I have an Open Directory master on a machine called "minime" (El Capitan, Server 5). I further have a Samba server "tricky", running Ubuntu and a Mac OS X client "wallace".

I want users on wallace to access files on tricky while being authenticated via Kerberos on minime. The users are all Open Directory users, so they should theoretically all get ticket granting tickets from minime when logging in on wallace.

I previously had a working configuration, the only change being that minime was a Raspberry Pi providing Kerberos tickets as well as directory services via OpenLDAP. I have replaced minime with a Mac OS X server.

I am now trying to get that configuration into a working state again but I am running into troubles.

Users from wallace can log in, but cannot access files on tricky. Upon login, they receive a ticket granting ticket. When trying to access files on tricky, a login box appears. Guest access will show the available shares, so Samba is up. However, Finder will not authenticate correctly with the logged in user. When explicitly selecting "connect as" and typing current user name and password, the ticket granting ticket is destroyed and access is not permitted.

I do not see anything logged in the Samba log files. I would be glad for pointers.


I found a solution to this problem. The critical point is that using kadmin on OS X Server is not enough to create a valid service principal that can be exported via keytab and used on a different server.

OS X Server requires the use of the command "krbservicesetup". Even though the manpage states that it can/should only be used for setting up local services, it worked successfully to create a keytab for Samba on a different machine.

See manpage and discussion on Apple's discussion forum here:

Discussion on Apple Forum

Man Page

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.