10.9 OD - diradmin login
Hi All,
After upgrading to Mavericks, i cant login with the diradmin account so manage the workgroup.
The login information is not valid for this server.
The server failed to accept the login information you provided. Check the Name and Password and try to log in again or contact your network administrator.
All other accounts are working.
I already had this issue on 10.8, there did a reset with the mkpassdb tool. Now it seems, the -setpassword switch is not longer actiive.
usage: [-u username][-m weakmech][-a][-b][-e count][-n replica-name][-o][-p][-q]
-dump [slot-ID]
-header
-getglobalpolicy
-kerberize
-key
-list
-mergedb filepath
-mergeparent filepath omit-file
-rekeydb [key-size-in-bits]
-setadmin slot-ID [admin-class (0-7)]
-setglobalpolicy policies
-setkeyagent slot-ID
-setcomputeraccount slot-ID [off]
Any ideas ?
Thanks
I deleted now the OD Master an restored a new one from the backup archive.
Now i`m able to login with diradmin in workgroup manager.
If i try to change a password from a OD user, i get always a error message:
In order to set the password of a a user with an Open Directory Password, your own password type must be Open Directory. Administrators with other password types cannot set the password of a user with an Open Directory password.
Connecting with a OD user to a AFP share does still not work.
Similar Messages
-
Lion Server network accounts not working on some computers.
Hello all -
I'm currently having an issue with network accounts working on some Macs but not others. I have a Mac Mini and a MacBook Pro. The Mac Mini works fine and I can login and sync my network account with the server just fine. However, I cannot connect to it from my MBP.
When I try and connect I get an error that says "You are unable to log in to the user account "xxxx" at this time. Logging in to the account failed because an error occurred."
If I login through console (by typing in ">console" in the username field) I get an error that says the user does not have a home directory...
I have searched numourous other forums but I have not found a solution that seems to solve this problem. I have unbound and re-bound my client to the open directory and I have restarted file sharing. Neither has solved the problem. I have a feeling the issue originates somewhere on the MBP since I can log in to the Mac Mini without any problems.
Anymore suggestions?Thanks for your suggestion, SolidWood. Unfortunately it didn't help.
After a 90 minute phone call with AppleCare, this issue has finally been resolved. Here is what the solution was. Turns out it was pretty simple but it took a while to find it.
First we created a test user and left the home folder set to Local Only in the Server App. I was successfully able to login with the test user on both clients but since there were no mobility preferences set, it was pretty basic.
Then, we removed the Users sharepoint from file sharing, turned off file sharing to disconnect any users, and restarted the server. Then we created a new folder on the Server HD with a random name. We chose Darron. We created a new sharepoint in file sharing (with it still turned off), and shared the new folder called Darron. Double click on the sharepoint and scroll to the bottom and check the box that says "Make available for home directories over AFP". Then we restarted file sharing.
Then we opened Workgroup Manager, clicked on the problem user in the left sidebar, clicked on the Home option at the top, and there were three things listed:
(None)
afp://servername.com/Users
afp://servername.com/Darron
Then we removed the Darron sharepoint from file sharing, and found that it was still listed as a home directory under the problem user.
This was the root of the problem. The system didn't know which path to use as the home directory.
Sooooo...
In the server app, we opened the Directory Utility (Tools in the menubar, Directory Utility). Clicked on Directory Editor. Authenticate to the directory using the diradmin login. Changed view settings to match this below:
In the left column, there were two paths listed for home mounts. We deleted both of them, saved changes, and closed directory editor.
Then, we restarted workgroup manager and both paths had been deleted from the users home listings. This was begining to solve the problem.
In the Server App, we recreated the users sharepoint, made it available for home directories, and restarted file sharing and workgroup manager. Now only one path is listed for the home folder for all the users.
This solved my problem of not being able to login on the MBP. The system synced the home folder and all was well. On the Mac Mini, I had to delete the problem account, un-bind from the network server, re-bind, and recreate the account. Now both clients are sycning perfectly and all is well.
Thank God I bought AppleCare! Thanks to everyone else for their help and suggestions.
As a recap, the problem of not being able to login to the MacBook Pro was caused by having multiple paths to the multiple home folders. These rogue paths were added somewhere in the troubleshooting process to try and recreate the home directories before I called AppleCare. To solve this, we had to remove the directory listings from accounts using Directory Editor, remove and recreate the users sharepoint in file sharing. The syncing problem on the Mac Mini was also created when multiple paths were introduced. The system didn't know which files to use.
Taylor -
Hello, in a testing environment with a non-networked server (eth0 is on and all other settings and management are working correctly e.g. workgroup manager and server admin) I am interested in practicing setting OS X as a PDC. However, each time I try and establish this setting (SMB), I enter my domain and then attempt to authenticate as my DirAdmin only to receive a could not authenticate message and my settings reverted to previous.
I think I might just be confused on the domain entry - I don't have enough room in the input box for server17.pretendco.com and pretendco.com doesn't work (what I've been using for everything else). Apple Knowledge Base says: "Domain: Enter the name of the Windows domain that the server will host. The domain name cannot exceed 15 characters and cannot be “workgroup.”"
Any direction or sources please?
I've been following the Apple Training Series Server Essentials 10.6 book up to this point, but this configuration is skipped over in the exercises... kind of important to know I feel.Just type PRETENDCO it doesn't want any .coms etc
I believe it must be in CAPS as well although i don't use this facility it is what i seem to recall it should be.
Windows 7 is not supported i believe and Vista may need some tweeking in the security policy.
Also login as diradmin before you try to modify anything as this will prove it is not an account issue with the diradmin login.
When you say non-networked server is a switch or router at least plugged in to your (eth0) as i have found that an OSX server with no network connection of any kind is not a friendly beast. -
Unable to authenticate with diradmin in Workgroup Manager
This has happened before, and I have no idea how it got fixed - too many independent variables...
Anyway, I cannot authenticate the OD with diradmin even while using Workgroup Manager directly on the server.
The setup:
SLS 10.6.8
Split-brained DNS
Both public and private FQDNs are the same (myserver.mydomain.com). External DNS maps machine record to my static public IP address. Using an AirPort Extreme router, port fowarding services that I want open to the server. The router provides DHCP via NAT to the local network, with a fixed private IP assigned to the server. The server is running DNS with the same zones, machine records, services and aliases that the public IP DNS has, except mapped to the fixed private IP. DNS checks out with changeip, etc.
The server is an OD master. Yesterday I exported it, demoted it, and restored it. All services (mail, web, etc.) seem to work fine (although I admit to not using Kerberos on AFP due to another issue).
I have a wildcard certificate that is generated by GoDaddy (*.<mydomain>.com) which seems to work fine with the hosted websites.
This is what the password service error log says when I try to log in with diradmin in Workgroup Manager:
Jan 10 2012 14:01:32 AUTH2: {0x4bbe71ca6b8b45670000000200000002, diradmin} DHX authentication succeeded.
Jan 10 2012 14:01:32 KERBEROS-LOGIN-CHECK: user {0x4bbe71ca6b8b45670000000200000002, diradmin} is in good standing.
Jan 10 2012 14:01:32 KERBEROS-LOGIN-CHECK: user {0x4bbe71ca6b8b45670000000200000002, diradmin} authentication succeeded.
Looks good to me. But I still get the "Information Not Valid for This Server" followed by stuff about invalid login ID or password.
I did notice in the LDAP log:
Jan 10 14:13:12 <myserver> slapd[52283]: SASL [conn=18] Failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Key table entry not found)
And at the last bootup in the directory service error log:
2012-01-10 08:52:03 EST - T[0x00007FFF7027ACC0] - DNSServiceProcessResult returned -65563
The other thing I notice when I log into the library in Workgroup Manager FROM THE SERVER, even if I use the FQDN <myserver>.<mydomain>.com that Workgroup Manager says (in the title bar of the window) <myserver>.local.
I have googled the various errors and messages, and I get folks with all sorts of variations ("change the binding options", etc.) none of which either applied or worked.
Help?Continuing on my quest... I found this Technical note from Apple about re-kerberizing:
http://support.apple.com/kb/HT3655
Interestingly, in step 3 where it says to remove realm information from kdc.conf, there wasn't any of my realm information. Argh!
So I completed all of the steps and executed the slapconfig command. This resulted in:
bash-3.2# slapconfig -kerberize -f --allow_local_realm diradmin <MYREALM>
diradmin's Password:
Could not resolve hostname <MYDOMAIN>
Skipping Kerberos configuration
Sounds like a dreaded DNS problem. It had been working correctly, but changeip -checkhostname confirmed a problem. Turns out that there were EXTERNAL DNS servers in the Network preferences in System Preferences as well as on the router. With my Split-brained DNS this caused problems (thank you again MrHoffman). So I changed them both to my DNS server INTERNAL IP address and added the external ones to the Forwarder IP Address in DNS. Now checkhostname -changeip returns a favorable result.
So after rebooting ran the slapconfig command again and got the same result. Argh. Cleared DNS caches. Still nothing.
So I tried nslookup.
nslookup <mydomain>
Server: 10.0.8.2
Address: 10.0.8.2#53
** server can't find <mydomain>: SERVFAIL
Where 10.0.8.2 is the fixed INTERNAL IP address.
However, nslookup on using the fixed IP address yields:
bash-3.2# nslookup 10.0.8.2
Server: 10.0.8.2
Address: 10.0.8.2#53
2.8.0.10.in-addr.arpa name = <mydomain>.
Scratching head here... changeip -checkhostname works, nslookup on the IP address works, but nslookup on the host name fails. -
Leopard Clients take a Long Time to Login (roughly 1~2 minutes)
Hello all,
I've spent the last few weeks scouring these groups and then net and searching and searching for someone with a similar problem to my own, but have come up pretty much empty handed and so now turn to here to see if any else has had this issue or can at least point me where to look to resolve the problem.
I've got a clean install of a XServe running Leopard server 10.5.2 with OD, AFP services and User home folders configured and fully working.
The problem:
Clean install of Tiger client logs into the server (OD binded) perfectly. Takes maybe 15 seconds tops to for the client to log in and show the all the AFP mounts and client settings and user's desktop and files, etc.
However, a fresh Leopard client install (OD binded) takes roughly 1~2 minutes to do the exact same thing.
I've gone through any log file I can find on server and client side, checked my DNS running on this xserve, created new users without "home" folders, and searched just about everywhere for an answer to this issue and am still empty handed.
This is not a show stopper issue, but there is something definitely not normal about what is happening with Leopard client logins.
I'm trying to explain this as best as I can without making a wall of text, but I'm sure I'll forget something, so please ask questions if you have them.
Things I'm seeing in the logs during the time of the login happening are:
Server-side Logs:
- Kerberos Server Log -
Apr 14 11:27:39 ns1.mydomain.com krb5kdc[167](info): TGS_REQ (7 etypes {18 17 16 23 1 3 2}) 172.16.9.14: ISSUE: authtime 1208190459, etypes {rep=16 tkt=16 ses=16}, [email protected] for ldap/ns1.mydomain.com@NS1. MYDOMAIN.COM
Apr 14 11:28:46 ns1.mydomain.com krb5kdc[167](info): AS_REQ (7 etypes {18 17 16 23 1 3 2}) 172.16.1.205: NEEDED_PREAUTH: CRC0002$@NS1. MYDOMAIN.COM for krbtgt/NS1. MYDOMAIN.COM@NS1. MYDOMAIN.COM, Additional pre-authentication required
- Password Service Server Log -
Apr 14 2008 11:43:03 KERBEROS-LOGIN-CHECK: user {0x47f3ab5903c4b01c0000002a0000002a, CRC0005$} is in good standing.
Apr 14 2008 11:43:03 KERBEROS-LOGIN-CHECK: user {0x47f3ab5903c4b01c0000002a0000002a, CRC0005$} authentication succeeded.
Apr 14 2008 11:43:04 RSAVALIDATE: success.
Apr 14 2008 11:43:04 AUTH2: {0x47c721234c9608250000000700000007, myusername} DIGEST-MD5 authentication succeeded.
Apr 14 2008 11:43:04 RSAVALIDATE: success.
Apr 14 2008 11:43:04 AUTH2: {0x47c721234c9608250000000700000007, myusername} DHX authentication succeeded.
Apr 14 2008 11:43:04 KERBEROS-LOGIN-CHECK: user {0x47c721234c9608250000000700000007, myusername} is in good standing.
Apr 14 2008 11:43:04 KERBEROS-LOGIN-CHECK: user {0x47c721234c9608250000000700000007, myusername} authentication succeeded.
Apr 14 2008 11:43:05 RSAVALIDATE: success.
Apr 14 2008 11:43:05 AUTH2: {0x47c721234c9608250000000700000007, myusername} DHX authentication succeeded.
Apr 14 2008 11:43:06 KERBEROS-LOGIN-CHECK: user {0x47f3ab5903c4b01c0000002a0000002a, CRC0005$} is in good standing.
Apr 14 2008 11:43:06 KERBEROS-LOGIN-CHECK: user {0x47f3ab5903c4b01c0000002a0000002a, CRC0005$} authentication succeeded.
Apr 14 2008 11:43:06 KERBEROS-LOGIN-CHECK: user {0x47c721234c9608250000000700000007, myusername} is in good standing.
Apr 14 2008 11:43:06 KERBEROS-LOGIN-CHECK: user {0x47c721234c9608250000000700000007, myusername} authentication succeeded.
Apr 14 2008 11:45:26 KERBEROS-LOGIN-CHECK: user {0x47f3ab5903c4b01c0000002a0000002a, CRC0005$} is in good standing.
Apr 14 2008 11:45:26 KERBEROS-LOGIN-CHECK: user {0x47f3ab5903c4b01c0000002a0000002a, CRC0005$} authentication succeeded.
Client Side Logs:
- All Messages -
4/14/08 10:09:12 AM loginwindow[9868] Login Window Started Security Agent
4/14/08 10:15:01 AM loginwindow[9868] Login Window - Returned from Security Agent
- Console Messages -
4/14/08 10:15:03 AM com.apple.launchd[1] (com.apple.UserEventAgent-LoginWindow[9880]) Exited: Terminated
- SingleSignOnTools.log -
kdcmond cannot retreive the computer's local Hostname , retrying ..
Kerberos configuration is up to date
Kerberos configuration is up to date
Kerberos configuration is up to date
Kerberos configuration is up to date
.. and so on
All other logs don't appear to show anything of importance in between the time frame of Login window started and login window exited.
I'd like to know what exactly the client workstation is doing during this time with the server, but it looks like it just hangs and does nothing since nothing shows up in the logs that I can find during this time period where the client hangs. Maybe I can try an Ethereal trace to see what traffic is being sent back and forth during this timeframe. I don't know if this is a configuration issue on my part or a OD / AFP bug on Apple's part since Tiger clients connect perfectly.
Logouts happen immediately, so no problems there on that end. And everything else with the system is working flawlessly (besides the OD Crashing issue which I'm sure everyone is well aware of right now with 10.5.2).
Thank you to anyone that can assist in shedding some light on this issue and I apologize if I didn't provide enough information.
-JesseeFOUND IT!!! Well for our install anyway. The culprit was AUTH2.
In our case computers would (randomly) have the same ..SLOW.. symptoms as your original post described, and the 'Apple Password Server log' on our server showed the same log entries.
It turned out that Single-Sign-On was being screwed up by two Authentication Authorities as applied in the LDAP (Computer and User) Attributes,
and showed up in the log as competing authentications from KERBEROS-LOGIN-CHECK and AUTH2. as follows:
Apr 30 2008 16:22:17 RSAVALIDATE: success.
Apr 30 2008 16:22:17 AUTH2: {0x4818c423083a8ddd0000000a0000000a, user} DIGEST-MD5 authentication succeeded.
Apr 30 2008 16:22:17 RSAVALIDATE: success.
Apr 30 2008 16:22:17 AUTH2: {0x4818c423083a8ddd0000000a0000000a, user} DHX authentication succeeded.
Apr 30 2008 16:22:17 KERBEROS-LOGIN-CHECK: user {0x4818c423083a8ddd0000000a0000000a, user} is in good standing.
Apr 30 2008 16:22:17 KERBEROS-LOGIN-CHECK: user {0x4818c423083a8ddd0000000a0000000a, user} authentication succeeded.
Apr 30 2008 16:22:18 RSAVALIDATE: success.
Apr 30 2008 16:22:18 AUTH2: {0x4818c423083a8ddd0000000a0000000a, user} DHX authentication succeeded.
Now, all the entries in our log (for remote logins) show:
May 2 2008 10:35:39 KERBEROS-LOGIN-CHECK: user {0x4818c423083a8ddd0000000a0000000a, user} is in good standing.
May 2 2008 10:35:39 KERBEROS-LOGIN-CHECK: user {0x4818c423083a8ddd0000000a0000000a, user} authentication succeeded.
May 2 2008 10:35:39 KERBEROS-LOGIN-CHECK: user {0x4818c423083a8ddd0000000a0000000a, user} is in good standing.
May 2 2008 10:35:39 KERBEROS-LOGIN-CHECK: user {0x4818c423083a8ddd0000000a0000000a, user} authentication succeeded.
May 2 2008 10:35:39 KERBEROS-LOGIN-CHECK: user {0x4818c423083a8ddd0000000a0000000a, user} is in good standing.
May 2 2008 10:35:39 KERBEROS-LOGIN-CHECK: user {0x4818c423083a8ddd0000000a0000000a, user} authentication succeeded.
i.e...Single-Sign-On and they're FAST.
no more AUTH2 entries overlapping with KERBEROS.
(local Authentications still show AUTH2 when using WGM)
The solution was pretty straight forward, But only applies if the system is using Single-Sign-On with AFP shared home folders and the Authentication for AFP is set to Kerberos.
Delete ;ApplePasswordServer entries from all user/computer combinations that are having problems.
I actually deleted it from all users and Computers. (Except the Server Computer and Directory Administrator that uses WGM. When I tested these, WGM would not authenticate Diradmin)
It can be done in the GUI from the inspector tab in WGM
find the attibute
dsAttrTypeStandard:AuthenticationAuthority
click to open
If there are two entries: ApplePasswordServer and Kerberosv5 then:
Edit the ApplePasswordServer entry (You can copy the text into an editor and save it for future use if needed, all entries are the same for all computers and users, so you only need 1 copy, and you can paste it back into new entry to put it back,...If needed....maybe for older systems, mine are all Leopard.
Now delete, OK, and Save the changes
After its done, check the logs again to make sure that all remote logons now show
KERBEROS-LOGIN-CHECK:
and they should be FAST.
Hope this helps
Steve -
Open Directory - Unable to login Workgroup Manager
I am unable to login to Workgroup Manager with my diradmin account.
I know the password is correct.
This is on Mac OS X Lion 10.7.2
Everything was working fine last night, but then it stopped functioning. I am able to see all the users, but they are greyed out. When I try to login, I get "The login information is not valid for this server"
The LDAP log shows a bunch of the same errors that it did not show before.
slapd[76]: SASL Failure: GSSAPI Error: Miscellaneous failure.
Please advise. Thank you.
SamsonTry logging in to Workgroup Manager using the local admin account not the diradmin account. If this works, then try accessing the /LDAPv3/127.0.0.1 choice using the diradmin account.
-
AFP login via Kerberos from 10.5 clients to 10.4 server broken
I don't know if this is connected to the problem laid out by William W. Higgins in [Open Directory or LDAP Problem with 10.5 Client and 10.4 Server|http://discussions.apple.com/thread.jspa?threadID=2163645&tstart=0]. The symptoms are... somewhat different, so I'll start a new thread.
We've got a small office with a bunch of 10.5.8 clients, a couple of 10.6 clients, one lone Windows 2000 client, and a number of remote users. I've had my OS X Server 10.4.11 machine (a PowerMac G5 single 1.8GHz, fwiw) working happily as an OD Master for the past few weeks. It's mostly a file server and a back DNS server for our public web site—we have web service turned on, but it's mostly to allow remote users to download files (or upload via WebDAV). The server has a secondary NIC that's hooked up to the cable modem in the DMZ. Everything else is behind the modem's NAT.
We've had some things show up on the logs that are making us want to tighten security, both in the LAN and over the internet. We've gone to HTTPS for the web server and are using TLS/SSL for the PureFTPd server. We closed the SMB ports on the external firewall—something we should have done years ago, probably.
I wanted to switch the AFP service over to Kerberos authentication only. However, when I make that change in Admin Server>AFP>Settings>Access, none of the clients can log on; they get an error reading:
+*Connection Failed*+
+There was an error connecting to the server. Check the server name or IP address and try again.+
+If you are unable to resolve the problem, contact your network administrator.+
Then, after you click on OK, you get the following:
+Sorry, the operation could not be completed because an unknown error occurred.+
+(Error code -5002)+
That code seems to indicate a Kerberos problem.
And when I try to log on as a network user from one of the clients, I get this message:
*+You are unable to log in to the user account "user" at this time+*
+Logging in failed because an error occurred.+
Gee, that's helpful!
Server Admin shows OD and Kerberos as up and running. The Password Service log has the following entry:
+Jan 21 2010 09:18:21 AUTH2: {0x4b4df87638fa1ec80000003400000034, bound-client-machine$} CRAM-MD5 authentication succeeded.+
So the log-on didn't go through Kerberos, for some reason, though it's been working fine that way for weeks.
I tried using +sso_util configure -r KERBEROS.REALM -a diradmin afp+ to make sure that single sign-on was running for AFP. No change.
I can use +dscl -u username -p localhost read /LDAPv3/Users/username+ and read the information on the user's home directory.
I can use /System/Library/CoreServices/Kerberos (or Ticket Agent) to request and receive a ticket. (Side note: does Kerberos really not allow login by secondary short names??? That's a pain! If I add principals for the secondary short names, will it authenticate correctly to the proper account???)
FTP is working. Web authentication is working. If I turn Kerberos authentication off for AFP, everything else seems to return to normal... but then the passwords are passed as cleartext, which isn't acceptable.
So... Is this a bug? Is this a conflict with PureFTPd? Am I doing something wrong?
Message was edited by: David KudlerPost-reboot:
Well, the good news is that the kdc now shows up in the kadmin log as starting up:
Jan 26 11:43:02 localhost kadmind[98](info): Seeding random number generator
Jan 26 11:43:03 localhost kadmind[98](info): No dictionary file specified, continuing without one.
Jan 26 11:43:04 localhost kadmind[98](info): starting
The lack of dictionary file I believe is a minor error, right?
The bad news is that a) clients are no longer able to receive tickets (+*Kerberos Error* Configuration does not specify default realm+) and b) clients can't log on at all—not even via the Finder>Go>Connect to Server... command. Not even when you use the static IP address of the server rather than the DNS name.
DNS still seems to be working. I can get reverse lookup:
*cerberus:~ root#* dig -x 10.1.10.2
; << DiG 9.3.6-APPLE-P2 << -x 10.1.10.2
;; global options: printcmd
;; Got answer:
;; -HEADER<<- opcode: QUERY, status: NOERROR, id: 45389
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 3, ADDITIONAL: 2
;; QUESTION SECTION:
;2.10.1.10.in-addr.arpa. IN PTR
;; ANSWER SECTION:
2.10.1.10.in-addr.arpa. 3600 IN PTR cerberus.limbo.jcf.org.
;; AUTHORITY SECTION:
10.1.10.in-addr.arpa. 3600 IN NS ns1.jcf.org.
10.1.10.in-addr.arpa. 3600 IN NS cerberus.limbo.jcf.org.
10.1.10.in-addr.arpa. 3600 IN NS 10.1.10.1.
;; ADDITIONAL SECTION:
ns1.jcf.org. 86400 IN A 207.58.140.213
cerberus.limbo.jcf.org. 3600 IN A 10.1.10.2
;; Query time: 2 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Tue Jan 26 11:50:51 2010
;; MSG SIZE rcvd: 163</div>
*cerberus:~ root#* dig cerberus.hades.jcf.org
; <<>> DiG 9.3.6-APPLE-P2 <<>> cerberus.hades.jcf.org
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 36453
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 0
;; QUESTION SECTION:
;cerberus.hades.jcf.org. IN A
;; ANSWER SECTION:
cerberus.hades.jcf.org. 86400 IN A 10.0.1.2
;; AUTHORITY SECTION:
hades.jcf.org. 86400 IN NS cerberus.hades.jcf.org.
hades.jcf.org. 86400 IN NS 10.1.10.1.
;; Query time: 4 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Tue Jan 26 11:51:46 2010
;; MSG SIZE rcvd: 93
</div>
*cerberus:~ root#* changeip -checkhostname
Primary address = 10.1.10.2
Current HostName = cerberus.limbo.jcf.org
DNS HostName = cerberus.limbo.jcf.org
The names match. There is nothing to change.
(The DNS also checks out from the clients.)
But.... fubar.
When I run +kadmin.local listprincs+, it lists all of the users and computers I've added—plus a couple that I don't recognize but that seem to be the products of bound computers (the names are along these lines, rather than the actual computer names for the clients: +LKDC:SHA1.59B886209B027XXXXXXXXXXXXXXXXXXXXXXXXXXX$@CERBERUS.LIMBO.JCF.ORG+). But when I run +kadmin.local list_policies *+, it just pops down to the next prompt. There don't seem to be any policies defined. That can't be right, can it????
Further weirdness: I tried rebinding the client that I'm working from (an iMac running 10.6.2), also using the IP address. It goes through the binding process, but no dice—when I try to run System/Library/CoreServices/Kerberos.app, I still can't get a ticket. And the weird bit is, there doesn't seem to be a /Library/Preferences/edu.mit.Kerberos plist file on the client. Well, no wonder the client's Kerberos app can't authenticate the realm—there's no local file in which the data is stored!
I should note that when I rebooted this morning, I first booted to the backup drive and ran Disk Utility; I repaired permissions—more than once—and repaired the disk directory as well. Perhaps I have confused the **** out of it. Though how the permissions got fouled in the first place is beyond me.
I have other things to do (as it says in my profile, I'm the local IT guy by default)—though everyone where I work needs this problem solved.
At this point my options seem to be:
1.) Back up, demote, promote and reload the OD server.
2) Reinstall from scratch.
If anyone has any suggestions in the next hour or so, I'd love to hear them!
Message was edited by: David Kudler -
OS X Server 10.4.11 - OS X Server 10.5.5 - PDC - No Windows login
Hey there,
we just upgraded a 10.4.11 Server to 10.5.5. Some little issues occured afterwards which we were possible to solve but one big problem remained.
Before upgrading the server, Windows XP Clients and a Windows 2003 Server could use our OD user accounts for a domain login.
Now the clients prompt that there is no domaincontroller available or the machine account couldn't be found.
Rejoining the domain works but doesn't solve the problem. The message keeps the same.
The OS X Server is PDC and OD Master.
Some relevant informations:
/etc/smb.conf:
xserve:Users sadmin$ more /etc/smb.conf
; Configuration file for the Samba software suite.
; ============================================================================
; For the format of this file and comprehensive descriptions of all the
; configuration option, please refer to the man page for smb.conf(5).
; The following configuration should suit most systems for basic usage and
; initial testing. It gives all clients access to their home directories and
; allows access to all printers specified in /etc/printcap.
; BEGIN required configuration
; Parameters inside the required configuration block should not be altered.
; They may be changed at any time by upgrades or other automated processes.
; Site-specific customizations will only be preserved if they are done
; outside this block. If you choose to make customizations, it is your
; own responsibility to verify that they work correctly with the supported
; configuration tools.
[global]
debug pid = yes
log level = 1
server string = Mac OS X
printcap name = cups
printing = cups
encrypt passwords = yes
use spnego = yes
passdb backend = odsam
idmap domains = default
idmap config default: default = yes
idmap config default: backend = odsam
idmap alloc backend = odsam
idmap negative cache time = 5
map to guest = Bad User
guest account = nobody
unix charset = UTF-8-MAC
display charset = UTF-8-MAC
dos charset = 437
vfs objects = darwinacl,darwin_streams
; Don't become a master browser unless absolutely necessary.
os level = 2
domain master = no
; For performance reasons, set the transmit buffer size
; to the maximum and enable sendfile support.
max xmit = 131072
use sendfile = yes
; The darwin_streams module gives us named streams support.
stream support = yes
ea support = yes
; Enable locking coherency with AFP.
darwin_streams:brlm = yes
; Core files are invariably disabled system-wide, but attempting to
; dump core will trigger a crash report, so we still want to try.
enable core files = yes
; Configure usershares for use by the synchronize-shares tool.
usershare max shares = 1000
usershare path = /var/samba/shares
usershare owner only = no
usershare allow guests = yes
usershare allow full config = yes
; Filter inaccessible shares from the browse list.
com.apple:filter shares by access = yes
; Check in with PAM to enforce SACL access policy.
obey pam restrictions = yes
; Don't be trying to enforce ACLs in userspace.
acl check permissions = no
; Make sure that we resolve unqualified names as NetBIOS before DNS.
name resolve order = lmhosts wins bcast host
; Pull in system-wide preference settings. These are managed by
; synchronize-preferences tool.
include = /var/db/smb.conf
[printers]
comment = All Printers
path = /tmp
printable = yes
guest ok = no
create mode = 0700
writeable = no
browseable = no
; Site-specific parameters can be added below this comment.
; END required configuration.
/var/db/smb.conf:
xserve:Users sadmin$ more /var/db/smb.conf
# Configuration options for smbd(8), nmbd(8) and winbindd(8).
# This file is automatically generated, DO NOT EDIT!
# Defaults signature: 0cff3e2e008004ba46f9cd36000048ff36880000
# Preferences signature: e0080ddc1594905ae70000000000574
# Configuration rules: $Id: rules.cpp 32909 2007-08-17 23:07:40Z jpeach $
# Server role: PrimaryDomainController
# Guest access: never
# NetBIOS browsing: domain master browser
# Services required: org.samba.smbd org.samba.nmbd
[global]
security = USER
add machine script = /usr/bin/opendirectorypdbconfig -c createcomputer
account -r %u -n /LDAPv3/127.0.0.1
add user script = /usr/bin/opendirectorypdbconfig -c createuseraccount
-r %u -n /LDAPv3/127.0.0.1
domain logons = yes
logon drive = H:
logon path = \\%N\profiles\%u
auth methods = odsam
netbios name = xserve
workgroup = OUR-WINDOWS-DOMAIN
dos charset = 437
server string = xserve
ntlm auth = yes
lanman auth = yes
max smbd processes = 40
log level = 1
map to guest = Never
wins server = 192.168.1.1
domain master = yes
preferred master = yes
os level = 65
enable disk services = yes
enable print services = yes
wins support = no
[netlogon]
path = /etc/netlogon
browseable = no
write list = @admin
oplocks = yes
strict locking = no
[profiles]
path = /Users/Profiles
browseable = no
read only = no
oplocks = yes
strict locking = no
[homes]
root preexec = /usr/sbin/inituser %U
comment = User Home Directories
browseable = no
read only = no
create mode = 0750
guest ok = no
com.apple: show admin all volumes = no
[global]
Error messages in the smb log:
[2008/10/23 13:21:18, 0, pid=554] /SourceCache/samba/samba-187.8/samba/source >/passdb/pdbodsam.c:odssamgetsampwnam(1571)
opendirectorysamsearchname gave -14136 [eDSRecordNotFound]: no >dsRecTypeStandard:Computers record for account 'LAZ-IMAC-20-ZOL$'
[2008/10/23 13:21:18, 0, pid=554] /SourceCache/samba/samba-187.8/samba/source >/passdb/pdbodsam.c:odssamgetgrnam(2040)
odssam_getgrnam gave -14136 [eDSRecordNotFound]: no dsRecTypeStandard:Groups >record for 'LAZ-IMAC-20-ZOL$'!
[2008/10/23 13:21:18, 0, pid=554] /SourceCache/samba/samba-187.8/samba/source >/passdb/pdbodsam.c:odssamgetsampwnam(1571)
opendirectorysamsearchname gave -14136 [eDSRecordNotFound]: no >dsRecTypeStandard:Computers record for account 'LAZ-IMAC-20-ZOL$'
kDSStdAuthNewUser was successful for account "laz-imac-20-zol$"
kDSStdAuthNewUser accountid len(392)"0x49005e2f415db9d900000ece00000600,1024 >35 >131244790597481883925064106712462407867419357228339572195109892970463819598600 08944504249596590147264020481450929886533055945735978363855606054033179354725683 16502940822933278295061864335023431267611975840263121713521174193910961618397774 36761029605188471296273168837776820246633980403453223607235696076277111 >[email protected]"
<CFArray 0x129cd0 [0xa06fb174]>{type = mutable-small, count = 1, values = (
0 : <CFDictionary 0x113180 [0xa06fb174]>{type = mutable, count = 3, >capacity = 3, pairs = (
0 : <CFString 0x129800 [0xa06fb174]>{contents = >"dsAttrTypeStandard:RecordName"} = <CFArray 0x129710 [0xa06fb174]>{type = >mutable-small, count = 1, values = (
0 : <CFString 0x128140 [0xa06fb174]>{contents = "passwordserver"}
1 : <CFString 0x12ca80 [0xa06fb174]>{contents = >"dsAttrTypeStandard:PasswordServerLocation"} = <CFArray 0x129100 >[0xa06fb174]>{type = mutable-small, count = 1, values = (
0 : <CFString 0x129f50 [0xa06fb174]>{contents = "192.168.64.55"}
3 : <CFString 0x10ca00 [0xa06fb174]>{contents = >"dsAttrTypeStandard:AppleMetaNodeLocation"} = <CFArray 0x12a450 >[0xa06fb174]>{type = mutable-small, count = 1, values = (
0 : <CFString 0x12b140 [0xa06fb174]>{contents = "/LDAPv3/127.0.0.1"}
[2008/10/23 13:21:19, 0, pid=554] /SourceCache/samba/samba-187.8/samba/source >/passdb/pdbget_set.c:pdb_get_groupsid(211)
pdbget_groupsid: Failed to find Unix account for laz-imac-20-zol$
[2008/10/23 13:21:19, 0, pid=554] /SourceCache/samba/samba-187.8/samba/source >/passdb/pdbget_set.c:pdb_get_groupsid(211)
pdbget_groupsid: Failed to find Unix account for laz-imac-20-zol$
testparm /etc/smb.conf
Load smb config files from /etc/smb.conf
Processing section "[netlogon]"
Processing section "[profiles]"
Processing section "[homes]"
Processing section "[printers]"
Loaded services file OK.
Server role: ROLEDOMAINPDC
testparm /var/db/smb.conf
Load smb config files from /var/db/smb.conf
Processing section "[netlogon]"
Processing section "[profiles]"
Processing section "[homes]"
Loaded services file OK.
Server role: ROLEDOMAINPDC
Is it possible to try the following?
/usr/bin/opendirectorypdbconfig -c createuseraccount -r %u -n /LDAPv3/127.0.0.1
create user account(%u)
no credentials available
opendirectorypdbconfig error(-14200)
Or that?
/usr/bin/opendirectorypdbconfig -c createcomputeraccount -r %u -n /LDAPv3/127.0.0.1
create computer account(%u)
no credentials available
opendirectorypdbconfig error(-14200)
Or must that lead into those error messages?
Error message in the nmbd log:
[2008/10/29 10:20:03, 0, pid=74896] /SourceCache/samba/samba-187.8/samba/source >/libsmb/nmblib.c:send_udp(791)
Packet send failed to 169.254.255.255(138) ERRNO=Host is down
[2008/10/29 10:20:05, 0, pid=74896] /SourceCache/samba/samba-187.8/samba/source >/libsmb/nmblib.c:send_udp(791)
Packet send failed to 169.254.255.255(138) ERRNO=Host is down
It would be awesome if some of you guys could help us back into the communication between OS X Server and Windows!
Thanks a lot!I had some issues when I initially setup Windows Services on our 10.4 server.
Some things that may help:
1) Check the WINS server box in Server Admin. Make sure your Windows clients have the IP address on your WINS server in their TCP/IP configuration
2) Reset your SID on the server. More info @ http://www.radiotope.com/node/61
2) If the diradmin password has changed, you will have to demote the PDC and recreate it to get the link between OD and samba working again, unless Apple fixed that in Leopard. Of course, you'll have to add all your machines back to the domain after this.
I'm looking at a problem now where just one machine cannot download a roaming profile after I had to restore OD from archive. I'm thinking it is a problem with the SID, bit so far, no love...
-Jon
Jon Auman
Systems Administrator
National Evolutionary Synthesis Center
Duke University
http:www.nescent.org
------------------------------------------------------ -
Xserver Will not allow me to login As Admin or Root locally
Hi all,
I am a regular reader of this wonderful forum but tend to shy away from discussions as I think a lot of you out there are a lot more unix knowledgable than I. I tend to do as much as I can in the GUI only.
After working on many cust. Xservers.
I have recently decided to upgrade our own little office Xserver from a PM G4 to a Mac Mini Intel running 10.4.10 Xserver.
We use this machine as our live lab learning unit to ensure we don't stuff up our client
I normally follow the usual method of setup for a small office Xserver to be used for Web, Mail & File services:-
1. I installing OS Xserver - no services running
2. Then Update to 10.4.10 latest updates etc,
3. Configured dns correctly for registered domain & test fwd & rev lookup working OK.
4. Setup DHCP ok. tested dns working okfrom DHCP bound client.
5. Premoted server to Open Directory Master OK. Kerberos running OK.
6. In this instance I restored Open Directory master from previous working 10.4.10 Xserver PM G4 Open Dir Archive, Restarted server.
Now it gets to login screen but the login screen is frozen for about 10-15 minutes & won't let me type anything in.
Logged Backin as admin get the spinning wheel of death indefinately.
Force Restart the Xserver
Wait 10-15minutes
Login as root.
Noticed kerberos not running anymore.
Demote to standalone then back to Open directory master but problem still occurs after every restart.
Can any one please tell me what I have done incorrectly & how to fix without reinstalling from scratch?
Thankyou
Macbook Mac OS X (10.4.10)Hi Tony,
I tried without network cable before posting, this did not help. Also tried on test network router.
However. I think I have fixed part of the problem.
I deselected the Enable SSL in the SA OD LDAP protocol area (not sure why this was on or whether it is the default setting when you promote to OD master).
Restarted the server.
It now boots quickly & allows me to log in OK.
I then Reset all the LDAP users passwords for OD OK in WGM. Just to make sure.
Restarted the server. Tested All services OK. Ie. Web, Mail, AFP etc.
Wa Hoo!
Came back to add additional user in WGM & now get error:-
"Error of type eDSAuthFailed (-14090) on line 1922 of /SourceCache/ServerManagerUserGeneral/ServerManagerUserGeneral-193.3.2/"
Doh! One step fwd three back.
I do have familiarity with Terminal but tend to avoid using it to try & keep the server as close to Apple out of the box STD as possible to avoid headaches when they update their software.
All services are still running in OD.
In regards to your Questions.
Yes. Keberos realm automatically appeared when I promoted to OD master. As I understand it this tells you your DNS is functioning correctly.
Yes. The diradmin user appears in WGM under ldap.
Yes It is the only server on network.
I normally setup a server on a lab test router /ADSL setup away from anything else to ensure I am not chasing my tail when configuring a new setup.
PS I am slowly getting better at the terminal but because I don't use it that often I keep forgetting the cmds. This is what happens when you run Macs. They hardly ever screw up.
Hoping you can help with the above error as I would really like to learn to repair these issues instead of reinstalling everytime I screw up.
Thank you for your help
Charles -
The login information is not valid for this server
Hello,
i've recently setup open directory for 30 MAC running 10.5 and 10.6
it works sort of fine.
having a few errors with mobility though that's for another thread.
My prob, is that the first time ive set OD, the next day while logging into WGM i had an error and couldnt login with directory administrator username.
i've trieed the following to resolve it:
tried reseting password according to an apple support document
disabled SSL(advice on some none apple forum)
rebooted the server
tried logging in localy from the server itself
checked tht LDAP autehtnication is the first to be checked while authenticaing with the server.
None of the above worked, where i had to wipe my OD, by choosing standalone from the server admin, and then doing it all over again.
today and for the second time i had the same issue.
i've managed to take screenshots of the errors i'm recieving. you can find them attached.
the below errors are ones which appeared while i had my WGM already authenticated and tried to work on it:
i appreciate any help with this matter.
Thanks,To be sure, the server field says your server "name"
you are tying to log in as diradmin
and you are using your password from when you set up the server? This password is also the same local admin password that you setup. -
Can't login to ML server network user from a client
Hi,
The computer name on my customer's ML server was changed post OD installation. Now I can't login with network user credentials from a MacBook.
I also see the old server/hostname displayed in workgroup manager under "location" (see attached).
I've tried destroying OD by deleting it in Server app then re-adding it again but it still shows the old name in WGM as shown in the screenshot above.
I suspect this is related to authentication problems. Should I be running a utility like changeDirData.pl to update the old values? If so, what is the syntaxt?
Old name was: server1.stmarys.lan
New name is: server1.local
I ran the following: sudo /Applications/Server.app/Contents/ServerRoot/usr/libexec/changeDirData.pl -i -s 192.168.2.2 -u diradmin -o server1.stmarys.lan -n server1.local
But got an error: cant contact ldap server to get config infoAfter contacting Apple server support, I was told there were two issues:
1- ".local" cannot be used in a hostname due to conflict with Bonjour
2- Hostnames must have three parts like "server.company.lan" & "server.lan" cannot be used
I wish Apple would inform users with a pop-up about these rules before they waste a lot of time having to re-do everything from scrath. I was lucky enough to have an export of all users.
If these rules are followed from the begining, DNS would auto-configure itself with the appropriate forward & reverse records. -
Subj.
New iMac with 10.5.5 not login on server. Just message:
"You are unable to log on in to the user account "name" at this time.
Logging in to the account failed because an error occurred."
On this imac i can logon as local user or diradmin. But after login as diradmin i see this message:
"The home folder for user "diradmin" is not located in the usual place or cannot be accessed.
The home or User folder may have been moved or deleted. If the home folder is located on the network, the server may be unavailable temporarile. If you continue to have problem, see you system administrator."
Home folder for users created on Mac OS X Server:
afp://serverIP/Users
Path:
username
Home:
/Volumes/Users/username
WT??
Tiger clients login properly.
I'm search all forum and not find answer..
Please, help me or point me on related topic!John-
Just realized I didn't answer your question.
For the /Users directory, I have no ACLs set.
However, for an individual user directory, I did the following:
- select the user directory in the left pane under Share Points
- click the Users/Groups button (bottom center of WGM window) to expose a slide-out window containing available users.
- dragged the owner of the user directory to the ACL window
- set "Allow" and "Full Control" permissions for that user
- then propagated the permissions (drop-down from the little gear in the bottom right corner).
I now have no issues logging in from Leopard clients. Hopefully this is helpful and more completely answers your question. -
Unable to authenticate as diradmin in WGM
Just installed the security Update 2011-002 for OS 10.6.7 Server. After the reboot I was able to login as diradmin into WGM but all settings were grayed out. I could not authenticate to /LDAPv3/127.0.0.1 any longer, using the lock in the top right corner.
/var/log/slapd.log showed a massive amount of errors like these after the update:
Failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Key table entry not found)
/Library/Logs/PasswordService/ApplePasswordServer.Error.log showed the following:
Registration is finished error: (10, -72000).
Not sure if this is related to the update, but turning off and on SSL as suggested by user "xjrguy" in this past discussion worked for me:
https://discussions.apple.com/message/10553322?messageID=10553322
Mind however, that this procedure has to be carried out after every update. Does anyone have a permanent "cure" for this issue?Just installed the security Update 2011-002 for OS 10.6.7 Server. After the reboot I was able to login as diradmin into WGM but all settings were grayed out. I could not authenticate to /LDAPv3/127.0.0.1 any longer, using the lock in the top right corner.
/var/log/slapd.log showed a massive amount of errors like these after the update:
Failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Key table entry not found)
/Library/Logs/PasswordService/ApplePasswordServer.Error.log showed the following:
Registration is finished error: (10, -72000).
Not sure if this is related to the update, but turning off and on SSL as suggested by user "xjrguy" in this past discussion worked for me:
https://discussions.apple.com/message/10553322?messageID=10553322
Mind however, that this procedure has to be carried out after every update. Does anyone have a permanent "cure" for this issue? -
Since 10.5.x, the diradmin user has been wonky. In WGM it sometimes fails to allow me to login. Logging in, it turns out, is quite useful. I like being able to edit all the nice accounts on my system.
Now that I'm running 10.6.3, the diradmin user is unable to authenticate using WGM at all. I'm sure I've got the password right. It just refuses to cooperate. Here are the methods for reset I've tried thus far:
passwd - No success.
mkpassdb - This slot-ID nonsense didn't help at all. Altho I did notice that the slot-ID was almost entirely a bunch of zeros.
dscl - Well, I would try this, but I'm unclear what the complete path is for the diradmin user so that I can actually use this.
Of course, it could be that it's not a password problem at all. Open Directory has the following checkboxes checked in its settings:
-Enable authenticated directory binding
-Disable clear text passwords
-Encrypt all packets
There something I'm missing here?I don't know if this helps:
http://serverfault.com/questions/56830/what-commands-will-change-open-directory- passwords
"apropos password gives me these interesting results:
kpasswd(1) - change a user's Kerberos password
ldappasswd(1) - change the password of an LDAP entry
lppasswd(1) - add, change, or delete digest passwords
passwd(1) - modify a user's password
pwpolicy(8) - gets and sets password policies
saslpasswd2(8) - set a user's sasl password
slappasswd(8) - OpenLDAP password utility"
What does logs say when you try to login using diradmin/root in OD? -
It has no response when I try to login database. I cancel the login since I don't have any choices
SQL> connect apps/apps
^CERROR:
ORA-00604: error occurred at recursive SQL level 1
ORA-01013: user requested cancel of current operation
But it is ok if I login as dba role like"/ as sysdba"
Please advice,
AmyWhen did it last work for application users?
What changed?
Identify the faulty trigger & either fix or DROP it.
SQL> desc dba_objects
Name Null? Type
OWNER VARCHAR2(30)
OBJECT_NAME VARCHAR2(128)
SUBOBJECT_NAME VARCHAR2(30)
OBJECT_ID NUMBER
DATA_OBJECT_ID NUMBER
OBJECT_TYPE VARCHAR2(19)
CREATED DATE
LAST_DDL_TIME DATE
TIMESTAMP VARCHAR2(19)
STATUS VARCHAR2(7)
TEMPORARY VARCHAR2(1)
GENERATED VARCHAR2(1)
SECONDARY VARCHAR2(1)SELECT .... WHERE OBJECT_TYPE = 'TRIGGER' ....
Maybe you are looking for
-
I am used to working on duel monitors. I bought a new MacBook Pro 15' yesterday, the adapter for my monitor, and the monitor is on with the generic background but I can't drag any windows over to it. I can do it on PCs but can't figure out on the Mac
-
Hi, Pls tell me whats wrong with this stmt which is giving null values . SELECT Aaufnr Bgstri Bgstrs Aautyp Aloekz Akokrs A~abkrs into corresponding fields of table it_aufk FROM AUFK AS A INNER JOIN AFKO AS B
-
Exctract information from the title of the document
Hello all, Not sure my post should go in this topic... I need to exctract information from the name property of my PDF document, and put that information it in the footer of my document: exemple : My doc name is : S01_Blabla.pdf I need to do a script
-
IPad Safari - Can't pinch to zoom on only one website
I've always logged into Facebook on my iPad in Safari, but as of last night, I cannot use the pinch to zoom function on www.Facebook.com. I can go to any other website, even the mobile version of facebook at m.facebook.com and the pinch works. I have
-
How to reinstall osx 10.8 in macbook pro retina display
I wanted to reinstall the Mac OSX 10.8 in my mac book pro retina display. No cd's came with the machine and no cd drive to the machine. What is the best way to reinstall the OS?