I have a Mac OS 10.7 server, and a number of 10.6.8 clients in a school. For the last year and half, network accounts could log into the clients with no problem. There is a set of presets in Workgroup Manager for correct default Group (staff vs students), home directory path, etc.

Since about May, all new accounts cannot log into the 10.6.8 clients. Old accounts (created pre-May) still can, and not just with cached credentials (clients wiped and restored). An OS 10.7.4 client CAN log in with the new account, just not the 10.6.8 ones.

I have checked all of the usual subjects (DNS issues, path issues, file permissions) and the logs - nothing. I can connect to shares using the new accounts (Connect As...), just simply cannot log in.

Anyone have any idea? I have pretty much exhausted what I can think of. I do find it interesting that we started having issues at the same time as the 10.7.4 update.


The first thing that comes to mind is service access lists -- if the new accounts aren't allowed to use the AFP service, they can't mount their home directories, and hence cannot log in. You implied you'd checked with with Connect As, but just to be sure please check this in Server.app -> Users -> Right-click a user and select Edit Access to Services. For more control, install the appropriate version of the Server Admin Tools, and use Server Admin -> server name in sidebar -> Access tab -> Services subtab.

Another possibility is that something has gone sideways in the kerberos setup. Compare what appears in the KDC log (/var/log/krb5kdc/kdc.log) in a successful vs. failed login, and maybe also the password server log (/Library/Logs/PasswordService/ApplePasswordServer.Server.log). Also compare user records in Directory Utility (/System/Library/CoreServices/Directory Utility.app) -> Directory Editor -> Viewing: Users in node: /LDAPv3/; pay special attention to the AltSecurityIdentities, AuthenticationAuthority, HomeDirectory, and NFSHomeDirectory attributes.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.