networkd kdc: UNKNOWN -- amy@OWL.OURCOMPANY.COM: no such entry found in hdb kinit: krb5_sendto_context is called on main thread, its a blocking api
If I try
kinit now I get:
kinit amy@OWL.OURCOMPANY.COM's Password: kinit: krb5_get_init_creds: Client (amy@OWL.OURCOMPANY.COM) unknown
Can anyone suggest how I get Kerberos, Open Directory and LDAP all talking together again?